nldcsc_elastic_rules/__init__.py,sha256=suctq7HZHKIrFLjLPe3z5Uhs1d5YWkW-Ir6WuzhdszI,26
nldcsc_elastic_rules/utils.py,sha256=sxGwPsOgrJbAYWOes85I0FXabGIRwI5e68yhRowl2dE,415
nldcsc_elastic_rules/rules/README.md,sha256=FsDrLRbMS1GiLtJxKEeB2etL1U0JZ053xE3T28iDNIY,2862
nldcsc_elastic_rules/rules/_deprecated/apm_null_user_agent.toml,sha256=P1Ob5RxPCMFTR8Z_fRaFpfLNgZmJekBbg1ihzeuHpeY,1466
nldcsc_elastic_rules/rules/_deprecated/command_and_control_connection_attempt_by_non_ssh_root_session.toml,sha256=L9n522sl79myzYEWozsyKhrtM9oD9n7xlHhsOq_-D-4,3405
nldcsc_elastic_rules/rules/_deprecated/command_and_control_dns_directly_to_the_internet.toml,sha256=qlYl28lEc69nJXQRHz0Z-nstI8SKLXttlll_4N_rnio,2841
nldcsc_elastic_rules/rules/_deprecated/command_and_control_ftp_file_transfer_protocol_activity_to_the_internet.toml,sha256=Ch4I743iqDRnHQBDzBJKPMvGxfD9cscKyWkNHkjChEc,2559
nldcsc_elastic_rules/rules/_deprecated/command_and_control_irc_internet_relay_chat_protocol_activity_to_the_internet.toml,sha256=Owf2oKiHH5RMdHs16mdW5NGlZfqacps7HCUB3NE2WJc,2506
nldcsc_elastic_rules/rules/_deprecated/command_and_control_linux_chisel_server_activity.toml,sha256=BaEtM6vHm5lT-Q6LjfAGz3Ke-TH3rShJ_0OO8mmYtG8,10398
nldcsc_elastic_rules/rules/_deprecated/command_and_control_linux_iodine_activity.toml,sha256=ik7mymIg2c2SRv5OG5UqT-rSRKzJmrcwxRTwLAo8tkc,1841
nldcsc_elastic_rules/rules/_deprecated/command_and_control_linux_port_knocking_reverse_connection.toml,sha256=17PowWGKOMFk8t2VMfTD5IBbPKYYAtAp4RVMyVJnlQY,5148
nldcsc_elastic_rules/rules/_deprecated/command_and_control_non_standard_http_port.toml,sha256=AI74O9bJme8VnypTjmfu4QQMiZIHPfre2Tk4f5z75u8,7807
nldcsc_elastic_rules/rules/_deprecated/command_and_control_non_standard_ssh_port.toml,sha256=SlMBF29t6TwpyGCMKrK3WLKnj7Pny0swdvaS46ufHw8,6704
nldcsc_elastic_rules/rules/_deprecated/command_and_control_port_8000_activity_to_the_internet.toml,sha256=jgENNsuzg4kMtoUEaeBlpqG5F-3eCtwUVBUU4du7cXQ,2010
nldcsc_elastic_rules/rules/_deprecated/command_and_control_pptp_point_to_point_tunneling_protocol_activity.toml,sha256=uzqvyL_JvKsDojc_TCpVZW_4qUhuJ38kwUbsJwUkn4k,1568
nldcsc_elastic_rules/rules/_deprecated/command_and_control_proxy_port_activity_to_the_internet.toml,sha256=N123c9tBYL3PqNd2xMKyRTZpkWdX9gQ4p8b2G7Q3N1Y,2443
nldcsc_elastic_rules/rules/_deprecated/command_and_control_smtp_to_the_internet.toml,sha256=OmyIkHqqO3OdQJLBLARCht0UsqkRlUjOkXUX7lXOHE8,2119
nldcsc_elastic_rules/rules/_deprecated/command_and_control_sql_server_port_activity_to_the_internet.toml,sha256=KDNeLrIR2fb2FNdMzS4mH_Mw6Ky7EhIttMD57ccXiCI,1916
nldcsc_elastic_rules/rules/_deprecated/command_and_control_ssh_secure_shell_from_the_internet.toml,sha256=dT3rK50ocmiI9aTi2AO9kK7SgczzjsAxOFswYRynrjk,2757
nldcsc_elastic_rules/rules/_deprecated/command_and_control_ssh_secure_shell_to_the_internet.toml,sha256=EfQzNOi7HQFnTMZT5QrVj50Sgr6iY6GOYrhLumicXcE,2151
nldcsc_elastic_rules/rules/_deprecated/command_and_control_sunburst_c2_activity_detected.toml,sha256=pNaQkWVGoZY35lRLznl2xv6ZH9mdJNzICpGtKgS_rPw,8473
nldcsc_elastic_rules/rules/_deprecated/command_and_control_tor_activity_to_the_internet.toml,sha256=NF4Fl59KsJLdABK6K5FwmXr1tdu7NXaedQfVnuhTaDw,2329
nldcsc_elastic_rules/rules/_deprecated/credential_access_entra_signin_brute_force_microsoft_365_repeat_source.toml,sha256=0gn1XEwiyKKC2FAt2-86ONDaxDYB2Hue50-8xstoxd0,6831
nldcsc_elastic_rules/rules/_deprecated/credential_access_gcp_gke_service_account_token_created_via_tokenrequest.toml,sha256=0gtvNBTLD6kNS8w5cFyMrRsDvJeHxfzHBuF1X8Fg-fA,4754
nldcsc_elastic_rules/rules/_deprecated/credential_access_microsoft_365_potential_password_spraying_attack.toml,sha256=ieBRSQIw3hk673O5dGw1hx8_JAklxKCYcicpjYjlTHc,1815
nldcsc_elastic_rules/rules/_deprecated/credential_access_potential_linux_ssh_bruteforce_root.toml,sha256=t_1U00NJarwzYBhpUkhLxdhiV2ZoPaNUOZWbY3Wq6Dk,3966
nldcsc_elastic_rules/rules/_deprecated/credential_access_potential_successful_linux_ftp_bruteforce.toml,sha256=5KZIG83OEzbv7XQlFPM2k9HvSTRuO1DK_BPxK52mGn0,9451
nldcsc_elastic_rules/rules/_deprecated/credential_access_potential_successful_linux_rdp_bruteforce.toml,sha256=IIOsk4fCYS3c7XspD_Cw85mb2TnW8cgftuQYHfDV5r4,9703
nldcsc_elastic_rules/rules/_deprecated/credential_access_tcpdump_activity.toml,sha256=HjMr6vfU4ptYXikdukMUug9Um8DBKHXRbBwns9RriJw,1662
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_agent_spoofing_mismatched_id.toml,sha256=lp9561MSJeqCyFJCbkvnqGJrOooZ6wbbnPvGwEHBRqU,5723
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_attempt_to_disable_iptables_or_firewall.toml,sha256=xmyL9oBeFgVTsQiHxVhe6hGmu1nYihiHP_kb8Rz3j_o,1530
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_base64_encoding_or_decoding_activity.toml,sha256=sZ_95szs8hOpomQmmlSUVgG96KgfH9C0YRBS5icSmMw,1477
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_code_injection_conhost.toml,sha256=G6Yz_j7i3ly8I_QxT64BDHoVSIi2aeeVRaZjfIotC68,5188
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_elasticache_security_group_creation.toml,sha256=Jbig4QsukegVaLhlQJPVk_3YiZ2mC16Z-cA6tFGP8TM,6876
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_elasticache_security_group_modified_or_deleted.toml,sha256=oCwORGOoEJ5FEtpeejX5ws89GGYnOiBEtBScxq0rW2U,6681
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_execution_via_trusted_developer_utilities.toml,sha256=0DIN1D3-hRuLx57AlgtkBAOFDQUAEZ_BNMf1TG7rX9Y,1342
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_hex_encoding_or_decoding_activity.toml,sha256=JtVxnHzgZ_O9fPb5DxmRoiFW-Gxqw7ihShvbv4zorMM,1431
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_hide_encoded_executable_registry.toml,sha256=xk3Vjgcv2gyZuI303rhDOFshEJSHM2s0nQvxfiIOBx8,6933
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_ld_preload_env_variable_process_injection.toml,sha256=N12tqet7lSXN0_AL0_CZAc9bbJlZBSyBZ2YMcjXm_Po,6018
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_mshta_making_network_connections.toml,sha256=-beMtzmAlThKxAhtC1QrgL6AQt76_S0sCHtgg1NeNJY,1491
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_posh_obfuscation.toml,sha256=b2zghB8WMYbtriApHNXb42uYJZrDl-mHeGYnKDUd7og,8037
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_potential_processherpaderping.toml,sha256=CrMLt3Zcji5ydCGpt-_p17w8NGWvdpC4i1uQ2vh-Vs4,1842
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_process_termination_followed_by_deletion.toml,sha256=kjpsgmi8BzvNoQCRJJLy0oW61hhZ26cFzxYazPapoxw,8481
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_rename_esxi_index_file.toml,sha256=lkVvaepEX8VSY-h1Z5_VDEXeYcpWSE-oTTopcVCKjGo,7730
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_whitespace_padding_in_command_line.toml,sha256=y1xyhawly-MX1X7wU8r7H33s61qjifj3O7MPD_9qHdg,5213
nldcsc_elastic_rules/rules/_deprecated/discovery_denied_service_account_request.toml,sha256=bT2Roery3Z62Y6m_JRynlpz5fdk09O4dJuY_UH4oKFc,7014
nldcsc_elastic_rules/rules/_deprecated/discovery_file_dir_discovery.toml,sha256=x3H7E_TjCpMrByzKuW5gFWFiSy46etE8-wfW2wy8tNU,4102
nldcsc_elastic_rules/rules/_deprecated/discovery_process_discovery_via_tasklist_command.toml,sha256=xsfztpMiMrhlVsKSJs8jpbpIr-ifl5-kWmYHjXgniSk,1357
nldcsc_elastic_rules/rules/_deprecated/discovery_pspy_process_monitoring_detected.toml,sha256=aYcip-UzP4DUeQcyKKjuy6P1Nxt5AaocUmbFDnuc9XM,7457
nldcsc_elastic_rules/rules/_deprecated/discovery_query_registry_via_reg.toml,sha256=yaFFIcpM9z2Z_xFL3zvhHcLyV9RU8BFtJtE_uhVhZko,1134
nldcsc_elastic_rules/rules/_deprecated/discovery_signal_unusual_discovery_signal_proc_cmdline.toml,sha256=EWTew-GkkXVVxHuhKio4SnW_RWXcJ7sFOxMiH2vn6rU,5847
nldcsc_elastic_rules/rules/_deprecated/discovery_whoami_commmand.toml,sha256=NEUGhhng629IInRexo-_TVOgkNCVoLvO4uaXJ4tlsqk,1256
nldcsc_elastic_rules/rules/_deprecated/execution_apt_binary.toml,sha256=FGsJSS6bii45TNR3PfSXcSXmUqRRW4g0Y01xBzzDpEw,1831
nldcsc_elastic_rules/rules/_deprecated/execution_awk_binary_shell.toml,sha256=jEchJX9Jf9-VQeV1-vssqVRqdQPza-Pcanw-556MCBE,1729
nldcsc_elastic_rules/rules/_deprecated/execution_busybox_binary.toml,sha256=IITvx4ReXM1up2gjvYa8Aec7QUgeDfILHFHeXC58zrM,1665
nldcsc_elastic_rules/rules/_deprecated/execution_c89_c99_binary.toml,sha256=5VLXlYDqDHGC7A9hJDtKHai7WMhCzUzF1-lB1MfyY9M,1791
nldcsc_elastic_rules/rules/_deprecated/execution_command_shell_started_by_powershell.toml,sha256=0SGoxLXFNej0Ffb8VvVq3PCqyvE4Jbay4eC1PifB8FY,1228
nldcsc_elastic_rules/rules/_deprecated/execution_cpulimit_binary.toml,sha256=Za3MQfcjwp3en5LUJsVZEPZxkv-Em2qjubwTLF5G5as,1792
nldcsc_elastic_rules/rules/_deprecated/execution_crash_binary.toml,sha256=-wz6LJVZUeuLHLm6ZPEpavzyPZWbX2IQWyhpSg609i4,1606
nldcsc_elastic_rules/rules/_deprecated/execution_curl_cve_2023_38545_heap_overflow.toml,sha256=zrasn_JYmeB7KA3xDBiFzipxcRYoVJN_L-8TDqosg38,9360
nldcsc_elastic_rules/rules/_deprecated/execution_env_binary.toml,sha256=2qq_ndk9zYy2_D3bli2eyWzNhSgJw7glh1Zq7r5wTJ0,1666
nldcsc_elastic_rules/rules/_deprecated/execution_expect_binary.toml,sha256=BIU_NjT5DFy7XrtG7MJJ_zfkL1YkoKIN9bhbmraY7Zo,1856
nldcsc_elastic_rules/rules/_deprecated/execution_find_binary.toml,sha256=PKvMdNYz4AEJ0ZfZxkwPLbCmQs1OVsBQ5QSZKLD3l8c,1719
nldcsc_elastic_rules/rules/_deprecated/execution_flock_binary.toml,sha256=cePqGZZf4f9-0GobaxgxMcEByc9I7pTOju6KyakcOq0,1769
nldcsc_elastic_rules/rules/_deprecated/execution_gcc_binary.toml,sha256=hqaGdpJ0pDyfe9Z3mLb9YQwRiSvAgiKyJbL1TtS6QJ8,1760
nldcsc_elastic_rules/rules/_deprecated/execution_linux_process_started_in_temp_directory.toml,sha256=Of0Ynl54K-ToNotSxvqmX7ZjEOpHOA4jPJwiTYAWvNs,1495
nldcsc_elastic_rules/rules/_deprecated/execution_mysql_binary.toml,sha256=DhCMP0edAa6Z22WuHQxlg31aDSFfUWOVvG38eMr85m0,1728
nldcsc_elastic_rules/rules/_deprecated/execution_pdf_written_file.toml,sha256=y_Z5_xAnD0GP7W-DNFS_GRhkMxjQ8yg44F-SrLqW6WM,6119
nldcsc_elastic_rules/rules/_deprecated/execution_pentest_eggshell_remote_admin_tool.toml,sha256=YjiX7lVLc9t84kG7zJJj1v3eFzSnJIrIEEACT3WciSc,5396
nldcsc_elastic_rules/rules/_deprecated/execution_reverse_shell_via_named_pipe.toml,sha256=ho8lidMGBTNyv3f5AT29uMlDs5PmO_UEhW0EPNLW9QI,2876
nldcsc_elastic_rules/rules/_deprecated/execution_shell_evasion_linux_binary.toml,sha256=BDWRIS4g_yhCUjj5a50kXAK1vejq0l6gAISLvMTe9hk,12652
nldcsc_elastic_rules/rules/_deprecated/execution_shell_suspicious_parent_child_revshell_linux.toml,sha256=M6bJXbB1RxvG7sNJifxwfKe8rn2WqRU2LOO1apmj17s,5431
nldcsc_elastic_rules/rules/_deprecated/execution_ssh_binary.toml,sha256=wRBTyH4Z06Qgf7uSefoQzWzR_yZLZRXrTAqdu00kkcg,1915
nldcsc_elastic_rules/rules/_deprecated/execution_suspicious_jar_child_process.toml,sha256=g7Y6xvGgfo0MTj6EGYxdDRUtE8VHgTVLnHEU8NSW_w0,5143
nldcsc_elastic_rules/rules/_deprecated/execution_unusual_request_response_by_user_agent.toml,sha256=QvGLDb2997whHyyPUJ6n5F1G7lT8vsWq9IVBVV1baT0,6628
nldcsc_elastic_rules/rules/_deprecated/execution_vi_binary.toml,sha256=rVx9fC5neqddpDzHI3cauhBO0O8eHaW1yeO0GqmPzm8,1693
nldcsc_elastic_rules/rules/_deprecated/execution_via_net_com_assemblies.toml,sha256=WoQfkdoC-v0pHjs5Z1CSF9JdwbEV-N3yiKzIfcZ05Yg,1517
nldcsc_elastic_rules/rules/_deprecated/exfiltration_ec2_snapshot_change_activity.toml,sha256=1G5HDecNxC7OnjHHAmJgTABviAJu6m5l8hrd94MErLQ,5984
nldcsc_elastic_rules/rules/_deprecated/exfiltration_ec2_vm_export_failure.toml,sha256=KGk9FAieIO1d6lNH3b6fBTeWvRrabD22uyL__lW5Tqk,5943
nldcsc_elastic_rules/rules/_deprecated/exfiltration_rds_snapshot_export.toml,sha256=sWun5b-ABOXGlkaBRRU4D7IAhq0oxcSzRiARSbzyVrs,1587
nldcsc_elastic_rules/rules/_deprecated/impact_potential_linux_ransomware_file_encryption.toml,sha256=lOEgZWwU381xlheYMvcJFy9gO17FYaWP720PAL9IlUk,4275
nldcsc_elastic_rules/rules/_deprecated/impact_rds_group_deletion.toml,sha256=mD95apuRrUSCvGO7SUZ8e64qLhoOmAiKB_R_qdV9gtM,6128
nldcsc_elastic_rules/rules/_deprecated/impact_rds_instance_cluster_stoppage.toml,sha256=7qRnEu_TD9VlHR6kud8vFX5BD2D8I1zOulZCX0zd2Lw,6067
nldcsc_elastic_rules/rules/_deprecated/impact_virtual_network_device_modified.toml,sha256=C1-KzN13Hafw3A9-Fg-37R4Bd9STq0xPe7i-vBfo69M,6954
nldcsc_elastic_rules/rules/_deprecated/initial_access_cross_site_scripting.toml,sha256=QzRJdE2DmDPRpcI1GD05Zmv8ouf4zjpWvZFFtp57Nts,1617
nldcsc_elastic_rules/rules/_deprecated/initial_access_login_failures.toml,sha256=_kOXSQ4PleBgeG68TjvkHXKMUomjZlIqBcP01JwEkPM,1382
nldcsc_elastic_rules/rules/_deprecated/initial_access_login_location.toml,sha256=tz_uUjcVOnqB1UK96KKBXIbDjYBNfzaWgbis3_6XeSs,1370
nldcsc_elastic_rules/rules/_deprecated/initial_access_login_sessions.toml,sha256=ANcZlbHYI9rAPIpTOVoBornOTDsvfhgikW-299X-CqY,1358
nldcsc_elastic_rules/rules/_deprecated/initial_access_login_time.toml,sha256=_kljdiUN-qkj6Cl_sl-1JkYo3pxrfmPDQLWq8v9ndWU,1361
nldcsc_elastic_rules/rules/_deprecated/initial_access_rdp_remote_desktop_protocol_to_the_internet.toml,sha256=Qwqv0Iuf1XK8f5-qP2KftZBIVXzV7Rwha_8MtLLG3uE,2587
nldcsc_elastic_rules/rules/_deprecated/initial_access_security_compliance_user_reported_phish_malware.toml,sha256=SpXddEF9aM-zwtgekM6BKIyhU36wurOBk8Xq5foKT_g,6647
nldcsc_elastic_rules/rules/_deprecated/initial_access_ssh_connection_established_inside_a_container.toml,sha256=8IRjm-KURyYajs2vbpg_vlAUEQRwlXN5gpA0DlzcVO0,6893
nldcsc_elastic_rules/rules/_deprecated/lateral_movement_malicious_remote_file_creation.toml,sha256=9psQ-KiT-Mi4cB1RCSHQ-Iy9adDa1vbLqdmG0N3nqh4,1489
nldcsc_elastic_rules/rules/_deprecated/lateral_movement_remote_file_creation_in_sensitive_directory.toml,sha256=cIF5BJVeQFXhcmk-oKcfIu5re0tjf_klOdBctLEIWXA,1956
nldcsc_elastic_rules/rules/_deprecated/lateral_movement_ssh_process_launched_inside_a_container.toml,sha256=tMNkzlHomJ5txCvbGqU1ee9DtSyhLJM2Nsf3rKkEJaA,7081
nldcsc_elastic_rules/rules/_deprecated/lateral_movement_ssh_process_launched_inside_container.toml,sha256=GvLLvGW_QVueYL4Ykj8OkA4_KNUhUXtzEuyF3YiK5Jc,8813
nldcsc_elastic_rules/rules/_deprecated/linux_mknod_activity.toml,sha256=AtOAcnSD1gRdU8oeF1nL7vR-8st7W6Cx_FM9ZqYU5fU,1252
nldcsc_elastic_rules/rules/_deprecated/linux_nmap_activity.toml,sha256=4krPC1MpI7NrhqLNP_CvUd_WpeI7V4Wb_IFbB8xH7Co,1250
nldcsc_elastic_rules/rules/_deprecated/linux_socat_activity.toml,sha256=fpPixypMYwHucgfqOZtKJesiqM45VL5AJ3tm3djHPJE,1283
nldcsc_elastic_rules/rules/_deprecated/multiple_alerts_different_tactics_host.toml,sha256=aRrg5h0s4Q7j2z6jax5wQn5J5_nFWURrHOQrMwygnFQ,5277
nldcsc_elastic_rules/rules/_deprecated/persistence_adobe_hijack_persistence.toml,sha256=2nP_f4Og1giGpAHABBTM2o11PX_ny62lhG6jzQ3jjks,8291
nldcsc_elastic_rules/rules/_deprecated/persistence_cap_sys_admin_added_to_new_binary.toml,sha256=elaLLLJeNPPC2ysluHFsPWClEWUpkkDu4J84UzJ8SnM,4004
nldcsc_elastic_rules/rules/_deprecated/persistence_creation_modif_launch_deamon_sequence.toml,sha256=nl0Jd4DRJzV8ZcFDsu1iaFLsQTpK_EXo5281JPx4jnI,7985
nldcsc_elastic_rules/rules/_deprecated/persistence_creation_of_kernel_module.toml,sha256=28DM-mMhCvG3RwE4aBN9tFNeFebjnkHlxwpCl1fkCgU,1562
nldcsc_elastic_rules/rules/_deprecated/persistence_credential_access_modify_auth_module_or_config.toml,sha256=8qPbbDdQ3xZLMDVVha2djk1F9qEVnN9jLkTvBtwSOSY,7618
nldcsc_elastic_rules/rules/_deprecated/persistence_cron_jobs_creation_and_runtime.toml,sha256=9NuZqZnlMzwYsrsHmFaCufJDQ_EvyjmFm1F0pV020zA,1948
nldcsc_elastic_rules/rules/_deprecated/persistence_etc_file_creation.toml,sha256=aJuHvXlPf_fsjj4kyttJnRq8-7JJgBiZvnDU182TjCI,13625
nldcsc_elastic_rules/rules/_deprecated/persistence_google_workspace_user_group_access_modified_to_allow_external_access.toml,sha256=YHdUhvXuabDtrsacccM1Js8ZjkslHGFALmVMHwNc56A,3682
nldcsc_elastic_rules/rules/_deprecated/persistence_kernel_module_activity.toml,sha256=NAumTSTdPVKKxNj_eawEiJj1O7NBc1BWsK95DlnIuuo,1570
nldcsc_elastic_rules/rules/_deprecated/persistence_mfa_disabled_for_google_workspace_organization.toml,sha256=zjyRwJ_YE4oN4uplodAuwa6Moi65wJYOSV5Yto9PSwA,6755
nldcsc_elastic_rules/rules/_deprecated/persistence_rds_cluster_creation.toml,sha256=qSHGYAesdQea2dCWfeBRM4xHwl-b-POpjWht64aO2no,6748
nldcsc_elastic_rules/rules/_deprecated/persistence_rds_group_creation.toml,sha256=c2M-d7tBZpTZHitlXsObzTNhRlp3WuG2YQ0ojGNOvy0,6138
nldcsc_elastic_rules/rules/_deprecated/persistence_rds_instance_creation.toml,sha256=V3Pf2qnZ4_JVdgIowqXUhcs39hZ5OxWuIhfDagZDdJ0,5917
nldcsc_elastic_rules/rules/_deprecated/persistence_redshift_instance_creation.toml,sha256=F89f3HXUsjlkYCYx56zhlCgjybt78tEe28LKeNHAcoU,6164
nldcsc_elastic_rules/rules/_deprecated/persistence_shell_activity_by_web_server.toml,sha256=1XiZc6_XUztm5qrZuHU01sEh6QAS9TGJ4-SDVR1Vkmo,4985
nldcsc_elastic_rules/rules/_deprecated/persistence_web_server_sus_child_spawned.toml,sha256=d3LOCNIhCW4o3SpIVJ2CfOSYMH1aUkE0_M9K10mNnL8,13193
nldcsc_elastic_rules/rules/_deprecated/persistence_web_server_sus_command_execution.toml,sha256=oYIHBX7v7dh6GvGFaS0ZIrghK3L-bxC16JUl2r8JX8I,12443
nldcsc_elastic_rules/rules/_deprecated/persistence_web_server_sus_destination_port.toml,sha256=MVRMIA-NasK9q6oZng3gvYyiRxq0FkiYPeq4FunggOI,10108
nldcsc_elastic_rules/rules/_deprecated/privilege_escalation_cve_2025_41244_vmtoolsd_lpe.toml,sha256=S5h78uR1GeanlqqdW7Vi4EdZM-yyCkxPMmDHE605Mk4,10325
nldcsc_elastic_rules/rules/_deprecated/privilege_escalation_gcp_kubernetes_rolebindings_created_or_patched.toml,sha256=FPINRz6iSlfk2sHVKA30AmwBavmIuhKHmxFxms6kFh0,1903
nldcsc_elastic_rules/rules/_deprecated/privilege_escalation_krbrelayup_suspicious_logon.toml,sha256=z0OxMwyBUuyP95zI2UFyJTJbPG-DgFxGjLpRP6HWKro,2361
nldcsc_elastic_rules/rules/_deprecated/privilege_escalation_linux_strace_activity.toml,sha256=jFqD1L6vukg2SZmd_9Dl7BOlyvneLEp73MLrn8sPjKQ,1505
nldcsc_elastic_rules/rules/_deprecated/privilege_escalation_linux_uid_int_max_bug.toml,sha256=GhGncqe62MCvlD_he-9coa5ZC7Rk_IPmXMHw9bkTsFc,8113
nldcsc_elastic_rules/rules/_deprecated/privilege_escalation_netcon_via_sudo_binary.toml,sha256=S4Wp681190UbtXAZRfuSVLtZeO9hz2HsdP_rdes23vU,8775
nldcsc_elastic_rules/rules/_deprecated/privilege_escalation_printspooler_malicious_driver_file_changes.toml,sha256=lpOfEQ3OwDo_dF1nPSHEf8PZOfLsszfNrnDDIRoajHs,1608
nldcsc_elastic_rules/rules/_deprecated/privilege_escalation_printspooler_malicious_registry_modification.toml,sha256=AlNF4rCdfNWp4xVMpUYEYHtYq1vGiWwb5-9VqY54qKI,1709
nldcsc_elastic_rules/rules/_deprecated/privilege_escalation_printspooler_service_suspicious_file.toml,sha256=qtpAqD1iwGZ1olWm6JRqrjG3GwoXkxrz1JUdSbhidUM,8518
nldcsc_elastic_rules/rules/_deprecated/privilege_escalation_root_login_without_mfa.toml,sha256=6kHzxusnxxfrjOoAVzHg0ar3eiQfLdnoc35nbxqQFjc,5377
nldcsc_elastic_rules/rules/_deprecated/privilege_escalation_setgid_bit_set_via_chmod.toml,sha256=ByHDIGHwpb4ynYkU_6ZBQKW4Sn5nyPB6yLdtmPcojaE,1779
nldcsc_elastic_rules/rules/_deprecated/privilege_escalation_sudo_buffer_overflow.toml,sha256=pjX7W3KL3ESCm9DBJMcGV4ekW2iVrMXQbzzG6gZKwVs,6845
nldcsc_elastic_rules/rules/_deprecated/threat_intel_filebeat7x.toml,sha256=PgkZ1AHtQPmjxdB3aoq29HBkSf9Z3hesx-_1S2ptQas,6963
nldcsc_elastic_rules/rules/_deprecated/threat_intel_filebeat8x.toml,sha256=P2To_aycPXS9uQVquiZWjQpl-XZGY4DUggWiyuwf3qQ,7564
nldcsc_elastic_rules/rules/_deprecated/threat_intel_fleet_integrations.toml,sha256=apK4wtHuBhL5vRGdIiG5rYIVKca4gYicu3yPdEA9HdU,7588
nldcsc_elastic_rules/rules/apm/apm_403_response_to_a_post.toml,sha256=mrUMKckbwi7Y0xsObsLcTSi8uRN6AMJdohzh2HlqOLk,5352
nldcsc_elastic_rules/rules/apm/apm_405_response_method_not_allowed.toml,sha256=EqkV5e8_xCyIKrYH_CEb-zATbEGbiqMv33M3vXu7ZE8,5400
nldcsc_elastic_rules/rules/apm/apm_sqlmap_user_agent.toml,sha256=x1isWyFpWPMYhLBWkWHHwlfPMaskSMmSwBICbZDG-kk,4951
nldcsc_elastic_rules/rules/cross-platform/command_and_control_common_llm_endpoint.toml,sha256=i67NvjvEFjOYco_nTpuybBf5RNaRhbEZl2VtQacrVhs,9303
nldcsc_elastic_rules/rules/cross-platform/command_and_control_curl_activity_auditd_llm_triage.toml,sha256=5Bzi6ppg7OuqRyKGijsBr_lJ0L4H7fZIegRz8QqXnpo,12297
nldcsc_elastic_rules/rules/cross-platform/command_and_control_curl_activity_llm_triage.toml,sha256=kMpVPhLsjDAf_-8MqXrfGYGV5b849RVojlhj2HM-Qhk,12292
nldcsc_elastic_rules/rules/cross-platform/command_and_control_curl_wget_spawn_via_nodejs_parent.toml,sha256=F1rv4vBk8IxtHd0Y1-mCPGEbfvg3gEDAMSl209KVHvg,8700
nldcsc_elastic_rules/rules/cross-platform/command_and_control_genai_process_suspicious_tld_connection.toml,sha256=XaE05r_C8gKwm9nk8NRWl6csPRzPcwAlK-n6tcRuLHc,6286
nldcsc_elastic_rules/rules/cross-platform/command_and_control_genai_process_unusual_domain.toml,sha256=3CIDH08TuQrzZ-UJzu_IV6oeAhtqdwKhGBsH6h3s0ns,7408
nldcsc_elastic_rules/rules/cross-platform/command_and_control_google_drive_malicious_file_download.toml,sha256=G8qSvQv_MIxlKDNJzZwXKXHAWzp_C_nHHJGPWMu0bu4,6655
nldcsc_elastic_rules/rules/cross-platform/command_and_control_kubectl_networking_modification.toml,sha256=b9iKpr9eoAYXSA8xmhYZLC9jUG-qAPN86-R3QbrEb-I,8759
nldcsc_elastic_rules/rules/cross-platform/command_and_control_pan_elastic_defend_c2.toml,sha256=0W8uWxuSgrb3j2ESMC4OtR5N-cbbcDjBtfvFYRL4aKQ,3247
nldcsc_elastic_rules/rules/cross-platform/command_and_control_socks_fortigate_endpoint.toml,sha256=fd1pd26gUmVOVdP8kD1Opyt1uAdnvoRSNoZHzu_2XJw,3591
nldcsc_elastic_rules/rules/cross-platform/command_and_control_suricata_elastic_defend_c2.toml,sha256=rRjs2L8gFh6C1TdxKOGomr6uNNulHDYSRb70Pvg0mak,4152
nldcsc_elastic_rules/rules/cross-platform/command_and_control_tunnel_qemu.toml,sha256=sDseIjaF4lnGtBHuobFNGYMpG9-oz2ov8mlZ2Jek_Q8,4939
nldcsc_elastic_rules/rules/cross-platform/command_and_control_tunneling_via_tailscaled.toml,sha256=OCEzEsT7jXpwrCKbIvLQc8_q39LGRUfCef9nF8iO62I,6530
nldcsc_elastic_rules/rules/cross-platform/command_and_control_uncommon_dns_request_via_bun_or_nodejs.toml,sha256=pIY5CJOhLgyMIVySCApQd0EN0_k3zsRn_S0fdV66uXw,6583
nldcsc_elastic_rules/rules/cross-platform/command_and_control_wget_activity_auditd_llm_triage.toml,sha256=iuVYydWGFvpX_G67IY43GjmkBhkTM2O5NdCQhMCO_34,12266
nldcsc_elastic_rules/rules/cross-platform/command_and_control_wget_activity_llm_triage.toml,sha256=smu-x12fNsmjD2JpXiWsnpcV8B5lMYh9zfsxjONVDj4,12265
nldcsc_elastic_rules/rules/cross-platform/credential_access_azure_wireserver_unusual_process_connection.toml,sha256=fLKBz6twObk-mGEFWeJHlb7ZS4uE5sqaYxYJpucD_cA,6798
nldcsc_elastic_rules/rules/cross-platform/credential_access_cookies_chromium_browsers_debugging.toml,sha256=8oxxyXqxF-CtqfQM_266IcGc5aLLKXqvkhJNIU9wwd0,6983
nldcsc_elastic_rules/rules/cross-platform/credential_access_forced_authentication_pipes.toml,sha256=E3OV3KeaaJQhdvJEsLSIEaCB6vhm2IHT1E6CxQA8KiA,6598
nldcsc_elastic_rules/rules/cross-platform/credential_access_genai_process_sensitive_file_access.toml,sha256=Q6wzoxp2MAqv41KKVShfOsfOz9I1YgodMueMCO__8fA,7399
nldcsc_elastic_rules/rules/cross-platform/credential_access_gitleaks_execution.toml,sha256=ShkhRIyIP7jmxCe8WPqKRrq6Dco4rtM-m_jwgnBSxHo,7415
nldcsc_elastic_rules/rules/cross-platform/credential_access_grep_recursive_credential_discovery.toml,sha256=IevA49bEh0ZacAwuQ_uue0xmbL-CJtSKdATQZvOM4Bg,5686
nldcsc_elastic_rules/rules/cross-platform/credential_access_multi_cloud_cli_token_harvesting.toml,sha256=dX9gKmLzT7_GuW7v9nF4zLvekl21_R-Y3iYGH4TYqIc,7126
nldcsc_elastic_rules/rules/cross-platform/credential_access_multi_could_secrets_via_api.toml,sha256=UDxRkuNv9Kpb9dZruMKaNi7iIoPgHWZp637-FndNNTs,10075
nldcsc_elastic_rules/rules/cross-platform/credential_access_suspicious_instance_metadata_service_api_cli.toml,sha256=jK-j8N0p4J_bjo8dn5gJnrD_ahLQJuMM0ryDbHeHRh8,8517
nldcsc_elastic_rules/rules/cross-platform/credential_access_suspicious_instance_metadata_service_api_request.toml,sha256=FKY_YDGb4uMWepIREjyXK1kXeInzXzj6T7p1bSmsrEQ,8973
nldcsc_elastic_rules/rules/cross-platform/credential_access_trufflehog_execution.toml,sha256=bJ8LKB1DmhStKBgrGmFD__4yDWuTl9WV0d2nTH3Qy0k,7401
nldcsc_elastic_rules/rules/cross-platform/credential_access_web_server_cloud_imds_ssrf_request.toml,sha256=8xJaCfj-c5hMrPNZGAbk7fJscclMlS8K3vkJmQBtaOw,6670
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_agent_spoofing_multiple_hosts.toml,sha256=CjBNNPnAA2XXadbQhr5i0bicvaKfRUMOJaGzI3V6JLU,5986
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_claude_cowork_vm_boot_image_tamper.toml,sha256=c2PNAmLsuf_NAjVGtBe-BRT7mR1n8pWox2O1agfmro4,5809
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_data_encrypted_via_openssl.toml,sha256=QABMMu8eDs0BJzL91o5IY51rfbF5YhylyMBIuHhgCR8,7052
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_deleting_websvr_access_logs.toml,sha256=T6pVWEsqaJVXxfohVdZK98toDaDZRszpPhpwBzoB8rk,5914
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_deletion_of_bash_command_line_history.toml,sha256=cf5Jab_D_ZMPLv6IG4l0TAPDYJXkOJNR3u51fBVjQAQ,7350
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_elastic_agent_service_terminated.toml,sha256=ryIGfeqE9i_O3Ey9adV-V7G2htZBAFi-UkW4z9gwA6c,9150
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_encoding_rot13_python_script.toml,sha256=Z8coQDx2aYLTRnj5E0D27LeSVT3o-zno24dsytEpUmE,6523
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_first_seen_network_flow_exporter_followed_by_suspicious_source_activity.toml,sha256=bVal4AW4p0hXternF__Hiqdk5mHI1qyP4BsfmkiUbes,9056
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_genai_cli_unsafe_permission_bypass.toml,sha256=D8Q9ut3K4Pgk3WtMUsyyXRhPxCy8TqnKgJaX-2vu2_Q,6109
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_genai_config_modification.toml,sha256=4C_HefwYtoGSjo66hjTOgAUielgGU1-6oHAEEf35o6Y,7593
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_genai_process_compiling_executables.toml,sha256=aFxH9VV81Em1-wblNjnWgU9h7xhFAfd8Cf5DBhonTS8,6902
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_genai_process_encoding_prior_to_network_activity.toml,sha256=oAifITgSsbMvwgy3saAnJNBQfvha-kqmCS5tk0mLmJk,8334
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_long_base64_encoded_interpreter_command_line.toml,sha256=4MHua6n45Pr6HXsYtdaV4MLkx41A1xC3GOp6UolbDr4,6066
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_masquerading_space_after_filename.toml,sha256=irmQx1Wu4aQZNFr-yjSq7ttXItNrawoANqM5AAmOK98,7094
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_missing_events_after_alert.toml,sha256=3r1iQF_JZ3hnwnoHTsQJF6YSBuUhzvsuoiQhafpNw78,4077
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_potential_http_downgrade_attack.toml,sha256=M4uTgs9CK_cpKiJHkrBjVOmCd2pnHKl_x-be5F29Iuk,5871
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_potential_kubectl_impersonation.toml,sha256=8G5q1PqW2tpOUK5SnkqV1KNduW9xBCo5CQf4ebkk5gw,10376
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_potential_kubectl_masquerading.toml,sha256=2v3GRGhLYl9AKMqEowZLl2FNQQV1QwntcREwYmjeB2E,10724
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_processes_with_trailing_spaces.toml,sha256=hSi1QVk4OZ0q6bgs2Bc2pnQ4KkKZ3N_KX1ir_Dredzw,5604
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_timestomp_touch.toml,sha256=SrT-BPeQLFg-E0fBKx0XIEkaXr4AjVLMBfykt-bqAPw,8201
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_whitespace_padding_command_line.toml,sha256=kURAeg-jnNuJ7SFBY9wRY9sYUqlfGAh9WuFocDzuoBo,5915
nldcsc_elastic_rules/rules/cross-platform/discovery_kubectl_permission_discovery.toml,sha256=zJJnO8hKrRiOlR9DrDV2TCRPfl21i5UMu5SzdeqXay0,8309
nldcsc_elastic_rules/rules/cross-platform/discovery_kubectl_secrets_all_namespaces.toml,sha256=A9DzSsDnTXo5qO3HGEJ1TnXE5Sa-ecuJhuScPUoT1Vs,8301
nldcsc_elastic_rules/rules/cross-platform/discovery_security_software_grep.toml,sha256=rN70uRNiuFyUmPg5ZQznHxk5x0iYwechjjC2vKXnVi4,6421
nldcsc_elastic_rules/rules/cross-platform/discovery_virtual_machine_fingerprinting_grep.toml,sha256=Lar-OnEbUE25-5-7jT2Y1OU1S5x5EN4SHfSMLBqAdwU,6688
nldcsc_elastic_rules/rules/cross-platform/discovery_web_server_local_file_inclusion_activity.toml,sha256=UBWLWnejHN3-2gRNv5nvqIwWa0lK-eCoFA39sj4wLoE,11673
nldcsc_elastic_rules/rules/cross-platform/discovery_web_server_remote_file_inclusion_activity.toml,sha256=edvVcAeXd4WrEUmDu9IfZ5Iazlu8MrCGkRWfECgwtfI,8150
nldcsc_elastic_rules/rules/cross-platform/execution_aws_ec2_lolbin_via_ssm.toml,sha256=HsQ9zpJ_TmHdGrb1sBpt07jxW_drCJWfAj6oZtmUZ2g,12551
nldcsc_elastic_rules/rules/cross-platform/execution_aws_ssm_sendcommand_with_command_parameters.toml,sha256=FV9yf5CGFtEGOugprDoaNm7Zj5KcLxm1Hysuf7gFIps,9942
nldcsc_elastic_rules/rules/cross-platform/execution_aws_ssm_session_manager_child_process.toml,sha256=1_uKFIg_-aJO0hhVoWz1qYJk5WtaMDtvautfUrSi2FI,6510
nldcsc_elastic_rules/rules/cross-platform/execution_azure_run_command_script_child_process.toml,sha256=rtOOF79Uvm8f1BOxmq87O7pS_3HPeB8M-aIqG5oZAY8,4257
nldcsc_elastic_rules/rules/cross-platform/execution_azure_vm_run_command_powershell_unrestricted_script.toml,sha256=OxWvGzPvAeUOr7gaSySCFc2bbOTAM9U7U5ZFQsiYEew,5976
nldcsc_elastic_rules/rules/cross-platform/execution_d4c_k8s_mda_direct_interactive_kubernetes_api_request_by_usual_utilities.toml,sha256=_rcVkCJrZ9cFeGJrcf0PBpqIFitxhXAENYl5spZdLLE,8535
nldcsc_elastic_rules/rules/cross-platform/execution_d4c_k8s_mda_forbidden_direct_interactive_kubernetes_api_request.toml,sha256=TtGo0LNJEP33q2LvumKH6f-sY-YJMguO5X4JvSIUSBk,9242
nldcsc_elastic_rules/rules/cross-platform/execution_d4c_k8s_mda_kubernetes_api_activity_by_unusual_utilities.toml,sha256=wlm8McI9jSUasYT0xRJwMCaSXoibqPJdCd2qAh_5FY0,10453
nldcsc_elastic_rules/rules/cross-platform/execution_d4c_k8s_mda_service_account_token_access_followed_by_kubernetes_api_request.toml,sha256=6Vn4n9RDP5QbmuMwPZh7LqdRukAjG7D7X19D6ilQpUA,8438
nldcsc_elastic_rules/rules/cross-platform/execution_git_exploit_cve_2025_48384.toml,sha256=Y4tNMu3No5oXYb4zF2vvKFsClBMDxddnrAsZ8wuxaT4,7310
nldcsc_elastic_rules/rules/cross-platform/execution_kubernetes_direct_api_request_via_curl_or_wget.toml,sha256=cWXdOMOiMIkmKomThke5f_ir0lhlHAlJMPqhWoIaLsI,10337
nldcsc_elastic_rules/rules/cross-platform/execution_nodejs_pre_or_post_install_script_execution.toml,sha256=2KfHxau7i7L5VAnrwVdB0e5TTfp5Ie3_I8uUJBt_tk4,6028
nldcsc_elastic_rules/rules/cross-platform/execution_openclaw_agent_child_process.toml,sha256=1Kn40_8XChAfcXWEXrtFWEmbAT_-F9lDFVwgujBRzVg,6313
nldcsc_elastic_rules/rules/cross-platform/execution_potential_widespread_malware_infection.toml,sha256=OVTPC91rFyVLzHwKI1i0R1CEMmFsAfDCmcJqocPGTGQ,6145
nldcsc_elastic_rules/rules/cross-platform/execution_privileged_container_creation_with_host_reference.toml,sha256=FgYMDNNZTdcXLNMJvAAjYnJF9M4JVzlbMDRwBxvMwgc,9369
nldcsc_elastic_rules/rules/cross-platform/execution_register_github_actions_runner.toml,sha256=PS1h5Ft1tGl3gGHpuB_h5Ng7M16Qef_XaFb34c6AFWA,5051
nldcsc_elastic_rules/rules/cross-platform/execution_revershell_via_shell_cmd.toml,sha256=1qjdIMqNpx1EANiDbvbBGSCarJbykOHBVqt6o1ME59E,5452
nldcsc_elastic_rules/rules/cross-platform/execution_sap_netweaver_jsp_webshell.toml,sha256=BvBLxOWw3Lr4LcT2c8kryCVvnziwNfpGsAtmoO922Hs,4427
nldcsc_elastic_rules/rules/cross-platform/execution_sap_netweaver_webshell_exec.toml,sha256=CYaRcb7Ewku30WSPqW5_F0ZR_cusR4AV_QFvT6irTDo,5752
nldcsc_elastic_rules/rules/cross-platform/execution_suspicious_java_netcon_childproc.toml,sha256=tgwP0Q_1H2fqxwrexPY9sP3mudf6vzLyzOvRJdc9Fmk,7956
nldcsc_elastic_rules/rules/cross-platform/execution_suspicious_process_execution_by_zoom.toml,sha256=P5VR-pWxM0opZ3Dw4DhB7K_LAB96shOERW-B9eKlFOw,8536
nldcsc_elastic_rules/rules/cross-platform/execution_suspicious_python_command_execution.toml,sha256=bD5dMq8gbTHJqIaRvv99qX0tVvxXTCWeWC29nXOBTQY,8121
nldcsc_elastic_rules/rules/cross-platform/execution_via_github_actions_runner.toml,sha256=BOIYArq1aM-GJDgENaGAx3uKcGekard07jy8JIB9mB0,10728
nldcsc_elastic_rules/rules/cross-platform/execution_via_github_runner_with_runner_tracking_id_tampering_via_env_vars.toml,sha256=WPIol3bWMrDEBjLI8gXVmlKL71Jut5tArshzOeiihAs,10360
nldcsc_elastic_rules/rules/cross-platform/exfiltration_potential_curl_data_exfiltration.toml,sha256=MAJ6o4UDOmZ7Xusy18HeqrEM-fAFw1TX6jtDHZNM_b4,10636
nldcsc_elastic_rules/rules/cross-platform/guided_onboarding_sample_rule.toml,sha256=p1GJtIMLs7uK8ueRMlMk5OP-sjUstczOGzDeo-nXdpU,4364
nldcsc_elastic_rules/rules/cross-platform/impact_alert_from_a_process_with_cpu_spike.toml,sha256=RCJLAjLkKBt4XZ25bqgYc1oSxajH6S-QlYanfZ6YqYg,6839
nldcsc_elastic_rules/rules/cross-platform/impact_alerts_on_host_with_cpu_spike.toml,sha256=k4tDLC14hgJT93MG3l3GgyOIlBMQtvud9ICy7bCxa2E,6616
nldcsc_elastic_rules/rules/cross-platform/impact_hosts_file_modified.toml,sha256=lv8X8fKHCsD_7vktlISLJUyKad6KbI9X-wJMl_OH6IA,8063
nldcsc_elastic_rules/rules/cross-platform/impact_newly_observed_process_with_high_cpu.toml,sha256=XTZ_a52bINdcweq_ob0ynRioqdAISmOBA8ZGDh008KA,6222
nldcsc_elastic_rules/rules/cross-platform/initial_access_azure_o365_with_network_alert.toml,sha256=9emHOKfW4m2xEYQRXxWm0Vkn_w16osTl92o5HLt623U,6838
nldcsc_elastic_rules/rules/cross-platform/initial_access_elastic_defend_alert_genai_utility_descendant.toml,sha256=nPlbi5lHRaR2eG2ziJ0wjXk7oZaCEYIkmYU9XNIixpQ,5672
nldcsc_elastic_rules/rules/cross-platform/initial_access_elastic_defend_alert_package_manager_ancestor.toml,sha256=y5JFxO77iqjJQGK3CMDv2bXascucQPUtc97tBeiVbco,5870
nldcsc_elastic_rules/rules/cross-platform/initial_access_execution_susp_react_serv_child.toml,sha256=YtASos7Sls6cJDotfCWKiilj__smyrDe0EcbHTm5rqA,10758
nldcsc_elastic_rules/rules/cross-platform/initial_access_exfiltration_new_usb_device_mounted.toml,sha256=zxxOU4p7u-RiQiCN0nnvEi4sYG7oaOKWfbz4rBmkqzs,6441
nldcsc_elastic_rules/rules/cross-platform/initial_access_file_upload_followed_by_get_request.toml,sha256=qIAOvu6KEgjsDeM-Sgucd_yq5rpmLxmC_VJwRXcX2qU,9266
nldcsc_elastic_rules/rules/cross-platform/initial_access_fortigate_ssl_vpn_login_followed_by_siem_alert.toml,sha256=xFuz7FCmIRVADLDPMzhQRBx3BEB15vES6ojkhhRm0Bg,3257
nldcsc_elastic_rules/rules/cross-platform/initial_access_ollama_api_external_access.toml,sha256=66vGTH9fM6G1dbBjVni5n4bgrdNIJWn9eKudq6o7qc0,3701
nldcsc_elastic_rules/rules/cross-platform/initial_access_papercut_java_class_file.toml,sha256=7xLugMVb72-ag8LBcZVE02_duXjAx4sndRzruXdsSrc,5598
nldcsc_elastic_rules/rules/cross-platform/initial_access_zoom_meeting_with_no_passcode.toml,sha256=7Jo1NdCRNmVb28Lzl94XAWSwHSUsDQCuVzs31Squm6s,6093
nldcsc_elastic_rules/rules/cross-platform/lateral_movement_multi_alerts_new_srcip.toml,sha256=LPq8aUSYcB-pjgx6faDV6dmHUXoG3dJt-4Z66Ci27M4,5186
nldcsc_elastic_rules/rules/cross-platform/lateral_movement_multi_alerts_new_userid.toml,sha256=IKkZ1ucNSpNe2oIwe_oZDF7bP_Ua1erutbykMYOKJlI,4459
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_by_host_ip_and_source_ip.toml,sha256=HJ4X6El43HzLtqWXy5nSKeJ7SyPv3f78ICVfeOVnCBA,6440
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_edr_elastic_defend_by_host.toml,sha256=OE_KUHHu72pOFhukQ8BHD0yWjnuhQ0k837q6LuYe63g,6519
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_edr_elastic_same_process_tree.toml,sha256=vm3r8H1j8HB1He7vMAVVHk-Kt0wZuHpzguotlvACDmI,6150
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_elastic_defend_netsecurity_by_host.toml,sha256=1gqCAeQ68LCorOIdEFFtZtXPYBqU6cQo_1_KlMfZjE8,7697
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_email_elastic_defend_correlation.toml,sha256=jnpxlfCXWUs1qRPcqMJ6VcRojP1dpEt8IfcqrXZcLj4,4429
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_from_different_modules_by_dstip.toml,sha256=MvqYs87iU6c8GMTqRenzwBi5fMCNOGGcVtCwA2Hm9yE,6038
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_from_different_modules_by_srcip.toml,sha256=e1YZgxUWPRWWMTF5LFZPNdqmBc4i9SHp4_yz5UuJ_aM,5956
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_from_different_modules_by_user.toml,sha256=Aq1xYXJ227BoJnuUaBeH9ycz9Lm_2F16CJ3yFaxB3oo,6808
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_involving_user.toml,sha256=IUKV1MrifgNTpVZHeY6Q7iaTRAz-fUGX3QQ9frLpc94,6604
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_llm_attack_chain_triage_by_host.toml,sha256=WsWWxgdQ3ecjaOAdmrvItS8JFB_tqd2gwQSw7kM6j-8,10507
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_llm_by_user_entity.toml,sha256=_nNAX634Nh8UVSwIiuFdleSob15QAAiTJyjgwpQ10RI,7464
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_llm_compromised_user_triage.toml,sha256=-rTdii0TBbbgycyuHerqUJjy_DmpqiFIVL4drfcj_sI,10302
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_risky_host_esql.toml,sha256=wm1CmgLnxoe5nMuwm5ndpFT6bUgMhkj1tjNLVc1vXHc,7430
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_same_tactic_by_host.toml,sha256=-1DL5gi_-OD1sair7oXRuEnVNkFoo94qmKNSiRnJT0Q,6721
nldcsc_elastic_rules/rules/cross-platform/multiple_elastic_defend_behavior_rules_same_host_prevalence.toml,sha256=iyvbSQyb6k-AqvqWat5qZ7ajSIVAkddtEIIsd3VgghI,4925
nldcsc_elastic_rules/rules/cross-platform/multiple_external_edr_alerts_by_host.toml,sha256=-vekWIajhv6c-lH-UMLc3cDCNjiLke2vjOdOaeRtneI,6860
nldcsc_elastic_rules/rules/cross-platform/multiple_machine_learning_jobs_by_entity.toml,sha256=80F7u13FTm2HsJpSSJ74YBJgH9KrX61u_w2AsH-kH4o,5499
nldcsc_elastic_rules/rules/cross-platform/multiple_vulnerabilities_wiz_by_container.toml,sha256=jY36zjOHgrpIQ3z17b7bJbCJ7F6mLeyPLeDg9aLflZY,5157
nldcsc_elastic_rules/rules/cross-platform/newly_observed_elastic_defend_alert.toml,sha256=tTdmgRPFe_AHa61Seid1OCicLGxlhtQc_qhVT-sX4D0,5181
nldcsc_elastic_rules/rules/cross-platform/newly_observed_elastic_detection_rule.toml,sha256=zqRT4lMV6iqlUA7uehvQrdd2-jHS0zludi5Rm03juCE,4748
nldcsc_elastic_rules/rules/cross-platform/newly_observed_fortigate_alert.toml,sha256=YCZ24ZCCUGz8dCWZf3LeEY60uCdmbz_XK0SHArem2Rk,4238
nldcsc_elastic_rules/rules/cross-platform/newly_observed_panos_alert.toml,sha256=NnxhrUqcu7YGWAvajrmnMm_bqsV3ZCsLLiUAnYaqleI,3855
nldcsc_elastic_rules/rules/cross-platform/newly_observed_suricata_alert.toml,sha256=bZMzLrZSptiXR-F60RHi2tctGI_jL1EA1ClHYqV7big,3843
nldcsc_elastic_rules/rules/cross-platform/persistence_shell_profile_modification.toml,sha256=X2J_WabNyDIqiV6VZ_gRSoKeLU33h5RaganaoPjDHjw,6347
nldcsc_elastic_rules/rules/cross-platform/persistence_ssh_authorized_keys_modification.toml,sha256=GvVNmJnJbu8S9Cx-4rCDcZ88p1f2cYiBhqUGAbFahWA,6993
nldcsc_elastic_rules/rules/cross-platform/persistence_web_server_potential_command_injection.toml,sha256=RXhBSZRx8yvJhB5O4Q3r8oceF4K6J9cJpD7Vsvc6s2A,15261
nldcsc_elastic_rules/rules/cross-platform/persistence_web_server_potential_sql_injection.toml,sha256=uMH9wxexRlLB3-IlHPfo1p0UyLLXXYgviDbHu46BOIM,12277
nldcsc_elastic_rules/rules/cross-platform/privilege_escalation_echo_nopasswd_sudoers.toml,sha256=15h9RYLUwEDpB8_pS-IHP_BEAKJjLktuBGySKt6ceGw,6288
nldcsc_elastic_rules/rules/cross-platform/privilege_escalation_setuid_setgid_bit_set_via_chmod.toml,sha256=iXmQo_cOfW-MF3YCCNTjDwVw9UQ0htQvZ2hCVR3fa9w,7275
nldcsc_elastic_rules/rules/cross-platform/privilege_escalation_sudoers_file_mod.toml,sha256=sYE7E9bujvu_GcMVZHPgEX2VcHdR3p_dXH6XOePQVRA,6524
nldcsc_elastic_rules/rules/cross-platform/privilege_escalation_trap_execution.toml,sha256=MebEmjamvCuMO_N_GkFiscPnfcU5jtiT6Lw1dOzKedY,5920
nldcsc_elastic_rules/rules/cross-platform/reconnaissance_web_server_discovery_or_fuzzing_activity.toml,sha256=CbEpwnFo3Du-y9l6nbhV0fTBt62lSidU3fuJbNJABhY,6898
nldcsc_elastic_rules/rules/cross-platform/reconnaissance_web_server_unusual_spike_in_error_logs.toml,sha256=4bKtT60_GdoO2_55fkFef-IWsKN6JLTHkSk7KpsLdRs,6410
nldcsc_elastic_rules/rules/cross-platform/reconnaissance_web_server_unusual_spike_in_error_response_codes.toml,sha256=EubumiVWf86LrUYmytTwHnErYKxtyMQ2wD6JVLmI8Rg,7067
nldcsc_elastic_rules/rules/cross-platform/reconnaissance_web_server_unusual_user_agents.toml,sha256=6A02fcc3jFL_L-eN4SewO_uha-s-CycP-Iw0UuQDwwc,9453
nldcsc_elastic_rules/rules/integrations/aws/NOTICE.txt,sha256=J_TLlzy-3FynutCsreov6dyNdxzN0cayBHv4dv9HzbU,1307
nldcsc_elastic_rules/rules/integrations/aws/collection_cloudtrail_logging_created.toml,sha256=tlApZe7dD9kDnmjz8rvvN_igpFlPRs4BHiT6zP7Nck4,5491
nldcsc_elastic_rules/rules/integrations/aws/collection_s3_bucket_acl_public_access_new_identity.toml,sha256=HpgzDtA75_NKRuO2X8AbBbb_ZViIjS2mPofge9-AYzY,4698
nldcsc_elastic_rules/rules/integrations/aws/collection_s3_unauthenticated_bucket_access_by_rare_source.toml,sha256=qq_wYxXES5y_eKi2Kdko_MHxAWKrqteAQybE__DhHLM,7938
nldcsc_elastic_rules/rules/integrations/aws/credential_access_aws_getpassword_for_ec2_instance.toml,sha256=FW9Np7Z4zmwauUusAAG4RbTZhALIbmBlf2H--AwAQeA,6464
nldcsc_elastic_rules/rules/integrations/aws/credential_access_cognito_unauthenticated_identity_pool_credentials_issued.toml,sha256=KvdUyjHzcWGxzvZB4WZCBejJunSuYrLgyMreeJpVeDM,8097
nldcsc_elastic_rules/rules/integrations/aws/credential_access_credentials_in_s3_bucket.toml,sha256=GIFVo_bszxiKnFzpzsxPExWNci8z0eToYAViGVwP-Aw,6366
nldcsc_elastic_rules/rules/integrations/aws/credential_access_get_federation_token_followed_by_console_login_via_federation_exchange.toml,sha256=9AUZXVFMdpnIsIP9sEV43pE6lNsLSjRsohzt4aHpGDA,5216
nldcsc_elastic_rules/rules/integrations/aws/credential_access_iam_compromisedkeyquarantine_policy_attached_to_user.toml,sha256=ohsmvslMRc14tJ9vfz-p0BdC9cFQzzjWR6HBGzajt_E,5338
nldcsc_elastic_rules/rules/integrations/aws/credential_access_iam_long_term_access_key_correlated_with_elevated_detection_alerts.toml,sha256=w_kP0R_2fUhIYYDwy3XR8I97YOh2aGHGsQmuZ5Xs3xM,7403
nldcsc_elastic_rules/rules/integrations/aws/credential_access_iam_long_term_access_key_first_seen_from_source_ip.toml,sha256=Vv1LhPXN43JucVV-YgHh3_Bjo25sXCvXPK80CP0CKj8,5568
nldcsc_elastic_rules/rules/integrations/aws/credential_access_iam_user_addition_to_group.toml,sha256=2OpeqUU4jP15gENwqaXBrL3eqlbPOSYnDByjL9-9JZ0,5982
nldcsc_elastic_rules/rules/integrations/aws/credential_access_new_terms_secretsmanager_getsecretvalue.toml,sha256=a5GuwZG5LirGqItadba0oS537KqKBdp5P7bNIic3xuk,7902
nldcsc_elastic_rules/rules/integrations/aws/credential_access_rapid_secret_retrieval_attempts_from_secretsmanager.toml,sha256=13JIb_XEvoh1N25I-mGlgR173xp9kXnsfHQJz9qLluE,7338
nldcsc_elastic_rules/rules/integrations/aws/credential_access_retrieve_secure_string_parameters_via_ssm.toml,sha256=_L_nwwc2gwVoFhRqbPn-WFB7IVpeWl6mkXsEL_RzOIk,7725
nldcsc_elastic_rules/rules/integrations/aws/credential_access_root_console_failure_brute_force.toml,sha256=Gdp1R7lv8Hhr5gNFzQ1SuubpjdN-byI7dgrM9IgXpqM,8230
nldcsc_elastic_rules/rules/integrations/aws/credential_access_root_console_password_spraying.toml,sha256=uo3bDygfvepSN6_QWDO-23WxekcJgxOO_U-HTk3_tQI,7095
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_bedrock_automated_reasoning_safety_policy_tampering.toml,sha256=ogkzo0rOqfhjpVT7f4Mp-_a0xkiN9P_LLZWU4mOLGDM,6238
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_bedrock_guardrail_deleted_or_weakened.toml,sha256=JChgI-v6Pcg9eCFY-hY41hf4KYW2JSlg7hNgXJQDy1Y,5570
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_bedrock_model_invocation_logging_disabled_or_modified.toml,sha256=mqZo9tPHd6cRoaXeOXzkAdq_JNLNPFaj_IPlR5-X6Wg,6281
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_cloudtrail_logging_deleted.toml,sha256=GFPZc3W43YO6f6kKYGNcRtzut519A8vLxmG8dbpsbqI,4874
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_cloudtrail_logging_evasion.toml,sha256=cg_CBaBTVzbPprsqqkfvLzsUKHmshaAyU680NJUbRSQ,7502
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_cloudtrail_logging_suspended.toml,sha256=7xTbqTFM_cET2tJLXNucXwGStrdNAV3h4mXccAp8YrY,4815
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_cloudtrail_management_events_disabled_via_eventselectors.toml,sha256=LHITPhzm-WTKXS5QnHitR6cAS0CO_LwrHzoDn52t0qQ,5743
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_cloudwatch_alarm_deletion.toml,sha256=FlxmPg-dKzLAuo-a4KmjIFBPXEt0e-Y1QN424LLZ6vM,8592
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_config_service_rule_deletion.toml,sha256=XBE9jXZSfP5tjUUl8ZJGrRAWyxN8qCf3jHxVqh-Epio,7804
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_configuration_recorder_stopped.toml,sha256=VE_FZ4dE5c1ak8ddttWKsGsfwo2uaw993eZU2tUKznk,6637
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_detective_graph_deleted.toml,sha256=7ZJ0Fbm4OmjmDaTxVhJGECYKRkrRkGi_pSu-bH6Dl3M,4320
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_ec2_flow_log_deletion.toml,sha256=4usJNq-sXD302ruJWIpV9XJyyROwpbYnT_wQicNXsIE,6378
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_ec2_nacl_all_traffic_allowed_new_identity.toml,sha256=34Q8MoBnu3oiNeQdyHZ4nf3SDLEPeps58XWeY4U3dW4,5473
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_ec2_network_acl_deletion.toml,sha256=Otl2_u-RpLCswuZhk9bP9fkbR-ge-tASaNl0cZ8QB20,6639
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_ec2_serial_console_access_enabled.toml,sha256=SpRMZnjhdQIb4xzZIk0hFqy3MGDLujUHiWuRlMOuHh0,7281
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_eks_control_plane_logging_disabled.toml,sha256=MPRKa0bFRmNiIO4dH0RSReZlFqfgWyjjHzYRWq7wvZc,3687
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_guardduty_detector_deletion.toml,sha256=bBkCzt3xWh_SES_Xk6Nee-_rJoiJQjp573BjDjoGpPQ,7141
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_guardduty_finding_suppression.toml,sha256=hMR_SDWEIOEJEtkKX7wTGwc5pwceCGESqO9yMyImTws,6470
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_guardduty_member_manipulation.toml,sha256=lu9cgaD1PlxvE8MSN4o2nCh6dqJ4HIiqweLrpnO14-0,7599
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_guardduty_publishing_destination_deleted.toml,sha256=gd3D3dj_bZkAJVV3d8p7jFcjj7IUi8Zd-th0PykrciY,4591
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_guardduty_threat_intel_set_deleted.toml,sha256=SaSkax3--Z3umkLl7it7UXUBJQ_AgdCvLAJzSd4e1jU,4280
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_iam_account_password_policy_deleted.toml,sha256=V1kyHMLhq0ypnX8sbC7XS3y6BahBnbHjVqieWdxl1KA,5283
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_iam_managed_policy_deleted_unusual_identity.toml,sha256=iUIUjRTBcLaVmEVUclo6JZhfpXDuxR7hK965ZBwuadw,5701
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_organizations_leave_organization.toml,sha256=o5SHvjspOuOwX6ngfzQBKKeweIZP7QRGh0EiCj4WgJI,6224
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_rds_instance_restored.toml,sha256=3U4Zr6Em_RD4np254zNrrEuQwx_LINAEh56rw3NN8j0,9458
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_route53_dns_query_resolver_config_deletion.toml,sha256=RqFgnHFOv16IFjCMqTu43pr_DCddka_kx_4R1zHBiGM,7376
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_s3_bucket_configuration_deletion.toml,sha256=NtIJ1xOLokXobFI3SBdfueBfkiGa56R0Wv0fAhIm7Rw,9247
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_s3_bucket_lifecycle_expiration_added.toml,sha256=qAsq_Eq-kSc9rHPHWFvUgsGyA9nrPvLi3S3JfVmHaBk,9256
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_s3_bucket_server_access_logging_disabled.toml,sha256=4bT13eTeXoxUqCsCDlGOVubI2Si9lKMIAzikyZE6JII,7476
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_securityhub_disabled.toml,sha256=XNwIym0mDU5XkFfMcUBB7Bhc4ua2DazHaaDryuLRSyw,5361
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_sqs_purge_queue.toml,sha256=BXWKxPLQasZn7LFqJxNbEMpB1I6O7OyE7HurEOO5f_0,6254
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_sts_get_federation_token.toml,sha256=RlwJ2hS-oH-yOoopK-ZMuHb_fndXZwmhIE0WznZAnmk,7073
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_vpc_security_group_ingress_rule_added_for_remote_connections.toml,sha256=IZO4S_CeWNokYgcLh3qL0_Pg-NZKKCEBteMf5EuGw_I,6874
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_waf_acl_deletion.toml,sha256=hv9yAdK1BdBJvKvfVWJStKAsywmfptSnKx6iUrH9G-0,8676
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_waf_rule_or_rule_group_deletion.toml,sha256=PuhEaJctT4Sy0ycx5SO73LuZAKV_fpGP1zOnqqhZEi4,7863
nldcsc_elastic_rules/rules/integrations/aws/discovery_backup_enumeration_via_long_term_access_key.toml,sha256=2FktnDmmJvy44qNCaEA0fPBvxjbgPkZNLG5MAsCILi4,4938
nldcsc_elastic_rules/rules/integrations/aws/discovery_bedrock_model_recon_and_invocation_via_long_term_key.toml,sha256=DW7z3ck72A3ug2cz5e-BlvjNbDFg1h400DP7S9vZgTc,6552
nldcsc_elastic_rules/rules/integrations/aws/discovery_ec2_deprecated_ami_discovery.toml,sha256=5sNYjTFe-aLyfVN7XcOjezDs-X4AZWPtxrgi4AX72so,6151
nldcsc_elastic_rules/rules/integrations/aws/discovery_ec2_userdata_request_for_ec2_instance.toml,sha256=RSckh0vykL2MA5ynvmzQ5ho82pu_FdDuxQCLEkAGTTc,7240
nldcsc_elastic_rules/rules/integrations/aws/discovery_iam_principal_enumeration_via_update_assume_role_policy.toml,sha256=t_qibN70nsgLiC6qKVSQGSepfRIkmM8jwCVKc7YFsjs,8376
nldcsc_elastic_rules/rules/integrations/aws/discovery_multiple_discovery_api_calls_via_cli.toml,sha256=jK_eD5EiHV-nOOEbJOygmfsk0iCIXzSj0H8t9m94BZE,12831
nldcsc_elastic_rules/rules/integrations/aws/discovery_new_terms_sts_getcalleridentity.toml,sha256=ZcpTUA2dQtARWzJxjQ7AbyXGtCYHeSjYda6C0llhxEI,7393
nldcsc_elastic_rules/rules/integrations/aws/discovery_new_terms_sts_getcalleridentity_ec2_role_new_source_as.toml,sha256=Udi3Qu3G6Szx1hJrXNVDwadcmshULsG-QMkIqIGuXNY,5563
nldcsc_elastic_rules/rules/integrations/aws/discovery_new_terms_vpn_asn_discovery_api_calls.toml,sha256=4wm6GtGTEoApas0Cia3BoEz5B_wGTzz1yoTFn7xd9GE,9635
nldcsc_elastic_rules/rules/integrations/aws/discovery_organization_discovery_by_rare_user.toml,sha256=IoHY2OXFLwy6of0z3D4L0aQBxRgX2LKf3MTaqeTlc6I,5664
nldcsc_elastic_rules/rules/integrations/aws/discovery_s3_rapid_bucket_posture_api_calls.toml,sha256=8Zhtr1Y6h_piqsHJAaeK7SCVSxPwoxuGrPbvCRcnAiw,10514
nldcsc_elastic_rules/rules/integrations/aws/discovery_servicequotas_multi_region_service_quota_requests.toml,sha256=KVn4cz1AQ_Xw0GUl3OhgbWlJbVGidlE259RBrXChWc4,9533
nldcsc_elastic_rules/rules/integrations/aws/discovery_ses_enumeration_via_long_term_access_key.toml,sha256=052w3vUqGHHt63Q6q54YYg-Dgd2LjpCAJU1n-Su7VNc,4860
nldcsc_elastic_rules/rules/integrations/aws/discovery_ssm_inventory_reconnaissance.toml,sha256=R94Tgga65LQL3gbfema-_zzqDiDDU2knaMnlNTXBeIU,7134
nldcsc_elastic_rules/rules/integrations/aws/execution_batch_job_submitted_container_override_unusual_identity.toml,sha256=OjSvkhthtgGVWonWcElU3VA6JCFhw60rwEEvP5EBneI,4915
nldcsc_elastic_rules/rules/integrations/aws/execution_cloudshell_environment_created.toml,sha256=644akfg8A3PPmx9n13Flp9xfbDYXsJuOuwOAVDW0ndc,6485
nldcsc_elastic_rules/rules/integrations/aws/execution_ec2_stop_start_with_user_data_modification.toml,sha256=rtfCxeOUQHACEcU6BbY8eHo5V1jWLrEx7LtfA_4VzYU,7719
nldcsc_elastic_rules/rules/integrations/aws/execution_lambda_external_layer_added_to_function.toml,sha256=A8t9w7DY8kxv5gvzKmH00JLJMrFmqaa4lnsv2qbGBg0,6783
nldcsc_elastic_rules/rules/integrations/aws/execution_lambda_function_invoked_by_unusual_principal.toml,sha256=H-Vh_1AtrgXMFyHneUjwILSHOBiLUrpHc912YqwIazE,5854
nldcsc_elastic_rules/rules/integrations/aws/execution_lambda_function_invoked_cross_account.toml,sha256=jitULBIbd9YxNYmNRB21NSt8vJL0n6KyL9H3osYuo58,5993
nldcsc_elastic_rules/rules/integrations/aws/execution_lambda_function_invoked_from_unusual_source_asn.toml,sha256=QIRO_IRr2kG4lA1hzEpiTvb48l6nfXz8p41MJcAT-n4,5705
nldcsc_elastic_rules/rules/integrations/aws/execution_lambda_layer_shared_externally.toml,sha256=Hz7NlKG1Optog9U8EyNReFHMROydzkS2tbhjh0K8CYE,5856
nldcsc_elastic_rules/rules/integrations/aws/execution_new_terms_cloudformation_createstack.toml,sha256=d9Ev29a1S7-zs5x0TGsFbEuaSWAGSKMv7UgstgWa2U4,6528
nldcsc_elastic_rules/rules/integrations/aws/execution_ssm_command_document_created_by_rare_user.toml,sha256=HtLe5AUPKEinwUSEppk_MOEKyZNpb4JYIXfBz0HOGSw,6264
nldcsc_elastic_rules/rules/integrations/aws/execution_ssm_sendcommand_by_rare_user.toml,sha256=rF6PZT6TxLYE2GdGHmHYzPbWjzI0j8zNAdo3I6YDtbQ,7574
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_bedrock_high_frequency_inference_api_probing.toml,sha256=DK26UqaDj7mvYHRkKeluwkxKBv6egoSV6xddiOlDJgg,7015
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_dynamodb_scan_by_unusual_user.toml,sha256=WT2KBfe55jpe9zIg5f-arXi4QZgJwMPOHwJwVSHU2UM,6757
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_dynamodb_table_exported_to_s3.toml,sha256=2wKpyyHrcqcKhA580RcQSUok1Jmq9HRv-8iqFYM_MSU,6443
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_ec2_ami_shared_with_separate_account.toml,sha256=wxIoRV2M7t-ykIW2XOCfQ5FqhR9D2aKTcYCmVmPB4fY,6662
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_ec2_ebs_snapshot_shared_with_another_account.toml,sha256=FUduJvFUZT6lgtpryjwu-tZQQEaB3XCGvsIxq0z3GWc,8950
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_ec2_export_task.toml,sha256=R9nbv5P-jXY0Fxh6SPHCxb3aGMIOTnDIktujS3hQqWM,7212
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_ec2_full_network_packet_capture_detected.toml,sha256=gWl-nP5dVmkLFDolgsoyVEps_Se2WbjTDuOQM5DwRzY,8375
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_ecr_repository_policy_granted_public_access.toml,sha256=jfQqM5Tb3AFLhG3Jrk0mqTPFkuZAGjmBvC4mywT5qzU,5545
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_rds_snapshot_export.toml,sha256=v5i8mS-Bpr-LKxF0FJ3JVwYSGm9BDtn-P1QqFeBq3iI,8369
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_rds_snapshot_shared_with_another_account.toml,sha256=tCSQR3GF7_hqQTTevZ42iKZvsaH2fkzv1MWuVBE7vV8,8041
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_s3_bucket_policy_added_for_external_account_access.toml,sha256=q451B8Ox7j8KX4usS0vg7QMqjgQUIGeYFvVarf5wN2s,10060
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_s3_bucket_policy_added_for_public_access.toml,sha256=LEgfF9y57qYLSGXUwe7u6Ad9Rjt_2fQ88rv4pdPazNc,8712
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_s3_bucket_replicated_to_external_account.toml,sha256=9F1ZtEfm80eVd2b0LCkwqlIv7J10YabcLOv9WluiqW0,8536
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_s3_uncommon_client_user_agent.toml,sha256=xcn7zEOvtlKroU3yqGPWvkynxvIc0zS5BvWSSnJBGPg,7353
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_sns_rare_protocol_subscription_by_user.toml,sha256=uh-28LluRLy5k0VcvNYDnHQFMFYmM_V50UVRmQ_vm88,7804
nldcsc_elastic_rules/rules/integrations/aws/impact_aws_account_closed.toml,sha256=UKRJhkGsSEOVkZng4VG3MOEedJce2FVWiy8BmMhec8Y,5543
nldcsc_elastic_rules/rules/integrations/aws/impact_aws_eventbridge_rule_disabled_or_deleted.toml,sha256=MWtia2KAmxhFjOirSTL4auYpxWWg1aLG3zAzBjfarM8,8109
nldcsc_elastic_rules/rules/integrations/aws/impact_aws_s3_bucket_enumeration_or_brute_force.toml,sha256=8gqkzXfiA9bckt3xUZNLPc_7l-KFz4xqx0Rx8KLWucU,8059
nldcsc_elastic_rules/rules/integrations/aws/impact_backup_recovery_point_deleted.toml,sha256=VjNuuOrVeXTBASRskof5KSPm6Ac-li4wmd-AtN1PZ68,5391
nldcsc_elastic_rules/rules/integrations/aws/impact_backup_vault_deleted_or_lock_removed.toml,sha256=f8fiJA4_4tNrHY9CFENLOmxecK0jdqqTR9UZWHxYevY,5967
nldcsc_elastic_rules/rules/integrations/aws/impact_bedrock_api_key_destructive_action.toml,sha256=f4QwMYDlevUE5ZUdXThrG9m8k_C4UiwkMIdK4YUUWzo,5958
nldcsc_elastic_rules/rules/integrations/aws/impact_bedrock_knowledge_base_or_rag_data_source_poisoning.toml,sha256=XmUl72L7T-w7AUedwoW_rRXdGl1vMc_AH-wXVhdygQY,7285
nldcsc_elastic_rules/rules/integrations/aws/impact_bedrock_provisioned_model_throughput_tampering.toml,sha256=jui_9AiflHysC5NtDGk8o7_drFuYqWS1MS7Wuy0dfwc,6774
nldcsc_elastic_rules/rules/integrations/aws/impact_cloudtrail_logging_updated.toml,sha256=9IZ5Y9DalRsOz-prAzVVD1ew5CoFVHQRaBwBbF9bGac,5528
nldcsc_elastic_rules/rules/integrations/aws/impact_cloudwatch_log_group_deletion.toml,sha256=D4UoqE0PhyJN5XmQ9LkKk6nZ_Jvv4z_yJqwaacpp_tk,8271
nldcsc_elastic_rules/rules/integrations/aws/impact_cloudwatch_log_stream_deletion.toml,sha256=4Y--d_7OrEO67RG2DlU0VbcvoK-bs5tzYGADpCp_0p0,8062
nldcsc_elastic_rules/rules/integrations/aws/impact_ec2_disable_ebs_encryption.toml,sha256=ajCT4a1U8d7lwpW71Rd8T6jXNH8_z6qdch5J5bF-iIc,9633
nldcsc_elastic_rules/rules/integrations/aws/impact_ec2_ebs_snapshot_access_removed.toml,sha256=hgL_nx0OOfmM6sf23NywDmpoSmYvyrEdpyIgQ3CVkcM,9719
nldcsc_elastic_rules/rules/integrations/aws/impact_ecs_cryptomining_task_definition_deployment.toml,sha256=g67zrhwkkICFM1z3APkXi5Dk69plDYVNVY0Cte1ITy0,7478
nldcsc_elastic_rules/rules/integrations/aws/impact_efs_filesystem_deleted.toml,sha256=gi-CFfOAchEn7O9SbSog-vYZroeiqzyplpAN2b3ApJY,7893
nldcsc_elastic_rules/rules/integrations/aws/impact_iam_deactivate_mfa_device.toml,sha256=uR_dgycWK6uVIXYnUq2dFktUpWhqDKYTPCG71Es33qM,7870
nldcsc_elastic_rules/rules/integrations/aws/impact_iam_group_deletion.toml,sha256=ZY2I94QX2TH6p1_O6PGFCUowJxu3AGfEqUBuZq18NKI,4943
nldcsc_elastic_rules/rules/integrations/aws/impact_kms_cmk_disabled_or_scheduled_for_deletion.toml,sha256=5-s2qRnRVcRYYm4-Zt6cX-bSrZhpnvcBgYEco3dgDo4,8145
nldcsc_elastic_rules/rules/integrations/aws/impact_kms_imported_key_material_deleted.toml,sha256=P9EMWiY0E12ADjcXErggUa3sywN0TEQmtp58tMu2oko,6588
nldcsc_elastic_rules/rules/integrations/aws/impact_lambda_function_deleted.toml,sha256=mAyO6Mwz0oU0TX-OeOAkMBaZfPfOwKMMp-FUcfXnMtI,5532
nldcsc_elastic_rules/rules/integrations/aws/impact_lambda_high_frequency_invocation.toml,sha256=xiXKeV3Rbdcib_Kj-5qm6VJyzXWE_-ux6uNj-vsh5_k,5166
nldcsc_elastic_rules/rules/integrations/aws/impact_rds_instance_cluster_deletion.toml,sha256=KTwqippKyYeJUF7SJ9wUpMWGpp8blrYx1WN9r_-6wS8,7367
nldcsc_elastic_rules/rules/integrations/aws/impact_rds_instance_cluster_deletion_protection_disabled.toml,sha256=PRKbOEe0yVuuhc9cHc5Kv_yrsHaaeTanryd2YFb6x7g,7060
nldcsc_elastic_rules/rules/integrations/aws/impact_rds_snapshot_deleted.toml,sha256=bRcAfgpEp2lrBji11AIKvNBRyRnvPQ8CloiVA2s3_hI,9314
nldcsc_elastic_rules/rules/integrations/aws/impact_s3_bucket_object_uploaded_with_ransom_keyword.toml,sha256=tT2gYS2EEZwl4us-rJCzTa5Z6wH7goXwvdWtHJTSpd8,9909
nldcsc_elastic_rules/rules/integrations/aws/impact_s3_excessive_object_encryption_with_sse_c.toml,sha256=u0s_sfYTWDW19-bt444ZSE6H95U7_YJjWmWO7amy9rY,6036
nldcsc_elastic_rules/rules/integrations/aws/impact_s3_mfa_delete_disabled.toml,sha256=SOH6NU_GPxxBybsQd4YTvaI2xSumN8DgFGodmm7QsSk,4713
nldcsc_elastic_rules/rules/integrations/aws/impact_s3_object_encryption_with_external_key.toml,sha256=tca73N9O6zX5uIm20bukiw-LGGZJT3XiRa7n2Yg4EG8,10542
nldcsc_elastic_rules/rules/integrations/aws/impact_s3_object_versioning_disabled.toml,sha256=M11FEnFSbSSVOqKrJhvPG2q5mF1QsZWhKsmvWZj9orc,8357
nldcsc_elastic_rules/rules/integrations/aws/impact_s3_static_site_js_file_uploaded.toml,sha256=FnHfT22kb8Jmfclz-9alks9O_HByMzprt1q2M4d3WB8,6089
nldcsc_elastic_rules/rules/integrations/aws/impact_s3_unusual_object_encryption_with_sse_c.toml,sha256=10TBlsXzRdDyvl1amBS97fItFVSgk-x0daYNi6R9Rk4,6585
nldcsc_elastic_rules/rules/integrations/aws/initial_access_assume_role_with_web_identity_kubernetes_sa_from_external_asn.toml,sha256=o19n-hWb0kwh9vJeAS0__A-tB5WeTGXd0TCgNly8Unw,5420
nldcsc_elastic_rules/rules/integrations/aws/initial_access_aws_api_unusual_asn.toml,sha256=92Xc5BjBk5rCfIl6Mt3Q65s2mafHw_c-ZJi9GJnqNfg,7523
nldcsc_elastic_rules/rules/integrations/aws/initial_access_console_login_iam_user_multiple_geolocations.toml,sha256=6han_E2lHqmGeS-7-bCyOnci07XoFM67X8ECZF1DvBo,6110
nldcsc_elastic_rules/rules/integrations/aws/initial_access_console_login_root.toml,sha256=CFLPYQP9qhIZUCk7PIS612k0XTgbvKOQljAAajT6FlM,7859
nldcsc_elastic_rules/rules/integrations/aws/initial_access_github_actions_oidc_credentials_used_from_suspicious_network.toml,sha256=q6Uqvas_2LqxTRiCFIi1cacbvDCXxvVFwJ2VKTj5BLs,6746
nldcsc_elastic_rules/rules/integrations/aws/initial_access_iam_session_token_used_from_multiple_addresses.toml,sha256=2qCDykKwf0J3iPFtSiisEMp2SHv0YltAXe2PSp7MqFU,12710
nldcsc_elastic_rules/rules/integrations/aws/initial_access_iam_user_console_login_without_mfa.toml,sha256=ZsbHhAEIFQWKuUcDluCYQhYWUjTboA8oIhU0R6aP8aE,5651
nldcsc_elastic_rules/rules/integrations/aws/initial_access_password_recovery.toml,sha256=o2QJElUCNMyV6_QgJ4myfxzQYT652zWuU9Vbi4qSbmU,6964
nldcsc_elastic_rules/rules/integrations/aws/initial_access_signin_console_login_federated_user.toml,sha256=nVKfbzWJczFMuq3EXq5K52k7hTYKWQkKAUogR1sflnE,6669
nldcsc_elastic_rules/rules/integrations/aws/initial_access_suspicious_user_agent_detected_in_cloudtrail.toml,sha256=KXRyg2ewZuRKz_3Y_YUmpfPKbslohJvuHShrIe5j6lo,8190
nldcsc_elastic_rules/rules/integrations/aws/lateral_movement_aws_ssm_start_session_to_ec2_instance.toml,sha256=f5__3_tqHs4vWp9yfec_-zSCyc_zQsbAcgRLFsGYubE,5763
nldcsc_elastic_rules/rules/integrations/aws/lateral_movement_ec2_instance_connect_ssh_public_key_uploaded.toml,sha256=GI9u8nsIEUAcnQjBTJvA9Myhr1ZAJdBuxiyL9DCXlbA,8473
nldcsc_elastic_rules/rules/integrations/aws/lateral_movement_ec2_instance_console_login.toml,sha256=hNoRTXhswD0KSbtU4kEbqmY6v1z65EI5rhFGTbMfPvk,9909
nldcsc_elastic_rules/rules/integrations/aws/lateral_movement_k8_assumed_web_identity_session_with_multi_phase_api_use.toml,sha256=C68Mndqvq2e8gxpFkJBB3CNwPsGcf38GGZJS3NibGnU,9325
nldcsc_elastic_rules/rules/integrations/aws/lateral_movement_sns_topic_message_publish_by_rare_user.toml,sha256=St-k-Cxv5VmfrpkPqySzjkQ9wJeC5VAT6AFmf031u18,8770
nldcsc_elastic_rules/rules/integrations/aws/ml_cloudtrail_error_message_spike.toml,sha256=fTOuAENlAYC3QS0aetQS7Ej1WsTibUrpKCZ-f_YZHe0,8304
nldcsc_elastic_rules/rules/integrations/aws/ml_cloudtrail_rare_error_code.toml,sha256=Lx_9GiGGaOA2vn4lcfpdi48EhQ5KbbGCG8v5gH9poMA,8949
nldcsc_elastic_rules/rules/integrations/aws/ml_cloudtrail_rare_method_by_city.toml,sha256=4ZjfJJuQyqsKlKN36dART-qzWJtjZ1866t_QsD0WZGo,8862
nldcsc_elastic_rules/rules/integrations/aws/ml_cloudtrail_rare_method_by_country.toml,sha256=-Fc88tgeUHq2qgNMJrf3-G4mRDJWF8Yshlvr5pf-dAI,8455
nldcsc_elastic_rules/rules/integrations/aws/ml_cloudtrail_rare_method_by_user.toml,sha256=XtRfS2BZxpUUn4uKKSymFEnD6ekke0gNItkoxMRS990,9863
nldcsc_elastic_rules/rules/integrations/aws/persistence_aws_attempt_to_register_virtual_mfa_device.toml,sha256=rz5QEeg91Dqk8f0NpkIE-p5QhDK3XAYLSdBRX0FzCeo,7842
nldcsc_elastic_rules/rules/integrations/aws/persistence_bedrock_agent_created.toml,sha256=wezjlrxQui9W8q_wJ-jYps1mx1RQCsb8PxNUGDyjc0M,5141
nldcsc_elastic_rules/rules/integrations/aws/persistence_bedrock_agent_or_action_group_manipulation.toml,sha256=36i2sAvQFqj26zL5osUEWBnfKiQ4-FW8I_8YQZi4PXI,7129
nldcsc_elastic_rules/rules/integrations/aws/persistence_bedrock_foundation_model_access_denied_attempt.toml,sha256=SnS5O9k43qLi9Ke3Tg9IKI-LjFB7wVPBK0ZbS3hG6fE,7087
nldcsc_elastic_rules/rules/integrations/aws/persistence_bedrock_foundation_model_access_enabled_or_entitlement_granted.toml,sha256=qqN9mXQXq-je8Gn4yKgWJqEOor3Y3Gg_d6ey8kX6MKA,7201
nldcsc_elastic_rules/rules/integrations/aws/persistence_bedrock_resource_based_policy_denied_attempt.toml,sha256=CpG6zGbd8ymWtLEHIzg3-UqlastC3nqSBIm9cSHZgaM,6418
nldcsc_elastic_rules/rules/integrations/aws/persistence_bedrock_resource_based_policy_modified_or_deleted.toml,sha256=fYEvop4Lk70mmZAz9q9K3Co6HP3ONbT3UUG5HjF6dYA,5779
nldcsc_elastic_rules/rules/integrations/aws/persistence_bedrock_third_party_or_external_knowledge_base_associated_to_agent.toml,sha256=zE8_Eo0zjJ6fA1ECzD_dd0gkJ1R68KGD9GqZ0Xz4M3A,6130
nldcsc_elastic_rules/rules/integrations/aws/persistence_bedrock_untrusted_model_imported_or_marketplace_endpoint_registered.toml,sha256=5mjWWli6W98Hc4cGXqLeFCoOZC7Z-ODvakwgG69Mjqk,6497
nldcsc_elastic_rules/rules/integrations/aws/persistence_ec2_network_acl_creation.toml,sha256=yhGoVgezeWPRxgCCLk-AN5UMgtCf9cLqkzBF89s3UV4,7470
nldcsc_elastic_rules/rules/integrations/aws/persistence_ec2_route_table_modified_or_deleted.toml,sha256=qS9E-l-bJdoeXST0nVqKnjctmeQWH1SBZziVxxaiDfs,8744
nldcsc_elastic_rules/rules/integrations/aws/persistence_ec2_security_group_configuration_change_detection.toml,sha256=g9ROqyN4-7i8HJ4PRPsM7zvkb9-BD9krt_yVjIJDsqI,8279
nldcsc_elastic_rules/rules/integrations/aws/persistence_eks_access_entry_granted_then_deleted.toml,sha256=j8ADZ9EZz6LCpCch-iz-3DEERDBGCKq9aGe-mKRn7bA,6219
nldcsc_elastic_rules/rules/integrations/aws/persistence_eks_access_entry_modified.toml,sha256=7FFSA5SXbDMWgGuUqGqFDKVJOL79z67W2JUkQWPGRRo,4620
nldcsc_elastic_rules/rules/integrations/aws/persistence_iam_api_calls_via_user_session_token.toml,sha256=jNj8mTOyIRiYEUtinMcE166ioPiC3RBh-hN6KWigBB8,8467
nldcsc_elastic_rules/rules/integrations/aws/persistence_iam_create_login_profile_for_root.toml,sha256=lMdwNGc-dBYHdDsUu54UHs0MNJEnI7e0n8pwuuTItss,9589
nldcsc_elastic_rules/rules/integrations/aws/persistence_iam_create_user_via_assumed_role_on_ec2_instance.toml,sha256=tihs296pgoa60llew6MsfMPzkWiluyBMqpCxwIhGMhA,7027
nldcsc_elastic_rules/rules/integrations/aws/persistence_iam_group_creation.toml,sha256=omlQAfukW6pd5foPomW_CoL0IeIoLX7z6fwFEM7t96g,5609
nldcsc_elastic_rules/rules/integrations/aws/persistence_iam_login_profile_created_or_modified.toml,sha256=dZnIHjtJVM-bFRb9m39PfHPcahgnwt8W0Ax9RnbXTzg,6687
nldcsc_elastic_rules/rules/integrations/aws/persistence_iam_oidc_provider_created.toml,sha256=C_LFu-mZiKf7tTnPXq5Q0r3a99nIzGKdHrG-fAlo_5c,7566
nldcsc_elastic_rules/rules/integrations/aws/persistence_iam_roles_anywhere_profile_created.toml,sha256=2jvyzl1cXX9XFH2gCeX3c9X1k4R8mKq5wY-NEr_nRzE,8233
nldcsc_elastic_rules/rules/integrations/aws/persistence_iam_roles_anywhere_trusted_anchor_created_with_external_ca.toml,sha256=Nj2ItQvsx8tYY3aG2Dz2nN90MIwmyLP5jU_ITUwhMGE,7936
nldcsc_elastic_rules/rules/integrations/aws/persistence_iam_saml_provider_created.toml,sha256=ZVhV9h2XOTiJrWhlP5oKxoAskY-u0ofHp5kgjParOsg,7103
nldcsc_elastic_rules/rules/integrations/aws/persistence_iam_ses_fullaccess_policy_attached_by_unusual_user.toml,sha256=Nj0fUJIJjAIaFH2o_YSBmmZCqE__EuJLWXyF7PPJkKc,6949
nldcsc_elastic_rules/rules/integrations/aws/persistence_iam_user_created_access_keys_for_another_user.toml,sha256=JKfLrP6vZwrgvUBMTw8kRsaSkXpSwK5QrZPhPi9rFHs,10073
nldcsc_elastic_rules/rules/integrations/aws/persistence_iam_user_self_created_access_key_subsequently_used.toml,sha256=tuz9R7Jvtdp4tcSbKgRvlv3zsEKXzpEM8kR7SAcKfKI,11078
nldcsc_elastic_rules/rules/integrations/aws/persistence_lambda_backdoor_invoke_function_for_any_principal.toml,sha256=l5xmbnqbyR4aAGtuC6tGuekhoNGUt6nbGIEKbf1gL4U,7631
nldcsc_elastic_rules/rules/integrations/aws/persistence_lambda_cross_account_invocation_backdoor.toml,sha256=nG-r2QoknnXRAG9BC4EBBwTT3m7Ss5n7-RwqKkEyB5c,6337
nldcsc_elastic_rules/rules/integrations/aws/persistence_lambda_event_source_mapping_created.toml,sha256=iqZpYFTjfB2LzdcK1yogy4sZOi9_f16fGkuWgI9ie90,6611
nldcsc_elastic_rules/rules/integrations/aws/persistence_lambda_function_url_public_access.toml,sha256=TK3EC6gkizG_nxX0g_FtF4hyUD5Rvuu1qjhsHw-rWOc,6282
nldcsc_elastic_rules/rules/integrations/aws/persistence_new_terms_ec2_create_keypair_unusual_source_as.toml,sha256=lX8R6JIrl3jXafE8yXgimPawwK0HX2BLipboOfJ9fW8,5515
nldcsc_elastic_rules/rules/integrations/aws/persistence_organizations_delegated_admin_registered.toml,sha256=NOZXnhpxVmMiuiOg_W4tQz4GdcYMYgyV85_jm4IULio,5821
nldcsc_elastic_rules/rules/integrations/aws/persistence_rds_db_instance_password_modified.toml,sha256=_9WuJC1SN2rpUDvIXqIW9gFZISpk3iIlG3un2sMHaDI,8952
nldcsc_elastic_rules/rules/integrations/aws/persistence_rds_instance_made_public.toml,sha256=YcjxWxqyMqyUKs2fuPpfVk_AM7vsMFRsLAvzWvmNRN4,7796
nldcsc_elastic_rules/rules/integrations/aws/persistence_route_53_domain_transfer_lock_disabled.toml,sha256=NcdhcVuO_LXAXxhhOUiM42X6A8b5OYNDfLH-pflAHpA,7412
nldcsc_elastic_rules/rules/integrations/aws/persistence_route_53_domain_transferred_to_another_account.toml,sha256=rWWyKiwO2VU2QQ_EItHhrPxP0pDS8pC_p8Srh5Npcmg,8141
nldcsc_elastic_rules/rules/integrations/aws/persistence_route_53_hosted_zone_associated_with_a_vpc.toml,sha256=9Vm3PR6CHvBnEbG7pgc0mknx6Rj5hO9fBTOfsEyTab4,7610
nldcsc_elastic_rules/rules/integrations/aws/persistence_route_table_created.toml,sha256=1kJ2P9F-77R6jtjIHN3-FsioTi_8DacUUKHxcoalTXg,6905
nldcsc_elastic_rules/rules/integrations/aws/persistence_sagemaker_lifecycle_config_suspicious_script_content.toml,sha256=yHnbEFAowr-hcLnV1DXD_fE2SX7YeyU_GZtwBQ9-cC8,6436
nldcsc_elastic_rules/rules/integrations/aws/persistence_sensitive_operations_via_cloudshell.toml,sha256=COooha1ow2njJmvgIr2nYHerCxuPuZref_fV2x4k9Ms,7577
nldcsc_elastic_rules/rules/integrations/aws/persistence_sts_assume_role_with_new_mfa.toml,sha256=MLYduMFTe61zJiWFyXd7CB0F2PvqV5B-JJJeRcHKQ50,8275
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_bedrock_agentcore_execution_role_used_outside_runtime.toml,sha256=5o4VIZcrsV035_6NgPKjZie_tpW1ZzJFapyJaLfJnl8,7408
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_bedrock_agentcore_resource_created_with_role.toml,sha256=BoH1DlTLuwv-kfPpa3JIlLqAGI9RmiMxOGpzFLLhlmI,4965
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_bedrock_phantom_user_activity_outside_bedrock.toml,sha256=TSnbiIKLtcnk3BdLYaSOGwMlySPHIxA3YliK50ocoQU,5406
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_bedrock_phantom_user_credentials_added.toml,sha256=tggyYifCj-K3pwUzcpZLxGTUbI-cMTmc4Qt3uT7bIcY,6373
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_ec2_instance_profile_associated_with_running_instance.toml,sha256=UYLNeZY-h_KPoAvuNPMUTArZLWh6t-mOaG4LrAo_z1k,4895
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_eks_access_entry_granted_cluster_admin_policy.toml,sha256=pEyBY5iY1ucAyVHroX2-jqI_bjBln3TQDxxz16HXttY,4859
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_iam_administratoraccess_policy_attached_to_group.toml,sha256=_SDf6JurS1-CgPu6ezjIz4ppI7tCJT3Lx_8tZjeIWT4,7090
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_iam_administratoraccess_policy_attached_to_role.toml,sha256=vtyvdUfZS6WCrpAKzGH9DguHFKL1JdGI1GIwjpy8ifE,7021
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_iam_administratoraccess_policy_attached_to_user.toml,sha256=UqzrfFKnVSRdN4CYwfJ0wWVUposR8s5N2Z40Tvt_ZdI,7760
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_iam_customer_managed_policy_attached_to_role.toml,sha256=68dlLaCbcTTyPX4vhmTrRqwhtqwsQhzSWZV17ojyqvQ,8389
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_iam_customer_managed_policy_version_created_or_set_default.toml,sha256=O-gL8nU7lveNZl4xC0z1_AQY9f_g4-veKxN9xCZxs8s,5067
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_iam_inline_policy_added_to_group.toml,sha256=R-5SAn5iZGwHlIBdin7G93Ya1YnirSd5IcsktwYqeDA,6067
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_iam_permissions_boundary_modified.toml,sha256=Vx0oO1PbqZRb0Pw7qVI4nbgMLn8aG93KODqBZLq9XIg,5989
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_iam_privilege_operations_via_lambda_execution_role.toml,sha256=wsOcU11l2O_-uoC253hh9z1Or564q4DzbyyHwUCeF5g,6149
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_iam_saml_provider_updated.toml,sha256=Sn1uUFb8-olXUl83c383QATrh40jzdHYjDyuHfcWdUc,8202
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_iam_update_assume_role_policy.toml,sha256=ccLRSWwkM_VAnNEYc3tbu5Sx8GjKLwJY4xOG93SwfvM,8161
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_kms_key_policy_put.toml,sha256=Q1WyikDZAAR2dOD-wHVCB-FT_PvvfaeVlYU02CZh6CA,4602
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_role_assumption_by_service.toml,sha256=4JWVW57Vd1i6cXk1TdG4mtxkdI5rtJH0gCdYHPE5dDM,7842
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_role_assumption_by_user.toml,sha256=ss4l0XdrCWRYQfeAQ55-2kumsFy8h8fgKRRq0yHMM-Y,7678
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_sagemaker_execution_role_passed_by_unusual_principal.toml,sha256=gnueT-N7CgNw3Lg5cwP29kXCEIinmQRvIig6q3Yb5wg,6766
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_sts_assume_root_from_rare_user_and_member_account.toml,sha256=cCVuVwkNpL-eo_VI21SqigPFWp2pGBb-YRRY0QlTxZs,12763
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_sts_get_federation_token_administrator_access.toml,sha256=MToVrQHqxIhtO2bSUYGlrtANUJq99m9SJm8-uwbfvUc,5321
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_sts_role_chaining.toml,sha256=3Ubike3QxGK-Et9hzezRVnBb65O8ZQDfJpjnnVpbkC4,9179
nldcsc_elastic_rules/rules/integrations/aws/resource_development_service_quota_increase_by_rare_identity.toml,sha256=fWhKmupN1UVY1uff4mLmRM7xNW1JdJqKLetXJTJ6gJ0,4650
nldcsc_elastic_rules/rules/integrations/aws/resource_development_ses_account_sending_enabled.toml,sha256=_JKoSDUttG80Yqjc7sWkDJD9Ebzuumb16tlGGgEWw8Y,5744
nldcsc_elastic_rules/rules/integrations/aws/resource_development_ses_identity_verified_then_deleted.toml,sha256=22bC8go_e2KxpZXj5fwrE9nzVw8g0iAzzy-MoWizBXM,6667
nldcsc_elastic_rules/rules/integrations/aws/resource_development_sns_topic_created_by_rare_user.toml,sha256=HMEu7CIljarDfXmZD8DCGKRTZs6pyoLij9u2xmBiGWg,6447
nldcsc_elastic_rules/rules/integrations/aws_bedrock/aws_bedrock_execution_without_guardrails.toml,sha256=w14fqZHwQ_sKfGg5-RKgW_2RIbm4vd-VvyWzx7DcHcE,4957
nldcsc_elastic_rules/rules/integrations/aws_bedrock/aws_bedrock_guardrails_multiple_violations_by_single_user.toml,sha256=AWqIxAfPzdzwmzVyCwb0v2evM000TD6fE-LqGaQfaXg,4967
nldcsc_elastic_rules/rules/integrations/aws_bedrock/aws_bedrock_guardrails_multiple_violations_in_single_request.toml,sha256=_MqfrJmW1oe1FHakMioIVaQvxR4605tIrDlpJVxRAqc,5349
nldcsc_elastic_rules/rules/integrations/aws_bedrock/aws_bedrock_high_confidence_misconduct_blocks_detected.toml,sha256=Q03vRDMcx1lGnTrvHLQW_aTW64JBap_1C6KhMtkNcPw,5357
nldcsc_elastic_rules/rules/integrations/aws_bedrock/aws_bedrock_high_resource_consumption_detection.toml,sha256=1nUd67YeS0jQxEWAOKJw0cdsr8FAD0MxjMHrBEAuNuc,5081
nldcsc_elastic_rules/rules/integrations/aws_bedrock/aws_bedrock_multiple_attempts_to_use_denied_models_by_user.toml,sha256=vvYYG5mRNkXJ4ZuOV5dwz9e8dl4vmae8weu0Cke5oF8,4676
nldcsc_elastic_rules/rules/integrations/aws_bedrock/aws_bedrock_multiple_sensitive_information_policy_blocks_detected.toml,sha256=pU9_-qiAr4SlW4JVJ3xW_zOCoqxl0oUN07XpRwCpj6c,4791
nldcsc_elastic_rules/rules/integrations/aws_bedrock/aws_bedrock_multiple_topic_policy_blocks_detected.toml,sha256=kJkd2eqFXoo1_V7Rp1ofR2oEO1jCZnAqA2RNuYzT26c,4681
nldcsc_elastic_rules/rules/integrations/aws_bedrock/aws_bedrock_multiple_validation_exception_errors_by_single_user.toml,sha256=Zee3Zo9kUj1U2imLXMg87G6XLnkCwSuYzgCsF6YFVPs,5127
nldcsc_elastic_rules/rules/integrations/aws_bedrock/aws_bedrock_multiple_word_policy_blocks_detected.toml,sha256=uFU2VckLn-P3mt4O3dnrcFrc9VEK1-gwRljxUiWJrJk,4697
nldcsc_elastic_rules/rules/integrations/aws_bedrock/credential_access_aws_bedrock_credentials_in_model_prompt_or_completion.toml,sha256=Oct_tlS58ZfrtBbP-MKKUk4396xTAjviet1VHXUP-Qg,5272
nldcsc_elastic_rules/rules/integrations/aws_bedrock/execution_bedrock_high_risk_tool_invocation.toml,sha256=Let8KgXCoywtuRITUZkLwq5HKJxmpxj787cA4t7Y0Dw,6116
nldcsc_elastic_rules/rules/integrations/aws_bedrock_agentcore/credential_access_bedrock_agentcore_runtime_prompt_containing_credentials.toml,sha256=n2TFAuqWHZj5DuuThFDlDRa7mtlGutG_jF1bq9c3aL0,4860
nldcsc_elastic_rules/rules/integrations/aws_bedrock_agentcore/credential_access_bedrock_agentcore_runtime_prompt_credential_harvesting.toml,sha256=t1LarExPeYqL1Ps1ylTKoW3hCE0jTROcGHuKlAWm2HE,7245
nldcsc_elastic_rules/rules/integrations/azure/collection_azure_storage_account_blob_public_access_enabled.toml,sha256=hFk0ut6q5t7ciSM3h9Q6did_gGwMatLXvhQoDbq1-f8,6141
nldcsc_elastic_rules/rules/integrations/azure/collection_entra_id_sharepoint_access_from_unusual_application.toml,sha256=KK6nRWFXjbNANEwB_5VATED2I6Ixl6r7-Lb6y6RPesI,9874
nldcsc_elastic_rules/rules/integrations/azure/collection_graph_email_access_by_unusual_public_client_via_graph.toml,sha256=DXf6RyVE8lIA06B8xFiJG3464Feqi_FoyTlUWDUbQ4I,7578
nldcsc_elastic_rules/rules/integrations/azure/credential_access_azure_aks_coredns_configmap_modified.toml,sha256=oe1lnwuMPkqf6X4VY8mhEtk4zVa8eSEei9vcxNZ2afs,7021
nldcsc_elastic_rules/rules/integrations/azure/credential_access_azure_aks_csr_created_or_approved.toml,sha256=WyB5Vm32OQtnEETa4_75Vqn5FyXA-sF97ByFvR_pql8,7994
nldcsc_elastic_rules/rules/integrations/azure/credential_access_azure_aks_secret_access_suspicious_user_agent.toml,sha256=xFz5XvNh0-ZdVQPNcqa5c7VqLXmzC9KFxczS4uBpGPo,7479
nldcsc_elastic_rules/rules/integrations/azure/credential_access_azure_aks_service_account_token_requested.toml,sha256=ic2C6iNbaEns-xq4PDXSkwNaJcppDHajQSYGbZjQR5Y,6736
nldcsc_elastic_rules/rules/integrations/azure/credential_access_azure_entra_susp_device_code_signin.toml,sha256=HApLe6H-d1XvsBXdNvxvlS31n6oFBXEdIrvBP6UuNXc,7845
nldcsc_elastic_rules/rules/integrations/azure/credential_access_azure_service_principal_signin_then_arc_credential_listing.toml,sha256=6CnoSmHoCJVo8uaIBAMqgZfoUIVJimR25tK058aJBhY,6518
nldcsc_elastic_rules/rules/integrations/azure/credential_access_azure_storage_account_keys_accessed.toml,sha256=dedBRxIU4yxayKN9A8NzNc-1ruBJ3AHSkhzp3ZTgjfc,7316
nldcsc_elastic_rules/rules/integrations/azure/credential_access_azure_vm_boot_diagnostics_retrieved_unusual_principal.toml,sha256=DEMNPUB5yUN3FjVDs5d_OccfRWRNXvWCoZ4r-Kk2eYs,5149
nldcsc_elastic_rules/rules/integrations/azure/credential_access_device_code_signin_aad_graph_enum.toml,sha256=pPODywLzIahnDot41r8etly4QXVcxsah0tIZwJMXN6M,10056
nldcsc_elastic_rules/rules/integrations/azure/credential_access_entra_id_brute_force_activity.toml,sha256=1FZlBdkCN7j0OUtf_o_mOUjqOC1mJKPauz3vSkf8rH0,14321
nldcsc_elastic_rules/rules/integrations/azure/credential_access_entra_id_excessive_account_lockouts.toml,sha256=QPX4XUL110ZSlUYCI52MYBk06vNqjXPhcVuOOJfr_Bo,9001
nldcsc_elastic_rules/rules/integrations/azure/credential_access_entra_id_prt_cookie_replay_unusual_ip.toml,sha256=AOfU8jCGrw7TbTzmMbn1SQFPcjj0ymJWIFnEJuWVPas,15008
nldcsc_elastic_rules/rules/integrations/azure/credential_access_entra_id_prt_from_unusual_device_ip.toml,sha256=mOXPar8NEC6Ss5dbGAdpvL6_ufVeALeNXMz2TvBr9Z0,10328
nldcsc_elastic_rules/rules/integrations/azure/credential_access_entra_id_ropc_unknown_client_id.toml,sha256=KgpbJpkww_ZG4KSCnCbLYdtL62qQztXn-FYATdWRZr8,8836
nldcsc_elastic_rules/rules/integrations/azure/credential_access_entra_id_signin_brute_force_microsoft_365.toml,sha256=99eW_9ueVS4NqF7To0_sHZqx8X4z7QAgqeQHqgPNyZE,14730
nldcsc_elastic_rules/rules/integrations/azure/credential_access_entra_id_suspicious_signin.toml,sha256=1BtHyohBL8a7xQJaVGP0KCskBZ3KZfocwhYK3p43baA,8517
nldcsc_elastic_rules/rules/integrations/azure/credential_access_entra_id_totp_brute_force_attempts.toml,sha256=vmtKKETWJbKNygFfScP2kzmozJF7MBoK9Be1XDLS-FA,10419
nldcsc_elastic_rules/rules/integrations/azure/credential_access_key_vault_excessive_retrieval.toml,sha256=4S4t-bm91P1SJpNZ_N90o17zAGZjd9Vy5A24Z7cgybQ,11300
nldcsc_elastic_rules/rules/integrations/azure/credential_access_key_vault_retrieval_from_rare_identity.toml,sha256=0jYwMW-CGV28tItfSZlR65LeOB5H047YdVNVCEg_G64,8515
nldcsc_elastic_rules/rules/integrations/azure/credential_access_network_full_network_packet_capture_detected.toml,sha256=tme4H96Y7NLac53ECkAv4-h_-QJA-0WdJt2Fv8Tcmlk,6331
nldcsc_elastic_rules/rules/integrations/azure/credential_access_storage_account_key_regenerated.toml,sha256=_3JMWhlYY47bJvPOgbYG88x2gbAjN7ndJ6_CPjgVLOA,6686
nldcsc_elastic_rules/rules/integrations/azure/defense_evasion_automation_runbook_deleted.toml,sha256=c0q5kADtBxUcf1gB8Ghz6b7cgCkSXx5DY9k-loX7eCQ,5805
nldcsc_elastic_rules/rules/integrations/azure/defense_evasion_azure_aks_events_deleted.toml,sha256=-qAdPC5twmOpZQCtDmj9DoBVjkaZmCJQw74HRMQLCJ8,6222
nldcsc_elastic_rules/rules/integrations/azure/defense_evasion_entra_id_ca_mfa_bypass_first_party_graph.toml,sha256=S_XQsIKNHJQigsBsJIQtBejoNW58HsIapgEu0BUa8MA,11372
nldcsc_elastic_rules/rules/integrations/azure/defense_evasion_entra_id_whfb_key_from_unregistered_device.toml,sha256=ZljXL_5azP0YWE8L0zF-WAj_xkaOSvuIr_zBREtOP1k,6637
nldcsc_elastic_rules/rules/integrations/azure/defense_evasion_event_hub_deletion.toml,sha256=sOtYwNL09zZQ0jI8-eXLQzWf_0O8LtQ42SVZJatMWfY,6679
nldcsc_elastic_rules/rules/integrations/azure/defense_evasion_insights_diagnostic_settings_deletion.toml,sha256=2fectnaihoFB2XqqmS0zhTsEEaN1hna-rbHiM0e3YzI,7006
nldcsc_elastic_rules/rules/integrations/azure/defense_evasion_kubernetes_events_deleted.toml,sha256=Omw1LtChBNzP1ovlm289G5XVarzxSmSBsnkNjJUSx58,6486
nldcsc_elastic_rules/rules/integrations/azure/defense_evasion_network_firewall_policy_deletion.toml,sha256=jF0lxkOz1VwQ267rn-sXbSamXHo4JsxomT2-EuP41w8,6310
nldcsc_elastic_rules/rules/integrations/azure/defense_evasion_network_frontdoor_firewall_policy_deletion.toml,sha256=BnjH6OV7fK7iSEGLIq2sLgVKg9Ht6WUzavGYECY56SU,6040
nldcsc_elastic_rules/rules/integrations/azure/defense_evasion_network_watcher_deletion.toml,sha256=JaX4xpmKEnG3zoiPvyrSjPfBcBsiOK02gFu8GXhXOYc,6185
nldcsc_elastic_rules/rules/integrations/azure/defense_evasion_security_alert_suppression_rule_created.toml,sha256=roWgVAA5tR60GIUtKgIaKvU3Dhiu63PTFkxTTB9WZaM,6745
nldcsc_elastic_rules/rules/integrations/azure/defense_evasion_storage_blob_permissions_modified.toml,sha256=Txqtf0mYNkzBatp8BJqUAeOv9CKM6AIkIjpJLtZlwtY,6261
nldcsc_elastic_rules/rules/integrations/azure/discovery_aad_graph_high_4xx_ratio_by_user.toml,sha256=1MiEVPJxCYUL2DJ-fjwDGw_i6XuMhhRtNL6jjp3wSDs,6110
nldcsc_elastic_rules/rules/integrations/azure/discovery_aad_graph_roadrecon_aiohttp_enumeration.toml,sha256=JZBU-gcgcfELgkzpmz1pQZxOEK7GElRuxicFULE6PGc,10349
nldcsc_elastic_rules/rules/integrations/azure/discovery_aad_graph_suspicious_user_agent.toml,sha256=UbZZuxJnCvuGS-SPlQLbGSH-x-Mkf6A6R_fHUBWnb3Q,7593
nldcsc_elastic_rules/rules/integrations/azure/discovery_aad_graph_unusual_client_for_user.toml,sha256=tOJG4Im4teyLnvxv9RWSUvK5Kf9GkDVPcCp_ihnPBEA,6977
nldcsc_elastic_rules/rules/integrations/azure/discovery_azure_aks_api_request_failure_burst.toml,sha256=JE7-XZLHF0YHgMjwxd1Hay3NFQHWQ5Lj-Ih6EzbjXDw,7499
nldcsc_elastic_rules/rules/integrations/azure/discovery_azure_aks_suspicious_self_subject_review.toml,sha256=2e_kMraNIYRJFEN1O0nR6XisWfUUtW4wVcmtJOalke8,7516
nldcsc_elastic_rules/rules/integrations/azure/discovery_azure_storage_anonymous_blob_access_unusual_resource.toml,sha256=pOP_jmsDePBi8pwnvxAGDQF-2ek5nn6UjyfoVrkJR6s,5021
nldcsc_elastic_rules/rules/integrations/azure/discovery_bloodhound_user_agents_detected.toml,sha256=fAUN0ecxP6oKqWQTVHY187S99JWUbHWdz-QCPxbzw8U,7435
nldcsc_elastic_rules/rules/integrations/azure/discovery_entra_id_teamfiltration_user_agents_detected.toml,sha256=J3yZz4TysvqnuRVhxn1ncPEFM_Eo_ta6rNydzctqWEg,7946
nldcsc_elastic_rules/rules/integrations/azure/discovery_graph_activity_delegated_user_multi_category_recon.toml,sha256=cGVLzF-Iqd-esah4VRmYISEM-b4Kskk4JGDUtZ9A2bc,6870
nldcsc_elastic_rules/rules/integrations/azure/discovery_storage_blob_container_access_modification.toml,sha256=tq9BIrI6WFXuvVqokYDJAMT-wca7KB__Fb51euSiY54,6592
nldcsc_elastic_rules/rules/integrations/azure/execution_automation_runbook_created_or_modified.toml,sha256=WMDP4-iwbCVncEZhKF8x1sWU1kNQpGL0qHOxj-4BD7w,6674
nldcsc_elastic_rules/rules/integrations/azure/execution_azure_aks_ephemeral_container_added.toml,sha256=66NF976UAy-ni_8bScIYLqi4YJdsERKYaLiKV29i6p4,6951
nldcsc_elastic_rules/rules/integrations/azure/execution_azure_aks_kubelet_proxy_command_endpoint.toml,sha256=jgbsoBMIl5UJhugxMqwb9jHjDQMPxj6G0uwPwzmv_k4,6317
nldcsc_elastic_rules/rules/integrations/azure/execution_azure_aks_pod_exec_potential_reverse_shell.toml,sha256=qWo1xqB35mKpuU4uCphRxzUKejccXtRbb7DxNTdeODc,9232
nldcsc_elastic_rules/rules/integrations/azure/execution_azure_aks_user_exec_into_pod.toml,sha256=kWqRhC3xpNaD4onPzmDEMhJs8Mme7rzKiFx5W4E147I,5191
nldcsc_elastic_rules/rules/integrations/azure/execution_azure_vm_extension_crud_unusual_source.toml,sha256=bT1mfs-UY1DPfc1X8HG3Y3Emgab_fztno-nTT8Pnp4A,7242
nldcsc_elastic_rules/rules/integrations/azure/execution_azure_vm_extension_unusual_for_host.toml,sha256=cuhX1IM5uGOlZv5H7D0uZ706uMf86mPn8lZCaFa8OjY,8622
nldcsc_elastic_rules/rules/integrations/azure/execution_azure_vm_managed_run_command_unusual_identity.toml,sha256=xBPfx0rSXKwss1UAUBpqwW9QsMye6z08wTpnryZkkXQ,6027
nldcsc_elastic_rules/rules/integrations/azure/execution_compute_vm_command_executed.toml,sha256=wkmAn2F_pdvREtk9C0SnjgkZz-kJANLlSccqxe3DEHg,7250
nldcsc_elastic_rules/rules/integrations/azure/exfiltration_azure_storage_blob_download_azcopy_sas_token.toml,sha256=BGW8pwJGIXXdUi3Dnsu3zVrIPvbevAGBJC6OATpuMoI,7686
nldcsc_elastic_rules/rules/integrations/azure/impact_azure_compute_restore_point_collection_deleted.toml,sha256=TJAvdaRZiwtyZ-3aqvbnAMrbEWO7_3tslPniZHNC5cY,6223
nldcsc_elastic_rules/rules/integrations/azure/impact_azure_compute_restore_point_collections_deleted.toml,sha256=0heKO_iIIN8AZlFuZZZvTs5vBw47xOLvs5EUsklVMoI,7994
nldcsc_elastic_rules/rules/integrations/azure/impact_azure_compute_vm_snapshot_deletion.toml,sha256=FZW9YyO9dVOP_vq8GwoapfhoBh_K4dFN4q48aX609RQ,7460
nldcsc_elastic_rules/rules/integrations/azure/impact_azure_compute_vm_snapshot_deletions.toml,sha256=xL9pZNdPp3H9cO-eIUgUrGfZqWWthfbg3MaXlIhKCrM,8483
nldcsc_elastic_rules/rules/integrations/azure/impact_azure_storage_account_deletion.toml,sha256=62TzFYzXmfsZbsJv0K-kK8IPGB0y0_wmwb-jVCMgoRk,6213
nldcsc_elastic_rules/rules/integrations/azure/impact_azure_storage_account_deletion_multiple.toml,sha256=DVCWq3oOZXl6167uilt88fmzzAwOSnEEqTE_fWkg06E,7087
nldcsc_elastic_rules/rules/integrations/azure/impact_key_vault_modified_by_unusual_user.toml,sha256=oR22OGe9Ed3FgDa5u55LEA71JCZjjM1VAAzQRajPOAo,6300
nldcsc_elastic_rules/rules/integrations/azure/impact_kubernetes_pod_deleted.toml,sha256=JIp6E6pwCct9K4am9aYxURetrzju4V2F5blUDS8kqwg,6055
nldcsc_elastic_rules/rules/integrations/azure/impact_resources_resource_group_deletion.toml,sha256=H_rooZ8VGOpXt4VdWgoYBKotetjum3gmFfHTggi_ZAs,7183
nldcsc_elastic_rules/rules/integrations/azure/initial_access_aad_graph_unusual_asn.toml,sha256=zMJfWKhQoRUqMpbk5hYBYQsqkRZsdd29dpPhBcwpbuI,6070
nldcsc_elastic_rules/rules/integrations/azure/initial_access_azure_arc_cluster_credential_access_unusual_source.toml,sha256=heN5nh6zFYTecUrkh_87A-SAPKfLnD8Yv9TB6CKdq4I,6122
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_actor_token_user_impersonation_abuse.toml,sha256=WyggOSRPgbeSjIm3-y_SvsMbSHCU1_NfE3J7dU7x6vA,6636
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_device_code_auth_with_broker_client.toml,sha256=fgEJMdnXDGZmB4p-ELwzYKspltc879pFgMLEMbtpLog,7889
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_external_guest_user_invite.toml,sha256=ybxIMY3A0TX_A85qPAwzbuZWzE2pgS2CCxpmC9x72oo,6730
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_federated_login_by_unusual_client.toml,sha256=XQqNtSI6YNSmgSE48g4aCDnwf76HAUVC_3Ro_KKUy9o,8054
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_first_time_seen_device_code_auth.toml,sha256=WJyWQ-azjmYFbtoz_C3GfBMuVaQeVFJ4guvWwT4kGpg,7771
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_graph_single_session_from_multiple_addresses.toml,sha256=BdtT54xgMdKlIm1q2QR0w1MvUtZHgbZSPuPyp28IIws,13071
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_high_risk_signin.toml,sha256=bbUpIAhTsqkMbEXLMNyvz38rZX4mhxIE3xK-hBtD9OU,5507
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_illicit_consent_grant_via_registered_application.toml,sha256=FlLrIp13OPviVnsyR42TfGHm9Yld9qD4CpZEQNxP14w,9931
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_kali365_user_agent.toml,sha256=TqgHLjYaLTyWkE5dkcgJeVzwqjD3YDXKiI4YzrGdn60,7710
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_microsoft_auth_broker_nonstandard_user_agent.toml,sha256=MAjFW_3DQuoumzricXZZa5dE_p36t5ILSlOfE_ECarc,5985
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_microsoft_auth_broker_unusual_resource.toml,sha256=ExG6Afw2UGw6KxFdcJAyBkn9Z6co1hDfM7i5te3c_rM,5587
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_oauth_auth_code_grant_unusual_app_resource_user.toml,sha256=HfZUjUZLrU6hGrLHWOUEGemJVSAO7h1iT4ZpU2beOM0,10108
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_oauth_device_code_phishing_tycoon_aitm.toml,sha256=VB3XiqXKqbX43YZSRXKOQacfYOp3E2VC2j6ASzTCWUA,5343
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_oauth_phishing_via_first_party_microsoft_application.toml,sha256=TY9Pe-09FZ6DwiAnRtxPzwKpG_MbIJglNepsjJV-g4k,9404
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_oauth_user_impersonation_scope.toml,sha256=DPEc8YDKM2BO0Xr832Cu46s-Xjp5iZYdkD-CckZceR4,11769
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_powershell_signin.toml,sha256=C0G8XM32HGdR5CbkNrQI5Pl_wIokZmz-LCFTSW7A2dY,6071
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_protection_alerts_for_user.toml,sha256=--LguT0clncUEEn7NJoHfbsHDcst8n898npbYqzg9vc,6287
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_protection_confirmed_compromise.toml,sha256=w_GnxYfYueNx9tPJhCktLLVxf5JO6PXKmZ9zrILwhSc,8217
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_protection_sign_in_risk_detected.toml,sha256=f5zkwi-GUhUn_37AEI4LIQVrPoEeikPcMEJ5Vm2VElo,8898
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_protection_user_risk_detected.toml,sha256=sKZG17-r5qEX2rURq6lINMJE-vPrT_GhiWK8e9Sv7J0,8652
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_rare_app_id_for_principal_auth.toml,sha256=jl4CN4q7C6jDXvFUsFp3mmilniLR2L2PF9GoX6gb17o,15385
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_rare_authentication_requirement_for_principal_user.toml,sha256=a8vkE2f3Cei5VNMt0hoNaQnC6Bm8VC_-NhUUaXYZn5w,7330
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_risky_user_or_compromised_sign_in.toml,sha256=mRlVXioPm8kqBQ_-a3gxzo3WZjCQIwkZPDh3UozOqJo,5252
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_service_principal_signin_unusual_source_asn.toml,sha256=JOSbbrqTN0Kc2yy_ycXXZuxgvG6BB9HtlE727UKTGz0,8219
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_signin_impossible_travel.toml,sha256=O1x1QLPLd0DTuzjgCf-AuQlXTrO_E-6HSSMNAjjOTfE,15690
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_suspicious_oauth_flow_via_auth_broker_to_drs.toml,sha256=pJr2vo8EnJSVjZyc9J9UNqA3qdBi2w-at3cjsUQOkws,13810
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_temporary_access_pass_created.toml,sha256=_YEaAteHZh9FP5QmlzJ7dVoVKFTMynoJ2Utuhl4YdCw,5085
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_unusual_legacy_auth_client_signin.toml,sha256=HPcUbeuszGHSYbpCMMjoQjVLOfcNpWZg2f2sEyzEzNQ,7175
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_unusual_ropc_login_attempt.toml,sha256=qe9EPRkgMtHztYFieJXDAzgvrrKh6CGrB-anTtTMBwI,7189
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_user_reported_risk.toml,sha256=KtDmpxU9RJlyyWF7-Ud-v292iWaIbyS7iECi8PqtM8I,5178
nldcsc_elastic_rules/rules/integrations/azure/initial_access_graph_first_occurrence_of_client_request.toml,sha256=sTveqpcRUy-Vc6QTAicjRgKXFy5e_Yo3_jYrw-p-rjY,7535
nldcsc_elastic_rules/rules/integrations/azure/initial_access_tycoon_entra_id.toml,sha256=Z9XbrHu9qB87YhAtyocyd5UTXgnHbf5p575ZLa75rb0,4693
nldcsc_elastic_rules/rules/integrations/azure/lateral_movement_azure_aks_api_server_proxy_to_kubelet.toml,sha256=6XPQV3XXGfRmPYP_TSaixi7_vuys2DwuqodubjgucUI,6669
nldcsc_elastic_rules/rules/integrations/azure/lateral_movement_azure_vm_serial_console_connect.toml,sha256=OPbCJJAk15uusgCU2b_eH8CCbQ7QDsY0yKgDqCCtqdk,6634
nldcsc_elastic_rules/rules/integrations/azure/ml_azure_event_failures.toml,sha256=Qjrctylek8x8NHXwjdR84HvvvZ3C2OHCyu7Ajn9q0qE,7732
nldcsc_elastic_rules/rules/integrations/azure/ml_azure_rare_event_failures.toml,sha256=23SZmNQLcbnuc2aW0onjMSvVIoGc66ksPd7HQx8s2SE,7960
nldcsc_elastic_rules/rules/integrations/azure/ml_azure_rare_method_by_city.toml,sha256=ioD6yD56SxCeDwXi-t1m-tkZ5F1UPrzwbu54Or04_ws,7868
nldcsc_elastic_rules/rules/integrations/azure/ml_azure_rare_method_by_country.toml,sha256=32aOLxMAiuDo3zVZxkoZL64gWWsiSvGjZHTdkYRPec0,7455
nldcsc_elastic_rules/rules/integrations/azure/ml_azure_rare_method_by_user.toml,sha256=riNd4AqyEJrr64JJtijmYB3v_N7VLqMRMubf2C35k00,8558
nldcsc_elastic_rules/rules/integrations/azure/persistence_automation_account_created.toml,sha256=VGebP4zl2U9H4iFaeE5XeOwwvSkxllmsWyUo5wjAVnU,6144
nldcsc_elastic_rules/rules/integrations/azure/persistence_automation_webhook_created.toml,sha256=t0MtBiiou3aRQ14mLJl8I4fMeCm__VmPYtxbWbIRJYE,5986
nldcsc_elastic_rules/rules/integrations/azure/persistence_azure_vm_extension_deployment_by_interactive_user.toml,sha256=70_2JTqnL0c4IpsZ5K7g3Vojc9bFPuUTOd1T6IUgLPk,5297
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_application_credential_modification.toml,sha256=6qu4NjyTN6ddAx3dkgsR567mDcKcTRb_Kk4Rb42WciY,6901
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_conditional_access_policy_modified.toml,sha256=_Gh2XDuOx5eTATYKJuJnjbtcx1zRk4FZmbBfle46f4k,5695
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_device_registration_to_prt_chain.toml,sha256=FpJX2UlH5lBlQlP9pU2pw35BeVD_kpDzx1SKhSxTakY,10624
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_global_administrator_role_assigned.toml,sha256=5alVPmEByTUnqED6pmBQrl5F7hbqMEnjNBrw2LFMNzg,7074
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_guest_account_promoted_to_member.toml,sha256=PHzqbtbQ08JZoPuy0N0dU2aA8hitDScU596JucgoETQ,3739
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_mfa_disabled_for_user.toml,sha256=pOlASkuGJzYJfGsXd646Cl-DrbZq0tRrPN4RjsBTEPQ,6516
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_microsoft_auth_broker_drs_signin_from_suspicious_asn.toml,sha256=EqWfgti2RLpMJmzFtnh1w88W6yNyY_4D0aBNH7yUt4o,6167
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_multiple_device_registrations.toml,sha256=ULvNyw2e0Df2o-ELbQgOlDPK0kSnltnDW26k7uxRIec,10673
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_oauth_app_redirect_uri_modified.toml,sha256=0bD10v8jwnPttGnXKgWoAL1UPdW_66CjNa_xyVqeVYA,4557
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_phishing_kit_default_os_build_device_registration.toml,sha256=mi-w4-omTrAL1fXis1A5WKp3f7g_IkX3BfCwZ6-uXYU,7811
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_pim_user_added_global_admin.toml,sha256=l6qpDT9QzvVcFzyHbd0XjhRciDh-1VFtNxMFfUsRah0,6933
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_privileged_identity_management_role_modified.toml,sha256=vigrriJwdptrXdBMWJpLA_2OgqwyQWrhOYcJRKM0xNk,6190
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_register_device_unusual_user_agent.toml,sha256=-LH3sR0js2IyrUncp6XOVGOU-MyyjrnQnXCtkX4QjPw,4184
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_roadtools_default_device_registration.toml,sha256=mtQJqyfPUGMpKVQVUtUBm0UOQQUV0xQOvARNQW4xuNI,6977
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_rt_to_prt_transition_from_user_device.toml,sha256=6pC9cv2MEMfWkxm_f34HuYLK9Z-oQrWweRfHPh4DUd0,7614
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_service_principal_created.toml,sha256=8XhC3C5RS4URZeFBudvgKUmJx7oATFz4J-JMxAijUrw,6390
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_service_principal_credentials_added.toml,sha256=gkQTRL4MzSi-C4bfst9hCl_4M9CJR5YN39sinSghIk8,6475
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_service_principal_federated_issuer_modified.toml,sha256=P__IZsGn8p-wszNhv6VnZVa9oHcX-eY83rlwxCOhM7w,6800
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_suspicious_adrs_token_request.toml,sha256=I8CGHDX3lNF5sRJwevt1NNuChrT3SxX6hUGiJLCutjE,6536
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_suspicious_cloud_device_registration.toml,sha256=PKZJe4wBKh6ccK8s4bLaH0dotkeUVgzokKQO9blJxlc,7094
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_user_added_as_owner_for_azure_application.toml,sha256=RTcG7uThiINaHbt63-xUTxhhzCxdjhrjW-qWe9P_2mk,5957
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_user_added_as_owner_for_azure_service_principal.toml,sha256=t7tQ-OFXYzJdDnrhbqeb3VTLxAZPC1py4-FIPVm8Iv4,6164
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_user_signed_in_from_unusual_device.toml,sha256=_d9pUrKW97ylYN94_IKK0WyaucURA4zoyaBrrILd6Lg,8253
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_whfb_credential_registration.toml,sha256=oiC6eBzXegFb6YRjeYnEc98vLKxMlQ5r3_hugoOPGQ4,5044
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_whfb_deviceless_signin_to_device_registration.toml,sha256=iEE-FXP6lehrTphFTu9Gwj9dfTS97nR2PUIIHmOOfEc,10466
nldcsc_elastic_rules/rules/integrations/azure/persistence_event_hub_created_or_updated.toml,sha256=XukNAoYPjKQJghpQ3cV8iBPO0DHk3PkJJpR4Ezi9ha4,6859
nldcsc_elastic_rules/rules/integrations/azure/persistence_graph_eam_addition_or_modification.toml,sha256=HuL-IIiereq2yV0kzk4g8nO4Ky0dnBXvsQtEYoDQdr8,5863
nldcsc_elastic_rules/rules/integrations/azure/persistence_identity_protect_alert_followed_by_device_reg.toml,sha256=9aMVFIur_uML5MZx3KVJ85bBbJ1q0IAjFwlO622fOOQ,6150
nldcsc_elastic_rules/rules/integrations/azure/privilege_escalation_azure_rbac_administrator_roles_assigned.toml,sha256=bJl9tM4O2u92T4y06BIubRP9CSKWGrjCDnxwy2NvDiY,7320
nldcsc_elastic_rules/rules/integrations/azure/privilege_escalation_entra_id_elevate_to_user_administrator_access.toml,sha256=XA0488JiLcvqoKJKKX2Paj8Ga7rOAnc4oVunTGhnWzs,5930
nldcsc_elastic_rules/rules/integrations/azure/privilege_escalation_entra_id_tenant_domain_federation_via_audit_logs.toml,sha256=NCteWCB-vgQGLE-qlKnRCYAKkGyNlYNoDovKci1PUe8,7819
nldcsc_elastic_rules/rules/integrations/azure/privilege_escalation_kubernetes_aks_rolebinding_created.toml,sha256=BUmBqPl5GMbGUmzoeQv-2VYQdHH_HqMwQ64wr7JuGhU,7265
nldcsc_elastic_rules/rules/integrations/azure/resource_development_entra_id_custom_domain_added_and_verified.toml,sha256=GzwbIXoxWbDqPLzFOrdZg00gq4AbRYcVN6KTlh-HeBk,5831
nldcsc_elastic_rules/rules/integrations/azure_openai/azure_openai_denial_of_ml_service_detection.toml,sha256=bGvukAnkcWkgAk9IRHLq14SXrignwMk5G6kAFUth18k,6104
nldcsc_elastic_rules/rules/integrations/azure_openai/azure_openai_insecure_output_handling_detection.toml,sha256=bj7eQi0J4LdaCeMQePc8YqD1jcuhzCN8aNU-WNEIInQ,5898
nldcsc_elastic_rules/rules/integrations/azure_openai/azure_openai_model_theft_detection.toml,sha256=WPWj9lJScaSe0KoleC5Ce31ZUrtWmpSjaXwg5TMCgSU,5888
nldcsc_elastic_rules/rules/integrations/beaconing/command_and_control_beaconing.toml,sha256=w2_64eSV7-bX48q2Co_E-QKke0H94RTbwu9xY_1OPTY,7844
nldcsc_elastic_rules/rules/integrations/beaconing/command_and_control_beaconing_high_confidence.toml,sha256=oJeNs78We6JEe1ppvTePutUFCVYDTSTSifGZMUi5efM,7222
nldcsc_elastic_rules/rules/integrations/cloud_defend/command_and_control_curl_socks_proxy_detected_inside_container.toml,sha256=ImxHHvhyO-p8gQSo3v3CoBQTXX88id0v0MpqE2tJrg4,4804
nldcsc_elastic_rules/rules/integrations/cloud_defend/command_and_control_interactive_file_download_from_internet.toml,sha256=VVU_1rmX3yAQQUOM0ftIue71K8-LNOeaKfMeKUjqcg8,7418
nldcsc_elastic_rules/rules/integrations/cloud_defend/command_and_control_tunneling_and_port_forwarding.toml,sha256=WizQXO0wwgOl5IE0JrYbqsKPtDJmi4gYOxh7QAD2AMg,7381
nldcsc_elastic_rules/rules/integrations/cloud_defend/container_workload_protection.toml,sha256=LR-_eERWPEKzQDAgg98mCamkKuDFGhyGm90A3cytWdQ,5076
nldcsc_elastic_rules/rules/integrations/cloud_defend/credential_access_cloud_creds_search_inside_a_container.toml,sha256=fNj2qm1eNn-eOVBuAjMrzAOCHKMsJvyV-EyY1KZwvjk,4183
nldcsc_elastic_rules/rules/integrations/cloud_defend/credential_access_collection_sensitive_files_compression_inside_a_container.toml,sha256=X5yRCnezR-C4K1ypDDnLvlcfA0k4Jmnv-VgQS7Rp7e0,8515
nldcsc_elastic_rules/rules/integrations/cloud_defend/credential_access_sensitive_keys_or_passwords_search_inside_a_container.toml,sha256=YfinBaOxIBnP2lNZIe9-8D-FnDq0hJM_NaBq-obHXlU,8555
nldcsc_elastic_rules/rules/integrations/cloud_defend/credential_access_service_account_token_or_cert_read.toml,sha256=qXmolcmG54dP3M-9PaLmD60mfuN9l-X9oT2GZTkD_Pg,7502
nldcsc_elastic_rules/rules/integrations/cloud_defend/defense_evasion_decoded_payload_piped_to_interpreter.toml,sha256=AUjVGSw5Ap4nRncTpMjs8klBZ0JAO6M0F8yeewegjyY,9359
nldcsc_elastic_rules/rules/integrations/cloud_defend/defense_evasion_deletion_of_shell_cmdline_history.toml,sha256=f-uy_rGT84ZeD85_KHrgQBKyEs-x4kuiCy1BsPMn6Tc,6842
nldcsc_elastic_rules/rules/integrations/cloud_defend/defense_evasion_file_creation_execution_deletion_cradle.toml,sha256=S1v9y0oG8ivpSg4inWNTKgwWUr3nQR1DCicYTjwZNzc,8885
nldcsc_elastic_rules/rules/integrations/cloud_defend/defense_evasion_interactive_process_execution_from_suspicious_directory.toml,sha256=MLPaCcf70wF2OMfhO0RXBYDj2BgC28FRH45NWC051wE,6327
nldcsc_elastic_rules/rules/integrations/cloud_defend/defense_evasion_ld_preload_shared_object_modified_inside_a_container.toml,sha256=6EIa72k5u9PH-1b__hKyF16mRzpb29RvWMs086u0vxY,7572
nldcsc_elastic_rules/rules/integrations/cloud_defend/defense_evasion_potential_evasion_via_encoded_payload.toml,sha256=l3uq0IMIKTnNXnBgZrHASqDHd3GYcZscUUrlxd5pgn8,7405
nldcsc_elastic_rules/rules/integrations/cloud_defend/discovery_dns_enumeration.toml,sha256=xjvRnkbwqIhhydUO4IBV4shD2Sw8VdKoUgjtH176-vw,7612
nldcsc_elastic_rules/rules/integrations/cloud_defend/discovery_environment_enumeration.toml,sha256=YZrog6lptme2oJ9kCLBWgZiXf6-DYv8kZwhZBy3XcY8,7055
nldcsc_elastic_rules/rules/integrations/cloud_defend/discovery_kubelet_certificate_file_access.toml,sha256=C9JerQzW9_3nBF0K4TTJORtMtr1TZ9WNR9PzbpOQb80,7765
nldcsc_elastic_rules/rules/integrations/cloud_defend/discovery_kubelet_pod_discovery_via_builtin_utilities.toml,sha256=g7zu5apX9Vbm0rAdwv67FsnnbXzJLsRuaaHjuZ_Sg8U,7069
nldcsc_elastic_rules/rules/integrations/cloud_defend/discovery_potential_cluster_enumeration_via_jq.toml,sha256=Vp6EYmqhZEjASJYKWweV4RLVHFwY1XpX3voKV0R85c0,2097
nldcsc_elastic_rules/rules/integrations/cloud_defend/discovery_privilege_boundary_enumeration_from_interactive_process.toml,sha256=bR-W_2b6_QL5AFvbKbrWI4TFdHrChaAip9QAQPBgJv8,7569
nldcsc_elastic_rules/rules/integrations/cloud_defend/discovery_service_account_namespace_read.toml,sha256=g6r7l678QxvUqSnHUrLiDUOH_iEwCUeRfgWM4kW_xH4,7071
nldcsc_elastic_rules/rules/integrations/cloud_defend/discovery_suspicious_network_tool_launched_inside_a_container.toml,sha256=nNCQGUrkhqefZ1d17qooV6SrHEb6-tGa07ywTkLb064,9002
nldcsc_elastic_rules/rules/integrations/cloud_defend/discovery_tool_enumeration.toml,sha256=kOoL47gMqRZYhIlnVEdnNGP4Maf2bae7aOjEYdndiDU,7189
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_container_management_binary_launched_inside_a_container.toml,sha256=G8OtKeKEtcPgaKAGSTT6fs3zsnlwcez0wagE0PEpEck,8095
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_container_runtime_cli_suspicious_args.toml,sha256=zqkGK9ynZW5-llb2_Wl0a98OtuV1Mu9n0w_V56ojr9U,4191
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_direct_interactive_kubernetes_api_request.toml,sha256=wTtCf_jgYqFegLyXr29Tv-2r8xfcN2_9aFOy_hs2ifs,8932
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_interactive_exec_to_container.toml,sha256=Jw-QmZJKkASwGvkFdI9zIzI3X6CsKAm0fbNj_qjmZMM,7522
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_interactive_file_creation_followed_by_execution.toml,sha256=vnMLYnQutXnXCycfvTDxO66y_NHo3j_2E3k5eflspS8,6249
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_interactive_file_creation_in_system_binary_locations.toml,sha256=EgRqbFe5rP_hXsXmomcdIY8q5C2clmC3hnxBig8F0As,6819
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_interactive_shell_spawned_from_inside_a_container.toml,sha256=OMastNi6TNIyJrs2d5O_3jkfenetkOQzyIYksKkSaIg,6709
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_kubeletctl_execution.toml,sha256=EU0ZE8D_VmvEIoO6MMaboXzbfHDmSaurCNX5IxMv6qQ,7312
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_netcat_listener_established_inside_a_container.toml,sha256=BucfxB3yqM_Fjp5cLtKOTx_BaQb0NY05aUw0yHIptq4,8699
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_payload_downloaded_and_piped_to_shell.toml,sha256=O-l8sT6k5MHbnq_z6a_5Jm4V9tzQUh6QelMsVYee-uA,7849
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_potential_direct_kubelet_access_via_process_args.toml,sha256=KJBdA1B3Dd5Q6ek872VWvkgNiRcVhJCF1N24VI4BwgI,7203
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_suspicious_file_made_executable_via_chmod_inside_a_container.toml,sha256=SSQIicQO8iPVegNbcfDeH4lalXEo9VUZL32BHb_IKRU,7906
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_suspicious_interactive_interpreter_command_execution.toml,sha256=xlyTT9a_gIsrmF-VAfQLowa2M5yKo8qcm_ad8Pn21vw,10216
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_tool_installation.toml,sha256=RadndAM7cnl84pdVrxpxXajZkiDkRNE1xhV4F4_NBRE,6957
nldcsc_elastic_rules/rules/integrations/cloud_defend/impact_process_killing.toml,sha256=8enKthIbBe9nw7Uy_UOc9-10Z5yT0x_i0Q4WKZmH4Os,6749
nldcsc_elastic_rules/rules/integrations/cloud_defend/persistence_modification_of_persistence_relevant_files.toml,sha256=NcRC_gbve4sKI34X8kKWA-DVQEczkEXLJpcsTUsVSDs,10925
nldcsc_elastic_rules/rules/integrations/cloud_defend/persistence_ssh_authorized_keys_modification_inside_a_container.toml,sha256=eBYor3vLVO_sjCxvauBWSuoxwsde-W9eyKS7tgNVsnY,6905
nldcsc_elastic_rules/rules/integrations/cloud_defend/persistence_suspicious_echo_or_printf_execution.toml,sha256=BrtsHdBmn7n2f5Y9_uhOub_0uNvIotXoI7hBA7JIvdo,10915
nldcsc_elastic_rules/rules/integrations/cloud_defend/persistence_suspicious_webserver_child_process_execution.toml,sha256=mF44_by1zpxp7yrnY8bVGhYTJgl7CtEIcg6nQ-kBavY,14204
nldcsc_elastic_rules/rules/integrations/cloud_defend/privilege_escalation_chroot_execution_detected_inside_container.toml,sha256=7ps6Iu1mecOKvfufQG3gRgD0JA6I4ycXthrjv_gOn9g,6352
nldcsc_elastic_rules/rules/integrations/cloud_defend/privilege_escalation_debugfs_launched_inside_a_privileged_container.toml,sha256=WRhANH44RUHGUajjxV0vk-YBHrRpC_QwdxPdJ7Y8q7A,7251
nldcsc_elastic_rules/rules/integrations/cloud_defend/privilege_escalation_mount_launched_inside_a_privileged_container.toml,sha256=B3OHjMWyMyjpBjUSGat9eh8WlwxlFojwnLIWeAh6GF4,6974
nldcsc_elastic_rules/rules/integrations/cloud_defend/privilege_escalation_nsenter_execution_inside_container.toml,sha256=Zg7QcrphgzXhXDJWZ-Mcw9KtpdiQONNI-u1gKLWqeQQ,3944
nldcsc_elastic_rules/rules/integrations/cloud_defend/privilege_escalation_potential_container_escape_via_modified_notify_on_release_file.toml,sha256=FfY-refOr-OlSKfO7I9dMuvqwN789vbEk4hcO10D-1g,6380
nldcsc_elastic_rules/rules/integrations/cloud_defend/privilege_escalation_potential_container_escape_via_modified_release_agent_file.toml,sha256=q1elOa5-QWb6T9boRCz8KmTk_nmVk-ooimEKPYcrxJk,6501
nldcsc_elastic_rules/rules/integrations/cloud_defend/privilege_escalation_unshare_namespace_manip.toml,sha256=07-n7gaTKx5yDBuoIjIBetRwvt1g7boZGJkjRnn5VnI,6127
nldcsc_elastic_rules/rules/integrations/cyberarkpas/privilege_escalation_cyberarkpas_error_audit_event_promotion.toml,sha256=dmgv2hQGrOQmp6QFWnZVbut0yGf9uEolXa--SDw-Wrk,2107
nldcsc_elastic_rules/rules/integrations/cyberarkpas/privilege_escalation_cyberarkpas_recommended_events_to_monitor_promotion.toml,sha256=5wSihk4PDyblMF1Ch2p-RBUbgOcjMg_hixL5804IUPA,2990
nldcsc_elastic_rules/rules/integrations/ded/exfiltration_ml_high_bytes_destination_geo_country_iso_code.toml,sha256=pt6tr1HCg87cs7N_-3ej94JSPEjxR9EAjAY71ttWceI,7200
nldcsc_elastic_rules/rules/integrations/ded/exfiltration_ml_high_bytes_destination_ip.toml,sha256=Xd5thlARKWt5ah2RIVAclZ9kXrhLdR-NZs4dDqZPaiY,7311
nldcsc_elastic_rules/rules/integrations/ded/exfiltration_ml_high_bytes_destination_port.toml,sha256=Uqi1h5OkDR7v1EG7Er9djLa7kLchuIT4wKDDvGfBImE,7424
nldcsc_elastic_rules/rules/integrations/ded/exfiltration_ml_high_bytes_destination_region_name.toml,sha256=jGywqc5Nse_VuYF7RTdVIQHHwYZrTZmvakFR9c7ciyk,7238
nldcsc_elastic_rules/rules/integrations/ded/exfiltration_ml_high_bytes_written_to_external_device.toml,sha256=nTHCDxaoaKhd6kymyqeY1FU1KQnpENUbq_aIef4PKME,7022
nldcsc_elastic_rules/rules/integrations/ded/exfiltration_ml_high_bytes_written_to_external_device_airdrop.toml,sha256=u0V-dzpeBhSh5FLxeNBK0jvPCunYoQbRN726xgk92z0,7226
nldcsc_elastic_rules/rules/integrations/ded/exfiltration_ml_rare_process_writing_to_external_device.toml,sha256=0PtOJfiaKAxwivUrhlwfC2MB25bsZqagMOaybCbSlhY,6892
nldcsc_elastic_rules/rules/integrations/dga/command_and_control_ml_dga_activity_using_sunburst_domain.toml,sha256=btQIM-2bxkMhJO0UlGjr-e7gHs5TqEiRIAlIRgXciPs,8152
nldcsc_elastic_rules/rules/integrations/dga/command_and_control_ml_dga_high_sum_probability.toml,sha256=gk82Y3ZYdq3JhRFgVwaMuIs8iKI1BhRd1QnSqUVJdms,8744
nldcsc_elastic_rules/rules/integrations/dga/command_and_control_ml_dns_request_high_dga_probability.toml,sha256=k3tNF7K89cUO3m-2-8MRRmC1IKc4tXMP0UD9JQU-tv8,7897
nldcsc_elastic_rules/rules/integrations/dga/command_and_control_ml_dns_request_predicted_to_be_a_dga_domain.toml,sha256=hyRv7vAHygo8wIAoak5B2rTssUT16POMx6Qsa7yYCnQ,7912
nldcsc_elastic_rules/rules/integrations/endpoint/defense_evasion_elastic_memory_threat_detected.toml,sha256=6aYCF6vJq9jFoeHmEQlHki90_jomKfVU1xiuXmejeZc,8837
nldcsc_elastic_rules/rules/integrations/endpoint/defense_evasion_elastic_memory_threat_prevented.toml,sha256=K_i3j0ZsXFiJruD8AFPfkTWSsTnrwlxGUYxFjyVrnaY,8814
nldcsc_elastic_rules/rules/integrations/endpoint/elastic_endpoint_security.toml,sha256=7JuxGnkWghYWeJrQTlNC_QP-4ErFwhZUw_9TWnPhCR8,6892
nldcsc_elastic_rules/rules/integrations/endpoint/elastic_endpoint_security_behavior_detected.toml,sha256=oINVbk8RAmb4vcg7D_kzJ-eNr6ZvN4jjo38bz4UpU8E,6928
nldcsc_elastic_rules/rules/integrations/endpoint/elastic_endpoint_security_behavior_prevented.toml,sha256=HqxuwMpWU0DdAPsca_DN7_huN0C-UD4StK9ePoxSRxo,6907
nldcsc_elastic_rules/rules/integrations/endpoint/execution_elastic_malicious_file_detected.toml,sha256=j0CdnaijJeAt9XYH333dOfAzwNQHyPQuGY4ylgwRoE4,8719
nldcsc_elastic_rules/rules/integrations/endpoint/execution_elastic_malicious_file_prevented.toml,sha256=-ZPqaZmP2z-Su3cEmdqW4knt99pjQm2JQtU7eTBXHY0,8697
nldcsc_elastic_rules/rules/integrations/endpoint/impact_elastic_ransomware_detected.toml,sha256=i0euPpVIU9ybfJMJd_KLq6vgW0eYJAXZ5AuzkKx-RKk,8674
nldcsc_elastic_rules/rules/integrations/endpoint/impact_elastic_ransomware_prevented.toml,sha256=hWJgYtCQYC05-sA4f2dzwKiHOK8nylNPT8AizyzDBLo,8659
nldcsc_elastic_rules/rules/integrations/entityanalytics_entra_id/persistence_entra_id_device_phishing_kit_default_os_build.toml,sha256=e7wX0pl4WGutlo8AKH02sjSO0E01uMASb6xx5GQSGtM,7793
nldcsc_elastic_rules/rules/integrations/entityanalytics_entra_id/persistence_entra_id_device_roadtools_default_os_build.toml,sha256=vcnL9p4NHIHqiVJJeczbiQYXuj4CLH6KU_yKaXeyJ6Q,6763
nldcsc_elastic_rules/rules/integrations/fim/persistence_suspicious_file_modifications.toml,sha256=41eUV_X6xgAZLN4GP3n4Ln8b4OLi62TTbHQ4kAenAW8,16220
nldcsc_elastic_rules/rules/integrations/gcp/collection_gcp_pub_sub_subscription_creation.toml,sha256=-sseIBKmdG9SkLNO3h7FhzLIKUqeRTMLryLWZ_JMU-U,5795
nldcsc_elastic_rules/rules/integrations/gcp/collection_gcp_pub_sub_topic_creation.toml,sha256=YLBUCauv0q0bS23mRHI_9SJNHCw-OLF48NutGhT8rIE,6113
nldcsc_elastic_rules/rules/integrations/gcp/credential_access_gcp_gke_pod_exec_cloud_instance_metadata.toml,sha256=IcpABFCqzdHMpbgA44M5IctUlePpZS8uAdlgvAxQVhM,4465
nldcsc_elastic_rules/rules/integrations/gcp/credential_access_gcp_gke_pod_exec_sensitive_file_access.toml,sha256=ef5V6Wzv89qr4pjQ6EI0-T2NQm189B-3eKh_qRUhNew,5148
nldcsc_elastic_rules/rules/integrations/gcp/credential_access_gcp_gke_rapid_secret_get_activity_against_multiple_objects.toml,sha256=Vs4_p8LU-HKCCUHCQLBAatDkgf9ogF3SstdCeeCnZk4,4737
nldcsc_elastic_rules/rules/integrations/gcp/credential_access_gcp_gke_secret_access_from_node_or_denied_service_account.toml,sha256=0gcnaNU4f-QdxjpRyCGo1CKYl60BRTQbgMz4TscZtXo,4347
nldcsc_elastic_rules/rules/integrations/gcp/credential_access_gcp_gke_secret_access_suspicious_user_agent.toml,sha256=8VrNc-k7ogF16-dEQBK-A48FZRyKZ308qC543kZnOaw,2615
nldcsc_elastic_rules/rules/integrations/gcp/credential_access_gcp_gke_secret_access_via_unusual_user_agent.toml,sha256=CIT4vR6YQf65LMqyMpDnaq7jmw_U7GFfMuh3lHu3HP8,4180
nldcsc_elastic_rules/rules/integrations/gcp/credential_access_gcp_gke_secrets_list_unusual_source_asn.toml,sha256=vy_G1QRMJ0klWL5vk2YQMnJb19RSYE9hbJJxDEJ_xW0,3257
nldcsc_elastic_rules/rules/integrations/gcp/credential_access_gcp_gke_unusual_service_account_secret_get.toml,sha256=APcSHGHOD4iQhaUns4LtKrBOixOa13WUFCcG25TAxCY,4309
nldcsc_elastic_rules/rules/integrations/gcp/defense_evasion_gcp_firewall_rule_created.toml,sha256=yx_4ZLdwJqn0PVbn9CER_-LC-WzdMz-lIZZXkvrwSHE,6669
nldcsc_elastic_rules/rules/integrations/gcp/defense_evasion_gcp_firewall_rule_deleted.toml,sha256=L5sOBCHvqbOep7NrPNIpK7vg9es2bAFaBAlvchIFLmk,6128
nldcsc_elastic_rules/rules/integrations/gcp/defense_evasion_gcp_firewall_rule_modified.toml,sha256=CMs1VoaIlxIF9fEzvvQH2wAlmL1KKAQoDUmnCK8VjW0,6252
nldcsc_elastic_rules/rules/integrations/gcp/defense_evasion_gcp_logging_bucket_deletion.toml,sha256=DT5K2d31foYUcBVPWrvKQ75q5BT6A8dpCvddXLGbJ-c,6355
nldcsc_elastic_rules/rules/integrations/gcp/defense_evasion_gcp_logging_sink_deletion.toml,sha256=hJd6JNfO3iXaIK1BGFQ7yFUvsS3GcRh2e64i8ue5Ezg,6090
nldcsc_elastic_rules/rules/integrations/gcp/defense_evasion_gcp_pub_sub_subscription_deletion.toml,sha256=zwVakazYqN9aicbeNsk1yHieo-21ZfzXNZnnIpe9YNs,6038
nldcsc_elastic_rules/rules/integrations/gcp/defense_evasion_gcp_pub_sub_topic_deletion.toml,sha256=n3_1_WTnl1g8btGKn6plb_dehpMUUSM5r7g1ZLZeWT8,6219
nldcsc_elastic_rules/rules/integrations/gcp/defense_evasion_gcp_storage_bucket_configuration_modified.toml,sha256=oNNoIh57iDNlLwwyKZMUshQJy_u8wAg_K-Ugl_Zb-BE,6289
nldcsc_elastic_rules/rules/integrations/gcp/defense_evasion_gcp_storage_bucket_permissions_modified.toml,sha256=MibMmhYr5TIubkdqdE0abWpLbqA4j5sWvxtPAB4F3pM,6821
nldcsc_elastic_rules/rules/integrations/gcp/defense_evasion_gcp_virtual_private_cloud_network_deleted.toml,sha256=iUGTRvT2zYQ_O2O4h_6sy4K1QJdLfXqfg9ivYH2fcsg,6195
nldcsc_elastic_rules/rules/integrations/gcp/defense_evasion_gcp_virtual_private_cloud_route_created.toml,sha256=a_BAqEW9LYoORMcuPEyzdOUl4FAMNANUjDE1dxfMgSk,6615
nldcsc_elastic_rules/rules/integrations/gcp/defense_evasion_gcp_virtual_private_cloud_route_deleted.toml,sha256=5Yb6ngtb-PFOqbVwizVWEMSf6ISyqEJ1YVrtYTr1DWc,6523
nldcsc_elastic_rules/rules/integrations/gcp/discovery_gcp_gke_anonymous_endpoint_permission_enumeration.toml,sha256=GxMdot2VMhNZY9-v0mxHKJHrT9YUhW201VlcZTNk7yI,4190
nldcsc_elastic_rules/rules/integrations/gcp/discovery_gcp_gke_api_request_failure_burst.toml,sha256=pls0baNMhevQyNFv4AZFm3KHbC45u0V9ioo3hZAiMgA,2968
nldcsc_elastic_rules/rules/integrations/gcp/discovery_gcp_gke_endpoint_permission_enumeration.toml,sha256=ve8R06rbeak_9G-boO4jcpdHfzS5BHIL8ixpH_mBPkg,4864
nldcsc_elastic_rules/rules/integrations/gcp/discovery_gcp_gke_multi_resource_discovery.toml,sha256=p8WjUoP0eb7Nsa_96Xl_akBQrUnkS07saOdtdpD1xW4,8549
nldcsc_elastic_rules/rules/integrations/gcp/discovery_gcp_gke_suspicious_self_subject_review.toml,sha256=JrD9AAg9o9RCbcBNehxKrWa199aUIIklJJVme1i5XtQ,2925
nldcsc_elastic_rules/rules/integrations/gcp/discovery_gcp_secret_manager_listsecrets_across_multiple_projects.toml,sha256=gx6ybtM45Wih_jP2uuV4zf_kKvQGUmLWtTps2bBEIf8,5844
nldcsc_elastic_rules/rules/integrations/gcp/execution_gcp_gke_anonymous_pod_create_update_patch.toml,sha256=K-lu_g58n6HZ5TOKTmJKX3nbh4m1DvFQj_s_SSElMdk,3264
nldcsc_elastic_rules/rules/integrations/gcp/execution_gcp_gke_forbidden_creation_request.toml,sha256=WYYphS2MkE8ZxXiMVX-eoa_7dP05YOsM55gslcOAAKA,3117
nldcsc_elastic_rules/rules/integrations/gcp/execution_gcp_gke_forbidden_request_from_unusual_user_agent.toml,sha256=fGDOyiOcfgmmjN-M_8X6o3koC9T42vHE8SECbV73WKo,3720
nldcsc_elastic_rules/rules/integrations/gcp/execution_gcp_gke_pod_exec_curl_wget_https.toml,sha256=oTFIqGskhKmJ3iJRrvyP4w3DDyWxgJBt9gWf_dVkC2Q,4478
nldcsc_elastic_rules/rules/integrations/gcp/execution_gcp_gke_pod_exec_potential_reverse_shell.toml,sha256=om8IkIDZDtObUt8tU3ShU_SIxn8yWOxxUbyqEvkadGk,4772
nldcsc_elastic_rules/rules/integrations/gcp/execution_gcp_gke_user_exec_into_pod.toml,sha256=Yf4T88m-SxJ46Dkj7KgBcfxdIyO8i1Ivp3oyGwkZKNE,2552
nldcsc_elastic_rules/rules/integrations/gcp/exfiltration_gcp_logging_sink_modification.toml,sha256=gGVCJQDauWRSOtYNXtSpM6ki2fp88YFd4DNB4Jh0rKI,6608
nldcsc_elastic_rules/rules/integrations/gcp/impact_gcp_gke_coredns_or_kube_dns_configuration_modified.toml,sha256=8u8tzpOtJpW2fw9WDfRKMbFQMQafem-rs--mWSLS4CA,4336
nldcsc_elastic_rules/rules/integrations/gcp/impact_gcp_iam_role_deletion.toml,sha256=JMYrfO0hfMjlgDAY95SxInCppJuVBHK9hMOpFIvaDqg,5783
nldcsc_elastic_rules/rules/integrations/gcp/impact_gcp_service_account_deleted.toml,sha256=sR_It3DN_BkXVaJlmottjmgsSpR78-2akmvCHssQj-o,5773
nldcsc_elastic_rules/rules/integrations/gcp/impact_gcp_service_account_disabled.toml,sha256=cs93-WSzap5c_Eq5HUevJGJSUwb29hiSTd-mpqKYe18,5694
nldcsc_elastic_rules/rules/integrations/gcp/impact_gcp_storage_bucket_deleted.toml,sha256=CHqIHlVwtX3JvyEvQ7IZnLsSdMWMYslfc0s0lQ87Z7U,5566
nldcsc_elastic_rules/rules/integrations/gcp/initial_access_gcp_gke_anonymous_request_authorized.toml,sha256=GKVFkg_I-skbEpf9FIB4EOrJ3kltqdlgDjjCD3juwSw,3837
nldcsc_elastic_rules/rules/integrations/gcp/initial_access_gcp_iam_custom_role_creation.toml,sha256=1Rb0Rxa6Xx48Y9-xhljgDbP0mjSovQ_Da1qVC0ronQQ,6771
nldcsc_elastic_rules/rules/integrations/gcp/ml_gcp_error_message_spike.toml,sha256=ichY4bA5mcVRBRn16Fx3M7CqqjodEn2seFXsH6U7CKI,3522
nldcsc_elastic_rules/rules/integrations/gcp/ml_gcp_rare_error_code.toml,sha256=GJN2AE-K0m0AKJCLC8KM8j_qpgBVW9bSGN87yaXGmvo,4035
nldcsc_elastic_rules/rules/integrations/gcp/ml_gcp_rare_method_by_city.toml,sha256=1la3dvf5oGhZU0LFBIExXtSxHmCSQCdmSb0gedurGW4,3742
nldcsc_elastic_rules/rules/integrations/gcp/ml_gcp_rare_method_by_country.toml,sha256=kunqvsQd8oS6EQvxEk6TEYlRJkJzNQZGZZr81EAjFSo,4170
nldcsc_elastic_rules/rules/integrations/gcp/ml_gcp_rare_method_by_user.toml,sha256=aMg82WXN_TvSdH6ZVbcB-VvaWkrnqv79oaVIZ6_0gG8,4790
nldcsc_elastic_rules/rules/integrations/gcp/persistence_gcp_gke_admission_webhook_created_or_modified.toml,sha256=k2fYQ9IGtZgX9XB-ENrd_hFWiU3gaW_7VyPp9f3YxjE,3488
nldcsc_elastic_rules/rules/integrations/gcp/persistence_gcp_gke_certificate_signing_request_self_approved.toml,sha256=6LjSSRlWyBukXkNpm0-t3dYEDAgvW22872dStoUlTZA,6864
nldcsc_elastic_rules/rules/integrations/gcp/persistence_gcp_gke_client_certificate_signing_request_created_or_approved.toml,sha256=ac0OH3QCNG8RBZMHSB_PbEW71ind6xUVkpwMwl-ItM4,7138
nldcsc_elastic_rules/rules/integrations/gcp/persistence_gcp_gke_cluster_admin_role_binding.toml,sha256=tG8JxxDAxLZGSAVxbEHhbsUI262fAW3m3w7Y7IvBuTg,3578
nldcsc_elastic_rules/rules/integrations/gcp/persistence_gcp_gke_exposed_service_created_with_type_nodeport.toml,sha256=9GahuBfZ3Q-9Lxsu7t7kUeKwwIQHweDlZ4_2Cak2h0s,4390
nldcsc_elastic_rules/rules/integrations/gcp/persistence_gcp_gke_role_binding_referencing_service_account.toml,sha256=72D8iSEvwD6zFxYOVgvSQkYka59ElzAIXV53rBF4RLg,4148
nldcsc_elastic_rules/rules/integrations/gcp/persistence_gcp_gke_sensitive_role_created_or_modified.toml,sha256=57LzHNcANhHHaSgcDEuy8CTIVz2BPRxV7MqWJ7JKs2s,5573
nldcsc_elastic_rules/rules/integrations/gcp/persistence_gcp_iam_service_account_key_deletion.toml,sha256=whz1DELNOmO-b-U5w8qJ2JrF6HGAoXK4d3xaic0nGvg,6039
nldcsc_elastic_rules/rules/integrations/gcp/persistence_gcp_key_created_for_service_account.toml,sha256=C3ulX-JlbRNysULpFskgUorkXj0feDK_-j_SZu-PIYI,6338
nldcsc_elastic_rules/rules/integrations/gcp/persistence_gcp_service_account_created.toml,sha256=FuRXzXdJjUoGifz9XKOyJj_4b1WWIILcka88Rz100JY,5798
nldcsc_elastic_rules/rules/integrations/gcp/persistence_gcp_service_account_impersonation_role_grant.toml,sha256=a3usBcKyypwvR14K1aPertcXH4PJio81oEZxSM60Do4,6678
nldcsc_elastic_rules/rules/integrations/gcp/privilege_escalation_gcp_gke_api_proxy_to_node.toml,sha256=YbNIczGlJ3YPdRo77nLzHa-sCmtfM8Od90yyS_PU9C8,5349
nldcsc_elastic_rules/rules/integrations/gcp/privilege_escalation_gcp_gke_api_request_impersonating_privileged_identity.toml,sha256=OTRr3kqLQEQc6m5J14xwxL4SPaS1jCtScuxc13jQQfQ,4861
nldcsc_elastic_rules/rules/integrations/gcp/privilege_escalation_gcp_gke_certificate_signing_request_api_client_signer_requested.toml,sha256=Sxx_EjriqBp1gm3ZUFteGrTRr6Zgq2MLIeNCJkdWCo4,5858
nldcsc_elastic_rules/rules/integrations/gcp/privilege_escalation_gcp_gke_certificate_signing_request_privileged_identity_requested.toml,sha256=gIJRui_t4cqDDwcGQ1GTwWnnNg9UEMDZPVNVSiVwxmc,7126
nldcsc_elastic_rules/rules/integrations/gcp/privilege_escalation_gcp_gke_ephemeral_container_added_to_pod.toml,sha256=wJ_S-TdmLvVmyqVWOdyoeSy-skn6SBe9wTiyPrRbBOM,4039
nldcsc_elastic_rules/rules/integrations/gcp/privilege_escalation_gcp_gke_excessive_linux_capabilities.toml,sha256=e2Z0esuA7r_bkSJUu2yrkh8bFe_LIcaI9gxTUWqJL4s,3077
nldcsc_elastic_rules/rules/integrations/gcp/privilege_escalation_gcp_gke_pod_host_ipc.toml,sha256=SH3OWwuwQiqIgtH4p5xnOoJKMJlCvaijd-IFe6nm-Yo,2795
nldcsc_elastic_rules/rules/integrations/gcp/privilege_escalation_gcp_gke_pod_host_network.toml,sha256=8ILyzVi9xeCyDgBYDkvR0lClq8bLODt6vIvZ6sV1z7c,2866
nldcsc_elastic_rules/rules/integrations/gcp/privilege_escalation_gcp_gke_pod_host_pid.toml,sha256=RoVJoTnzARmWF6etSOP1WDN21925W_2YR8v8P1m4tiI,2803
nldcsc_elastic_rules/rules/integrations/gcp/privilege_escalation_gcp_gke_privileged_pod_created.toml,sha256=LMHn8mVFFC-7VMJqPhEehgcSv5j-yA1V_u1lEJ0MDJE,3073
nldcsc_elastic_rules/rules/integrations/gcp/privilege_escalation_gcp_gke_rbac_wildcard_elevation_on_existing_role.toml,sha256=sEyUmuSSqLcvve3bFiRY4LYz1qTI99kXFepvkiYRTDU,4023
nldcsc_elastic_rules/rules/integrations/gcp/privilege_escalation_gcp_gke_sensitive_hostpath_volume.toml,sha256=k83bBU0jWbWEGDO0DzCRZgfkTGeK0lXCPgvEjT-g-FM,3355
nldcsc_elastic_rules/rules/integrations/gcp/privilege_escalation_gcp_gke_sensitive_rbac_change_followed_by_workload_modification.toml,sha256=HjqiUvzVPCtVf37Tn1r5iYt88RprqteZouT7egV9zqg,8233
nldcsc_elastic_rules/rules/integrations/gcp/privilege_escalation_gcp_gke_service_account_modified_rbac_objects.toml,sha256=uV3fWCKizwtj1f9QW3C4eK2u3eGFspQXFn957QUlmKM,4780
nldcsc_elastic_rules/rules/integrations/gcp/privilege_escalation_gcp_gke_suspicious_assignment_of_controller_service_account.toml,sha256=B-liS3us0Yt2V4bEO4tTM31_vbQtI-s2g9kqSSY9CPQ,4586
nldcsc_elastic_rules/rules/integrations/gcp/privilege_escalation_gcp_gke_unusual_sensitive_workload_modification.toml,sha256=JSdqKuDP3_8MyGwLW3m38oXtG_HCqdL_c9DzjwSVIDg,4261
nldcsc_elastic_rules/rules/integrations/github/defense_evasion_github_protected_branch_settings_changed.toml,sha256=GZYbFt-ZQR3aEO4xqO9vfZgzg1NWIU2oA2y1hxeYuD0,5452
nldcsc_elastic_rules/rules/integrations/github/defense_evasion_secret_scanning_disabled.toml,sha256=iWpMxD2Rr37OjtR68ftnfEieVK0aPBbx9cED0PKMenA,5446
nldcsc_elastic_rules/rules/integrations/github/execution_github_app_deleted.toml,sha256=TFKrHAGYgrLNtamiTWOKvtT1gd1GBt84Oe_S4PXTz8E,5302
nldcsc_elastic_rules/rules/integrations/github/execution_github_high_number_of_cloned_repos_from_pat.toml,sha256=TfEHzKWjVmisbg4d-YkG8kmMcn9jxnolM1gONWUAMaA,5573
nldcsc_elastic_rules/rules/integrations/github/execution_github_ueba_multiple_behavior_alerts_from_account.toml,sha256=sBoDB9cs63vrsOGHnGFCThWh6zhC13upYxsf570xYFs,5187
nldcsc_elastic_rules/rules/integrations/github/execution_new_github_app_installed.toml,sha256=IS2VE8U9_jiAmbYmOW2lpns0UBZLiNkfxtIylb3-NGk,5649
nldcsc_elastic_rules/rules/integrations/github/exfiltration_github_private_repository_turned_public.toml,sha256=JWhBfLsNrg0EbwlLc0Szk5sGDrdAPh-uaQ0Nh3tAhBc,5553
nldcsc_elastic_rules/rules/integrations/github/exfiltration_high_number_of_cloning_by_user.toml,sha256=DxnHa7iKIN9fgcpIyiXvLT9wVpM_yA34jLBfTUpXI1s,6514
nldcsc_elastic_rules/rules/integrations/github/impact_github_repository_activity_from_unusual_ip.toml,sha256=0tEQXAi8241dh5oGITG2przjmmZA-wwCsXmlGWm6wgo,3147
nldcsc_elastic_rules/rules/integrations/github/impact_github_repository_deleted.toml,sha256=0wXCWcZsljc-NDeRLMBQgr_2tehrk5lgqSq9Q6H1mfI,5297
nldcsc_elastic_rules/rules/integrations/github/impact_high_number_of_closed_pull_requests_by_user.toml,sha256=FJqK6qMjvlolyGle4BKcd3yt0XclAmZLLQBCe0qpc2Q,6845
nldcsc_elastic_rules/rules/integrations/github/impact_high_number_of_failed_protected_branch_force_pushes_by_user.toml,sha256=RyyfwU2kqu0eHMJjv4FoAnxL9L8K0KV1qzYa1rkPfRo,6821
nldcsc_elastic_rules/rules/integrations/github/impact_high_number_of_protected_branch_force_pushes_by_user.toml,sha256=wIMjF8EG4hcvoup_qNsrJrxVj70GgjD3vB7M3GqztrI,7394
nldcsc_elastic_rules/rules/integrations/github/initial_access_github_actions_bot_first_push_to_repo.toml,sha256=_mkF2uzXVw5GCHsP5X8OdVgbjqLXv1CmCZyzKjWpbHw,5083
nldcsc_elastic_rules/rules/integrations/github/initial_access_github_actions_workflow_injection_blocked.toml,sha256=nAE21kCUB1VO6S3OZpkKpv1MayNyicyKXuUYZodbeMI,5338
nldcsc_elastic_rules/rules/integrations/github/initial_access_github_register_self_hosted_runner.toml,sha256=gQ_NoD2Hf9ThvAIsv4F5UjNM8heiG98_MErGYvg8X58,3741
nldcsc_elastic_rules/rules/integrations/github/persistence_github_org_owner_added.toml,sha256=Dn0yojCbPMeODOsB7EhkWvQc4QtQkXgr8a42U4GQ360,6103
nldcsc_elastic_rules/rules/integrations/github/persistence_new_pat_created.toml,sha256=gm6oYJr-5O_yH0Ggn4DnZh7UfuXmlYNX2X7XAx0d7mE,5777
nldcsc_elastic_rules/rules/integrations/github/persistence_organization_owner_role_granted.toml,sha256=5f3IXzfkl4n1XD2Lpr-uRs_xQQ1smC6DB0_Yj3GufFM,5618
nldcsc_elastic_rules/rules/integrations/google_workspace/collection_google_drive_ownership_transferred_via_google_workspace.toml,sha256=QaJ-Jl3X1KSM4cPQlYDnSAFXPQRZ6soSFUSjwVYB0Lo,8237
nldcsc_elastic_rules/rules/integrations/google_workspace/collection_google_workspace_custom_gmail_route_created_or_modified.toml,sha256=31sSThb4usk5pmXxZHbe-V8ElYipIZHv4uk8Bq9KIfI,7575
nldcsc_elastic_rules/rules/integrations/google_workspace/credential_access_google_workspace_drive_encryption_key_accessed_by_anonymous_user.toml,sha256=-wR6eKGfZntwF_FczBHAIfLrK6aWu7_qCoJpV5jYCg0,7179
nldcsc_elastic_rules/rules/integrations/google_workspace/defense_evasion_application_removed_from_blocklist_in_google_workspace.toml,sha256=6GoIexqxlJ92pecj5ZrWcvg7myQp2ZB20sBUr4CvW8Y,8240
nldcsc_elastic_rules/rules/integrations/google_workspace/defense_evasion_domain_added_to_google_workspace_trusted_domains.toml,sha256=qZzYYe_9z-4x32WkXYMFFVMYHe-hATOMyP3ZYM61BAg,7967
nldcsc_elastic_rules/rules/integrations/google_workspace/defense_evasion_google_workspace_bitlocker_setting_disabled.toml,sha256=_pPG_pRCaXBFRZL2SamNR6UUNbW_csExgpesCXXTNFw,6960
nldcsc_elastic_rules/rules/integrations/google_workspace/defense_evasion_google_workspace_new_oauth_login_from_third_party_application.toml,sha256=wZ-Epl-KZNEOFSs3f1lESLpWAlV3vPf5k5IS0GKCFbA,8631
nldcsc_elastic_rules/rules/integrations/google_workspace/defense_evasion_restrictions_for_marketplace_modified_to_allow_any_app.toml,sha256=YLk2H-j6YUCi_R0_zzXJSbuDMlNlhck-Fcvcn4u2ScQ,8193
nldcsc_elastic_rules/rules/integrations/google_workspace/google_workspace_alert_center_promotion.toml,sha256=L2vF7csjGC2RLTJ01zqAdKds1O0cRzaC8ZymNgZkwHk,2278
nldcsc_elastic_rules/rules/integrations/google_workspace/impact_google_workspace_admin_role_deletion.toml,sha256=4LnhzqTCW_HEUL5d1tC4AjfIkHd6jMsOx2oDgOvqSw4,8279
nldcsc_elastic_rules/rules/integrations/google_workspace/impact_google_workspace_mfa_enforcement_disabled.toml,sha256=51jQUVyuQ0qcT3ujQnGPl2Ivh1rYpQifmtw01OluD0g,9570
nldcsc_elastic_rules/rules/integrations/google_workspace/initial_access_external_user_added_to_google_workspace_group.toml,sha256=SxruGPT_ZmzZhFPCQ908hLmD8RbsmnU7h1W1bVxxy0g,7634
nldcsc_elastic_rules/rules/integrations/google_workspace/initial_access_google_workspace_login_from_atypical_asn.toml,sha256=VpWrVH8t_JvrD4ZbDTOQ2bdrwdhsO7y_kCwDCldskDw,6711
nldcsc_elastic_rules/rules/integrations/google_workspace/initial_access_google_workspace_login_impossible_travel.toml,sha256=lFb-KZrXcPRDaWon-oObAh7aHNK5Br_T924fWk0h5uY,12370
nldcsc_elastic_rules/rules/integrations/google_workspace/initial_access_google_workspace_suspended_user_renewed.toml,sha256=Lr2PoGPrI2aLMn6_MmEoQ4g1jMMPJoROSRfKmljLzIA,7704
nldcsc_elastic_rules/rules/integrations/google_workspace/initial_access_object_copied_to_external_drive_with_app_consent.toml,sha256=jhqYlZPiyiHQB2PRggRcYaXvMD6hCz4k6kRCgmmZlj0,11114
nldcsc_elastic_rules/rules/integrations/google_workspace/persistence_application_added_to_google_workspace_domain.toml,sha256=diX40OHBmqZCnCqwgA8i68A39fdI8dm_TY7Bnao7tCI,7688
nldcsc_elastic_rules/rules/integrations/google_workspace/persistence_google_workspace_2sv_policy_disabled.toml,sha256=MlhceKYgzmFeNmcTJNPTHuKApoZEHEcR7z2r2Caiy1c,8125
nldcsc_elastic_rules/rules/integrations/google_workspace/persistence_google_workspace_admin_role_assigned_to_user.toml,sha256=RknsfPWXiErZknGHEsTdYmp87HJXq4TThozjMYao0rw,8331
nldcsc_elastic_rules/rules/integrations/google_workspace/persistence_google_workspace_api_access_granted_via_dwd.toml,sha256=6gxnqRHUPiJdow8joPXhlWDlak0beUDS6t_QphkUmIg,8932
nldcsc_elastic_rules/rules/integrations/google_workspace/persistence_google_workspace_custom_admin_role_created.toml,sha256=81MvhVHhA5PD9VjoYqD_b-VkWRUNu2x2SXGT8HQx3bk,8465
nldcsc_elastic_rules/rules/integrations/google_workspace/persistence_google_workspace_device_registered_after_oauth_from_suspicious_asn.toml,sha256=ImvXru1vICHznAG4oQK0oiqEydW53AP2WHJ4mkgSQt0,4520
nldcsc_elastic_rules/rules/integrations/google_workspace/persistence_google_workspace_device_registration_atypical_device.toml,sha256=Py3SYsU0LBPhs6cVNmT3rc01qTN1sXuHBjgvz2O0QSQ,8666
nldcsc_elastic_rules/rules/integrations/google_workspace/persistence_google_workspace_device_registration_burst.toml,sha256=bnfaCh63WUoXPdmdP5f9MAEq5FQe5CjzHQDVpI82gKk,10006
nldcsc_elastic_rules/rules/integrations/google_workspace/persistence_google_workspace_password_policy_modified.toml,sha256=JJg6P8kMsyV0tXvf9jzlBm6msygGFVR-suAgf8qcWI4,9388
nldcsc_elastic_rules/rules/integrations/google_workspace/persistence_google_workspace_role_modified.toml,sha256=KbN6dO1mSryKxkH-Mrri4bIQt3aPkBKnqsf8w-hGosY,9330
nldcsc_elastic_rules/rules/integrations/google_workspace/persistence_google_workspace_user_organizational_unit_changed.toml,sha256=FRLVgMsOtC8SpdmMpBR-bH6fyBMGrnQpSG5bj9I4KPk,8100
nldcsc_elastic_rules/rules/integrations/kubernetes/credential_access_azure_arc_proxy_secret_configmap_access.toml,sha256=nvy39DlQSUmRo26XumToSPHOrB9jBN5-g-EnPyPNIUI,7480
nldcsc_elastic_rules/rules/integrations/kubernetes/credential_access_get_secrets_access.toml,sha256=sdO6t8D5d6EBZVfFTw4Bej6uaggyHk--YHt3zTL3UAY,6091
nldcsc_elastic_rules/rules/integrations/kubernetes/credential_access_kubernetes_multiple_secret_retrieval_burst.toml,sha256=V6gFFODtAYZO782rm8TuofLD28BhkfQYODqp5jMGvwQ,4362
nldcsc_elastic_rules/rules/integrations/kubernetes/credential_access_kubernetes_pod_exec_cloud_instance_metadata.toml,sha256=e04Ie57DnckWh3Ld2W0FZdFrOPwsUnfd7AvpcZ0W0nY,5657
nldcsc_elastic_rules/rules/integrations/kubernetes/credential_access_kubernetes_pod_exec_sensitive_file_access.toml,sha256=bRuEbscwTwX6eTLMcm19qo_IweKif8Iryh354fTLbqM,6676
nldcsc_elastic_rules/rules/integrations/kubernetes/credential_access_kubernetes_secret_access_scripting_http_clients.toml,sha256=IOf1uvk_zDcwoIp1K5dLzxg0bBTm6Fdf43ML96z6cus,4507
nldcsc_elastic_rules/rules/integrations/kubernetes/credential_access_kubernetes_secret_read_by_node_or_pod_service_account.toml,sha256=xX-hWY1_XfS38oJLKkiZie9jNCQJ_SaW-TDEHM8E14U,5835
nldcsc_elastic_rules/rules/integrations/kubernetes/credential_access_kubernetes_secrets_list_cluster_and_sensitive_namespaces.toml,sha256=r_WUmeuIFphREOFHsm226Tx8pcXiHgrkSSk_Ld8zrg8,3602
nldcsc_elastic_rules/rules/integrations/kubernetes/credential_access_kubernetes_service_account_token_created_via_tokenrequest.toml,sha256=YOlSoThYq95ZX-SSjaofNGtqjnniCJHnQl5pyBaPId4,5060
nldcsc_elastic_rules/rules/integrations/kubernetes/defense_evasion_events_deleted.toml,sha256=VhJNID0ys8vs2DfCOlI4_SnqxflSRy7-Qfs4XyUnE5A,5712
nldcsc_elastic_rules/rules/integrations/kubernetes/discovery_endpoint_permission_enumeration_by_anonymous_user.toml,sha256=rxPJXgvzJ7Nfs2BLsQoS04XkrY86Rn3HQp60xt3Tp1w,9609
nldcsc_elastic_rules/rules/integrations/kubernetes/discovery_endpoint_permission_enumeration_by_user_and_srcip.toml,sha256=ryGVXzFL72BJs7DdohcTq7v5e7I56YH8IR5aRTHMDkk,7465
nldcsc_elastic_rules/rules/integrations/kubernetes/discovery_kubernetes_multi_resource_setup_recon.toml,sha256=HiKqo8uRGC3wIPW9jSJI2b_DkS7jLhl_tpXlQfIu3Tk,5357
nldcsc_elastic_rules/rules/integrations/kubernetes/discovery_suspicious_self_subject_review.toml,sha256=t_3drU8_EHfDpMjZw0lkgLmwnHbIs5dKHIOBtaomwnA,7419
nldcsc_elastic_rules/rules/integrations/kubernetes/execution_anonymous_create_update_patch_pod_request.toml,sha256=wnxUp1juRwkkhXvwmtUJCyAapDh_6qguDNIOTZ2fkpU,1710
nldcsc_elastic_rules/rules/integrations/kubernetes/execution_forbidden_creation_request.toml,sha256=rsProEmHOY9jfUVWV0gScP2IxlHiY4-aYsNtSZRYYYk,6518
nldcsc_elastic_rules/rules/integrations/kubernetes/execution_forbidden_request_from_unsual_user_agent.toml,sha256=4ULaGEP7R-dWDW2Ee3qfe8KhmaZ8rj1RBSW2oS9hr34,6051
nldcsc_elastic_rules/rules/integrations/kubernetes/execution_kubernetes_pod_exec_curl_wget_https.toml,sha256=_zDKqVdeW__pc408WKfHRYdK_oUNr_mUMwfY6ZpxYMM,4838
nldcsc_elastic_rules/rules/integrations/kubernetes/execution_kubernetes_pod_exec_potential_reverse_shell.toml,sha256=Lj1B13royUiMLyl1Q7VZOox1OWfWPQ50TNxozYpJMzM,4326
nldcsc_elastic_rules/rules/integrations/kubernetes/execution_user_exec_to_pod.toml,sha256=raHIYpLxh-PaOquayqpvgXa-Z75YzXLZGs8Yv6LfQVM,9351
nldcsc_elastic_rules/rules/integrations/kubernetes/impact_kubernetes_coredns_or_kube_dns_configuration_modified.toml,sha256=wOzmO1gS0oswdlt0bEnRy94XvS_XeTPikSzBJTdcnCk,4228
nldcsc_elastic_rules/rules/integrations/kubernetes/initial_access_anonymous_request_authorized.toml,sha256=rGFDgCo0BxxBt-mR0u2zLMvwe_FFcutQ0Q6vcFR4Siw,6369
nldcsc_elastic_rules/rules/integrations/kubernetes/persistence_cluster_admin_rolebinding_created.toml,sha256=W452I04LPg5-smPEdBjyzWDrNvC3OlA4bzGEJ2oFWmU,6515
nldcsc_elastic_rules/rules/integrations/kubernetes/persistence_exposed_service_created_with_type_nodeport.toml,sha256=xLX40ZjnlIqsja-vqc3REUKCcUbq-5KLUKKfWnJItSc,7751
nldcsc_elastic_rules/rules/integrations/kubernetes/persistence_kubernetes_admission_webhook_created_or_modified.toml,sha256=pdjLWpE763qXg19hQZLel03uPnQtp7Y2AJ3Bg1-_exE,6057
nldcsc_elastic_rules/rules/integrations/kubernetes/persistence_kubernetes_client_certificate_signing_request_created_or_approved.toml,sha256=tcNYwU3NgERt2NbG-UZTiHwFKY10fpzCiVp4JCAdV_Q,5695
nldcsc_elastic_rules/rules/integrations/kubernetes/persistence_kubernetes_eks_aws_auth_configmap_modified.toml,sha256=Qska9_ya-b9Nh5HYFoPOR-Sx1FWuhJ-by8QsBp0m95Q,4525
nldcsc_elastic_rules/rules/integrations/kubernetes/persistence_sensitive_role_creation_or_modification.toml,sha256=IATuPCwQ6AxFxcpiaxjOCjUstOMCSSeNtd9pi9LLsZo,8815
nldcsc_elastic_rules/rules/integrations/kubernetes/persistence_service_account_bound_to_clusterrole.toml,sha256=AlBhvWUPCmseGUHiGynBeb_4IFqhdnD_5TxNZdG9e28,6762
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_api_proxy_to_node.toml,sha256=VHb1nuUqFCDs6_qpekakzhIZiF1Wg-pee4J8AQfkbmw,5732
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_container_created_with_excessive_linux_capabilities.toml,sha256=bSTORC2cmoiCM-wx8BoSKkytbUfXvp5DMYneVA7rOFI,5865
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_kubernetes_api_request_impersonating_privileged_identity.toml,sha256=EEtEkrKS0DsYOxoINsBXNUNxPCJD3SCc5C_-cE-_UmA,4855
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_kubernetes_ephemeral_container_added_to_pod.toml,sha256=Ku0JGEoQt6ocnldlyoX9ihqtRx52xKUudbGeToQYxrQ,3888
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_pod_created_with_hostipc.toml,sha256=vhWre0Koeo3e60oJ0y1Gybk9nGZKB15X4QDfcDBDsNM,7428
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_pod_created_with_hostnetwork.toml,sha256=NWsRtuJCJ06H_AKwkiwgtjglOTM3e-rTS484bhIa3pY,7517
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_pod_created_with_hostpid.toml,sha256=wI3j-xW5A1_ogJ44TUqC81Of1DJ8cn_Ekd5NclhQTyo,8189
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_pod_created_with_sensitive_hostpath_volume.toml,sha256=zFtV25pkHkYZeLTAAu_6AFTRI-OPhU5CIx384QuR8iA,8957
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_privileged_pod_created.toml,sha256=kPiU8Hzms5D3jcKrCNqCDWEkp2xidWdwa2NEbrcN1yI,8482
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_role_patch_wildcard_verbs_resources_response.toml,sha256=fbyIIr-CP7GLQxxYBgsWkPkKCJIRJXHCzydFz7kg-Ic,3889
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_sensitive_rbac_change_followed_by_workload_modification.toml,sha256=vROO1luNW3lmt5EIo6sYir-6Oh5_WulaL4YxVCivzBA,7286
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_sensitive_workload_modification_by_user_agent.toml,sha256=_0s0gljbgDhMusIWZ81kbqqfEd1S4IowD543vYvxHf8,6953
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_service_account_rbac_write_operation.toml,sha256=lmgPpMZ3z7uhUU2JR9rNJK7LZT_qwLZzt10lQ93IxjA,6482
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_suspicious_assignment_of_controller_service_account.toml,sha256=H0NKkn47KLsrNyBAgde2SZY7PA7LCgHycOH1UL8oyqw,7327
nldcsc_elastic_rules/rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_process_args.toml,sha256=_4RLJ4UMPlcNHIOPdMlSIHL4SvmHiP_q5dPWGweb3fc,7648
nldcsc_elastic_rules/rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_session_duration.toml,sha256=0QCtOFb7yvAFrhAk0FQz_snkWBETAq8cqK7oUQvW6_I,7501
nldcsc_elastic_rules/rules/integrations/lmd/lateral_movement_ml_high_remote_file_size.toml,sha256=q9shlVlBMuw7CoChxoYyEULeQ2_JFfyw8EPsSgBJXOo,7822
nldcsc_elastic_rules/rules/integrations/lmd/lateral_movement_ml_high_variance_rdp_session_duration.toml,sha256=QluO2uxE_4xUsA20NXQfC5MsnHfVOhDP1sOONnubJJ4,7585
nldcsc_elastic_rules/rules/integrations/lmd/lateral_movement_ml_rare_remote_file_directory.toml,sha256=DjLnONSwqaUXvkkKOwmY_h2IVTcBgR_vei_R2BpkZjc,7662
nldcsc_elastic_rules/rules/integrations/lmd/lateral_movement_ml_rare_remote_file_extension.toml,sha256=iVtMjScmO6C93-7UTwPjLPVf8ZFXfHhnMZ-sr5O-s7Y,7166
nldcsc_elastic_rules/rules/integrations/lmd/lateral_movement_ml_spike_in_connections_from_a_source_ip.toml,sha256=9uEEUxTWUGswdaqERH55AUJGg0NkJB3MyhZAonVjPss,7616
nldcsc_elastic_rules/rules/integrations/lmd/lateral_movement_ml_spike_in_connections_to_a_destination_ip.toml,sha256=E4JSxSDs20zszCM8UhAJffqwr9U6vsRdj0jWEnoA6GQ,7421
nldcsc_elastic_rules/rules/integrations/lmd/lateral_movement_ml_spike_in_rdp_processes.toml,sha256=OMm4NDsMsBzLtIZkf_FHjgIDFvEV35yOpDGuiRdKIm4,7503
nldcsc_elastic_rules/rules/integrations/lmd/lateral_movement_ml_spike_in_remote_file_transfers.toml,sha256=W_aWaI5oee0IigH3vYVi3fSGr5_BUA5Ey0CKJRYS5Dk,7578
nldcsc_elastic_rules/rules/integrations/lmd/lateral_movement_ml_unusual_time_for_an_rdp_session.toml,sha256=K4czsxxvTHq9Puo49-gjC2muLSgnWDTE1QnYJeAzOhY,7572
nldcsc_elastic_rules/rules/integrations/macos/credential_access_potential_macos_ssh_bruteforce_via_security_events.toml,sha256=Qhl7D7E6mrDoYeX7S0E99OEDMCLX7Hz-JW_PLgsZcKY,7426
nldcsc_elastic_rules/rules/integrations/macos/credential_access_potential_successful_macos_ssh_bruteforce_via_security_events.toml,sha256=4RucZ1NCqrpyVG4bKTralpCmAKDx_staWsd8IiLv4qw,7575
nldcsc_elastic_rules/rules/integrations/microsoft_exchange_online_message_trace/initial_access_azure_monitor_callback_phishing_email.toml,sha256=_cjrjwRNyOtFQJcc4D5o16lD934ew1gYfXoNLDyFAHw,6419
nldcsc_elastic_rules/rules/integrations/o365/collection_exchange_excessive_mail_items_accessed.toml,sha256=fI3Hg_MaaEtXmiyCN5rwd8is4mxnnvV_O50U0AXWKNI,7570
nldcsc_elastic_rules/rules/integrations/o365/collection_exchange_mailbox_access_by_unusual_client_app_id.toml,sha256=3e4oJSV_slet0kniFpy82iyizUGhZvckFK_fiKdXrlU,13178
nldcsc_elastic_rules/rules/integrations/o365/collection_exchange_new_inbox_rule.toml,sha256=Zv-9JZISLtAncSjLaZUKamu1cPeYv7Bx_5hHTjLzfk4,8182
nldcsc_elastic_rules/rules/integrations/o365/collection_onedrive_excessive_file_downloads.toml,sha256=RQm8R75lqaXmzPL8Z2akG4z5h5f82__c67Tvr49eNiM,8712
nldcsc_elastic_rules/rules/integrations/o365/collection_sharepoint_file_download_via_powershell.toml,sha256=FUSngVMlWygq7TjphJsYt8KFjc3iL6g6IOObI8HblTQ,6060
nldcsc_elastic_rules/rules/integrations/o365/credential_access_entra_id_device_reg_via_oauth_redirection.toml,sha256=UpuRTljBB3PQw-C9ZmO425AEBAV7NA6CgL8DgQ93Wrc,5869
nldcsc_elastic_rules/rules/integrations/o365/credential_access_entra_id_potential_user_account_brute_force.toml,sha256=-mU3bG16LDV9FzmoD4KecT2ylE28eiDP1pUDkRIWW2g,8858
nldcsc_elastic_rules/rules/integrations/o365/credential_access_identity_user_account_lockouts.toml,sha256=5zZiDCl2D27aiRFaczcAeDm2AgQOjx6KRt0BJr9aOMo,7056
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_entra_id_susp_oauth2_authorization.toml,sha256=agCh9pshJxka05eaL9VRpC3trkvjxezi5qifc9TyVyg,10911
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_exchange_anti_phish_policy_deletion.toml,sha256=OxQCojgaKjUftyoNsO-rbGopFNngjqIFQggcjPWaEgg,6117
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_exchange_anti_phish_rule_modification.toml,sha256=TsJrILzeR7u4Gb75Vgo0hGL5ZCxP2MkFXq7c2bKeZbQ,6115
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_exchange_dkim_signing_config_disabled.toml,sha256=alFzceAiPfsGepAmml6SVaGA8-rScx9J6cJronQIf8w,6782
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_exchange_dlp_policy_removed.toml,sha256=2c_wcUqHnhLptoH4wJnCLrkLpE6Hn0CJW4LS807WwU8,5375
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_exchange_exchange_safelinks_disabled.toml,sha256=duAd9U3uAge445FqjPobUnAj_O7nxuiQ7hS_3d8dCz4,6186
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_exchange_inbox_rule_obfuscated_name.toml,sha256=qPkmIUqMXDzVzNqXBGgJX45G4KN2-SKBlHEuPc5IOOk,5541
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_exchange_mailbox_audit_bypass_association.toml,sha256=yX_TXZPEu3t1fuTog1mOGcDBs6WChKrF60JSdzz5PuM,6507
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_exchange_malware_filter_policy_deletion.toml,sha256=Ihja1_bXtPGKmYIR8NwftkTcAzvuCxIEfeZPad_oQ6U,6068
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_exchange_malware_filter_rule_mod.toml,sha256=Aljqgxy8GyE6N6PQbksQoPcYddAnJ5ao1JlAiBYuxmo,6207
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_exchange_new_inbox_rule_delete_or_move.toml,sha256=D1Y8YQ1mmn1bO398irj0dk1SoWId7O33gbA2g8NhNC0,6524
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_exchange_safe_attach_rule_disabled.toml,sha256=u-0ArzBxkp1H6w_8dBEJpnyNJX4bW39-y7a3QVKlbwk,6116
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_mfa_notification_email_deleted.toml,sha256=J8TS_xSJlqq8sO-3HHkGb6XEtiB7zZSlWgTWYiaTdEw,6356
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_sharepoint_sharing_policy_weakened.toml,sha256=AXYD10IBgvNQzQaGn7xEHck5mrDUSQz7PJb-AxgoSY0,7613
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_teams_custom_app_interaction_allowed.toml,sha256=vkXdMpcdOGYjDsOGvi-BVOBVnpgvPTpRXxoYWi-RHOc,6770
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_teams_external_access_enabled.toml,sha256=hU-F6bHMeDsPXLA9I1IJy3dh0-D-Wa_TjQ_IZ801mVw,5751
nldcsc_elastic_rules/rules/integrations/o365/discovery_sharepoint_sensitive_term_search.toml,sha256=2TuezuslLNZBrsEJyTK8Ggo7FBxKQJNe3Cy-G7XKFgc,6136
nldcsc_elastic_rules/rules/integrations/o365/exfiltration_exchange_transport_rule_creation.toml,sha256=hdsnU1SY5r653fCSOD4XqenO0eeyAjA5kXCB4GDPZrY,6048
nldcsc_elastic_rules/rules/integrations/o365/exfiltration_exchange_transport_rule_modification.toml,sha256=JzcJT14WTvAgh4tzBA3GewOLm9hXp-ojr1m2PB1_UzE,6661
nldcsc_elastic_rules/rules/integrations/o365/impact_security_compliance_potential_ransomware_activity.toml,sha256=huGBN6Vz_m6qyjToUpIBvIjtEk7xzzimSs2RTVisM2c,5907
nldcsc_elastic_rules/rules/integrations/o365/impact_security_compliance_unusual_volume_of_file_deletion.toml,sha256=JD0YUceNznPhmqqP8ZoKT7tri_0Zk3H2XaQKgSS7bEs,5900
nldcsc_elastic_rules/rules/integrations/o365/initial_access_entra_id_portal_login_atypical_travel.toml,sha256=eIDRaLF5uooCbmWeRG8J5vO5gkeFJ9dye1pRHI7ws1k,6487
nldcsc_elastic_rules/rules/integrations/o365/initial_access_entra_id_portal_login_impossible_travel.toml,sha256=BegvmsjdCB7lr6N0C0bhil9ZpCbiuY8HhW451wLNyZ4,5702
nldcsc_elastic_rules/rules/integrations/o365/initial_access_identity_illicit_consent_grant_via_registered_application.toml,sha256=V_a3h6VAe_eiq4lZGDbq0HycAT2QWn2KNF8pl4COf90,8115
nldcsc_elastic_rules/rules/integrations/o365/initial_access_identity_oauth_device_code_grant_unusual_source_asn.toml,sha256=-a5b-YG4qOuVBbi9DY1AG4tDsRVSrMT_iiJnHVgr_04,8054
nldcsc_elastic_rules/rules/integrations/o365/initial_access_identity_oauth_device_code_grant_unusual_user_noncompliant_device.toml,sha256=dPKT5IMBGMhuJBljN3XlikN2BlfZZOP1aRafP_5pqnw,8085
nldcsc_elastic_rules/rules/integrations/o365/initial_access_identity_oauth_phishing_via_first_party_microsoft_application.toml,sha256=rS0ZVn7lieG6AxZza_plkvXh-YfAeYl4W5coWWY2IAE,9163
nldcsc_elastic_rules/rules/integrations/o365/initial_access_identity_ropc_grant_via_legacy_authenticated_client.toml,sha256=eyJ0rnALhvF3D-VLeL8SxbG8n-gvaW14zLeAsYlK3WI,6495
nldcsc_elastic_rules/rules/integrations/o365/initial_access_identity_unusual_sso_errors_for_user.toml,sha256=Rz2nJ_FJ576hm5QrD5DSGpU_IINb8amV3YhGTYPY7io,7228
nldcsc_elastic_rules/rules/integrations/o365/initial_access_security_compliance_user_restricted_from_sending_email.toml,sha256=VkBjAq4PMIOqXDdWdVLzbrdMZdlp2ef-V4zp6O81784,5667
nldcsc_elastic_rules/rules/integrations/o365/initial_access_teams_rogue_helpdesk_chat.toml,sha256=cNUGLbT6QLNXTc5i52QOi8Bf-9rGFMhKNX91wp-Qffk,6302
nldcsc_elastic_rules/rules/integrations/o365/initial_access_tycoon_o365.toml,sha256=vF2xxgZumY-FL6VC0MKHOd6ro0tTixtgg5HLEbl0u9g,4451
nldcsc_elastic_rules/rules/integrations/o365/lateral_movement_onedrive_malware_uploaded.toml,sha256=GhVyiKA5x4yrorgDeTDusPDzT8sJmiWJXQOSnaaHLyA,6684
nldcsc_elastic_rules/rules/integrations/o365/lateral_movement_sharepoint_malware_uploaded.toml,sha256=-ofmPWjGG5jU5jqiHlYYuEzZgQNHiSc2QovCwhoHCqo,6686
nldcsc_elastic_rules/rules/integrations/o365/persistence_entra_id_global_administrator_role_assign.toml,sha256=Mg8KRSgRZwfooYpU6VNg6L7nD19d2lAr-lDzb_BGckk,6026
nldcsc_elastic_rules/rules/integrations/o365/persistence_exchange_management_role_assignment.toml,sha256=gAkJwZnih9h8mnCR_ECZGbiAQn1SHoSfdW0VlMeHFeo,6194
nldcsc_elastic_rules/rules/integrations/o365/persistence_exchange_suspicious_mailbox_permission_delegation.toml,sha256=4Rpd68iIyPtiCJDa8BVNWZABfRH1qsUjnbL7x2IjzR8,6491
nldcsc_elastic_rules/rules/integrations/o365/persistence_teams_guest_access_enabled.toml,sha256=CFTDWaVEdTaSlACKmHKTLH70R03garWHjOR7HPPMW1o,6000
nldcsc_elastic_rules/rules/integrations/o365/privilege_escalation_exchange_new_or_modified_federation_domain.toml,sha256=iuD9nef_7iMu1H3V2RnaTbod2JUpbzyQRcj61aGbZVM,6997
nldcsc_elastic_rules/rules/integrations/o365/privilege_escalation_sharepoint_site_collection_admin_added.toml,sha256=1hB0ohYTKVwmZmnz5RpL6IMsNjgNs0jOwvyx2UJgabU,5820
nldcsc_elastic_rules/rules/integrations/okta/credential_access_attempted_bypass_of_okta_mfa.toml,sha256=eMXnZ7zcli9sjJskSsORsuMwoGJAwPTXEYL3a1pSU00,4653
nldcsc_elastic_rules/rules/integrations/okta/credential_access_attempts_to_brute_force_okta_user_account.toml,sha256=2RaJbJm7vRm5M59qll62_zV0ZrZtqahMay9iE4LS8PU,4865
nldcsc_elastic_rules/rules/integrations/okta/credential_access_multiple_auth_events_from_single_device_behind_proxy.toml,sha256=tSUvO_HMXuj2WeQxg9O0f404-0ULd7desdntJ3q5XwI,7060
nldcsc_elastic_rules/rules/integrations/okta/credential_access_multiple_device_token_hashes_for_single_okta_session.toml,sha256=4zZU1hVSfF-7XTJBgl2_eXENkAfk8UHfX-cV0xaKPRM,8756
nldcsc_elastic_rules/rules/integrations/okta/credential_access_multiple_user_agent_os_authentication.toml,sha256=-SExlpeb7sl5Xxnh6Zj_-HmgXJQRE7cNudprepvacII,4847
nldcsc_elastic_rules/rules/integrations/okta/credential_access_okta_aitm_session_cookie_replay.toml,sha256=s4oY4VzAdhw8XPsLfL6yHUSptOMaqiDiWy_tz9lNsrY,9600
nldcsc_elastic_rules/rules/integrations/okta/credential_access_okta_authentication_for_multiple_users_with_the_same_device_token_hash.toml,sha256=aAuiE--TDB76OIT95r9G2OpPxNR5PpS42UG0atxDO78,7779
nldcsc_elastic_rules/rules/integrations/okta/credential_access_okta_brute_force_device_token_rotation.toml,sha256=u__35J4yrQ-E2769YEtbUpG8SVY98u8vuf4ZH703YI4,6819
nldcsc_elastic_rules/rules/integrations/okta/credential_access_okta_brute_force_multi_source.toml,sha256=PgHjtKSGMCnDoYJpvu5BSDGfJMvnN1Y1KwISJbrMVEA,6426
nldcsc_elastic_rules/rules/integrations/okta/credential_access_okta_credential_stuffing_single_source.toml,sha256=YU4T8Vmu21nj8GW4CwL0iimepjhp0tL2yaxs-NkzczA,7873
nldcsc_elastic_rules/rules/integrations/okta/credential_access_okta_mfa_bombing_via_push_notifications.toml,sha256=LoUB44foIx_-z4VKklFvGZUFI4LM6RJBT-natTGx-tk,5438
nldcsc_elastic_rules/rules/integrations/okta/credential_access_okta_password_spray_multi_source.toml,sha256=JBLfLFBqFenJm0ZIqPNDPHRae6ChqG8oH-LzMl262C4,6750
nldcsc_elastic_rules/rules/integrations/okta/credential_access_okta_password_spray_single_source.toml,sha256=tVmrMQx5axtWq6nKocyzO0_-99IZzKjzlWPDFxNSWek,8094
nldcsc_elastic_rules/rules/integrations/okta/credential_access_okta_potentially_successful_okta_bombing_via_push_notifications.toml,sha256=mcH7epfLFbPK8E-JnjgyrSD-KbpwQ2rRB_AYs1DW11I,5585
nldcsc_elastic_rules/rules/integrations/okta/credential_access_okta_successful_login_after_credential_attack.toml,sha256=51JoIrl1_-VZlB964nLo2ZzYpZSLtCsNVDPrG3_mfoY,10072
nldcsc_elastic_rules/rules/integrations/okta/credential_access_user_impersonation_access.toml,sha256=EpAW43RXF4CQoBjP_SCnN0OPawO2DPW7hQ72epi7FJI,4407
nldcsc_elastic_rules/rules/integrations/okta/defense_evasion_attempt_to_deactivate_okta_network_zone.toml,sha256=UDkoxvUY2rVU2sVk2oKAWCGjQQ1IsxnVJ34Ec9Mb2o0,4707
nldcsc_elastic_rules/rules/integrations/okta/defense_evasion_attempt_to_delete_okta_network_zone.toml,sha256=uSrZdtZz0MFqSvJZpZp7mvLrsjMVFicyasFcCnLpsS4,4438
nldcsc_elastic_rules/rules/integrations/okta/defense_evasion_first_occurence_public_app_client_credential_token_exchange.toml,sha256=P2guGxbgEA7KhPNlGwHP6zIopGz3SKSbFmrZ9eSrWgY,7192
nldcsc_elastic_rules/rules/integrations/okta/defense_evasion_okta_attempt_to_deactivate_okta_policy.toml,sha256=q6-1WtAT7HR3MYMiyYd1cNxVcIJmt_4fKxYTh4JvlQ8,5598
nldcsc_elastic_rules/rules/integrations/okta/defense_evasion_okta_attempt_to_deactivate_okta_policy_rule.toml,sha256=iTa02R_443dUEPCgxLcve3EWH_e7UyqH6W5cfSLBMak,5423
nldcsc_elastic_rules/rules/integrations/okta/defense_evasion_okta_attempt_to_delete_okta_policy.toml,sha256=tUcBk1IwE-ddfanSDysbr7DdWWUciZbO8llWJ5MSyRI,5926
nldcsc_elastic_rules/rules/integrations/okta/defense_evasion_okta_attempt_to_delete_okta_policy_rule.toml,sha256=oagwQIDUQ26C4UVdGvRPlLg9PTIl-2w9TMRYks4PYiU,5249
nldcsc_elastic_rules/rules/integrations/okta/defense_evasion_okta_attempt_to_modify_okta_network_zone.toml,sha256=5gUnVBBxnHx9On829JZOcmdLNnCxJIiFRPRB7eWQNCA,5263
nldcsc_elastic_rules/rules/integrations/okta/defense_evasion_okta_attempt_to_modify_okta_policy.toml,sha256=ry8vE02IB2hhfmB_KJkiZSPYTAIS5DLVPo2FDo06rT8,4540
nldcsc_elastic_rules/rules/integrations/okta/defense_evasion_okta_attempt_to_modify_okta_policy_rule.toml,sha256=QgzhaTLN99owt1t6OFVMoBNfqbzjo0Q34VR5S_wd9UY,4826
nldcsc_elastic_rules/rules/integrations/okta/defense_evasion_suspicious_okta_user_password_reset_or_unlock_attempts.toml,sha256=7Q7vWoR7I7rYYjyqgq6RGAN6SbYW4fAk2f25IOhm9z4,5844
nldcsc_elastic_rules/rules/integrations/okta/impact_attempt_to_revoke_okta_api_token.toml,sha256=aq2XuXL7QFCWyVKMfllRSvwWGM1hJiTWAgIOhE6wCjY,3680
nldcsc_elastic_rules/rules/integrations/okta/impact_okta_attempt_to_deactivate_okta_application.toml,sha256=-jD7C4ZYVMXjlAwOdSwSJeP22nxHP4CulvUSU2sRDOs,4448
nldcsc_elastic_rules/rules/integrations/okta/impact_okta_attempt_to_delete_okta_application.toml,sha256=504GoEiIaHNXtoR51GbtnCy8kd4Wk8rCp3yus803J7g,5839
nldcsc_elastic_rules/rules/integrations/okta/impact_okta_attempt_to_modify_okta_application.toml,sha256=EUxHaCa9_UFnOt7YIpIQYFHksrQTbuUyccqXsiNuk2Q,5747
nldcsc_elastic_rules/rules/integrations/okta/impact_possible_okta_dos_attack.toml,sha256=y3v5djPNxwwRRVviuvncrVl0hg05yJYqFdLFBDEfavQ,6404
nldcsc_elastic_rules/rules/integrations/okta/initial_access_first_occurrence_user_session_started_via_proxy.toml,sha256=XOnMxGgHu0-F33R0ALszf7WJFf9w5JPNgUuFzky4xPk,4711
nldcsc_elastic_rules/rules/integrations/okta/initial_access_okta_fastpass_phishing.toml,sha256=5eHtCxmU_xnRc3rLSpeoOsM5U8Rg18mLMPK7h_B3lg8,6288
nldcsc_elastic_rules/rules/integrations/okta/initial_access_okta_suspicious_activity_after_proxy_authentication.toml,sha256=ZeRusiKJMPJYNs3ECjkT0VcCkpoxmzC0YojKT19pdMs,4911
nldcsc_elastic_rules/rules/integrations/okta/initial_access_okta_user_attempted_unauthorized_access.toml,sha256=pOBW7miEeG0fGfhGJnh6ixCuT6ZzLxivVhPyPYLPlSw,5868
nldcsc_elastic_rules/rules/integrations/okta/initial_access_okta_user_sessions_started_from_different_geolocations.toml,sha256=9cXwtMHXHUEUXguecfImAH3dYnzaDqgwE8TZtbiREtI,6446
nldcsc_elastic_rules/rules/integrations/okta/initial_access_sign_in_events_via_third_party_idp.toml,sha256=dKZ-QOBb0VNti1BmfYbiBC_t7KPlcGIGm9-0vHXySng,6601
nldcsc_elastic_rules/rules/integrations/okta/initial_access_successful_application_sso_from_unknown_client_device.toml,sha256=5gqW3SXO23hosZIl8pinwpTSPC6ppkK9uSehP6iytbc,6007
nldcsc_elastic_rules/rules/integrations/okta/initial_access_suspicious_activity_reported_by_okta_user.toml,sha256=5fMh-0mWvIRRUfK36irNoumtbeZFCBKK9gq0_NrKOdk,6662
nldcsc_elastic_rules/rules/integrations/okta/lateral_movement_multiple_sessions_for_single_user.toml,sha256=svzO3bJOCSzPUGoTp_qOjw4pB1pE5YirtAcG0Z7Ac14,6511
nldcsc_elastic_rules/rules/integrations/okta/okta_threatinsight_threat_suspected_promotion.toml,sha256=RYLPqQxhOP3QRDt5Mc7fEY3PC0YCs_5Q2nqoxQdX2gk,2488
nldcsc_elastic_rules/rules/integrations/okta/persistence_administrator_privileges_assigned_to_okta_group.toml,sha256=MWdjQsWDLJVANuAUlSD3dLiWT9_8qsbSETLjLHBy5LU,6521
nldcsc_elastic_rules/rules/integrations/okta/persistence_administrator_role_assigned_to_okta_user.toml,sha256=o99sAO2tc0BRJ4I0nPZaxBO9DFGdYdRRUgzzGByLMQ4,6681
nldcsc_elastic_rules/rules/integrations/okta/persistence_attempt_to_create_okta_api_token.toml,sha256=GQn5KsHxMS_Atku9zQ6WDq5yRz2iIV8KYYtfD6nCXfk,5953
nldcsc_elastic_rules/rules/integrations/okta/persistence_attempt_to_reset_mfa_factors_for_okta_user_account.toml,sha256=46sB1qbHsCnIjIk6l530THJdAJU-aWWfgqgMKIK-KvA,6185
nldcsc_elastic_rules/rules/integrations/okta/persistence_mfa_deactivation_with_no_reactivation.toml,sha256=5h4IH9Tp8nxWbAW8jDcD5oSuceqhXo9Y1DvIkjbSnHI,5419
nldcsc_elastic_rules/rules/integrations/okta/persistence_new_idp_successfully_added_by_admin.toml,sha256=FsrdE7O0wwNa_Lg1kmu1xTB-AXaQDYqfQOSU5wFFMwE,5170
nldcsc_elastic_rules/rules/integrations/okta/persistence_okta_attempt_to_modify_or_delete_application_sign_on_policy.toml,sha256=YKSeDOQkJ32Uoeu34prag9MYUL5GGXK_U_gycqp0vuA,6631
nldcsc_elastic_rules/rules/integrations/okta/persistence_stolen_credentials_used_to_login_to_okta_account_after_mfa_reset.toml,sha256=kR8cphhrH1YGOL_KCZFueTddgIRuDo4u548B0lcGleQ,5911
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_linux_high_count_privileged_process_events_by_user.toml,sha256=kd1S6eHpf1hroClv2A1rZ2a2K1Usw3ARrlMnnnHGG3U,7501
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_linux_high_median_process_command_line_entropy_by_user.toml,sha256=XjBIRGIqNqnP78IKXO3af8Q8VUy8zOKgT-3EmVljiz8,7156
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_linux_rare_process_executed_by_user.toml,sha256=eCiseCoE-ySYQTQLCDerwGoYgbcZvcvNXLyfwHNBhgk,6976
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_okta_high_sum_concurrent_sessions_by_user.toml,sha256=wfmyV-1tDzfl4KMvH9HN1cexjUrBw6LsxWIdBwQCmmE,7582
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_okta_rare_host_name_by_user.toml,sha256=1VGzFCH3-B6qzqIfSzE-kPl_F_7oh5ljYWQ8rrI3GVs,7537
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_okta_rare_region_name_by_user.toml,sha256=zNCN2KQPQ2wgY0d5bxD17r1U_50oW7IxvDGN1b8lxRk,7444
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_okta_rare_source_ip_by_user.toml,sha256=LxicPC9QrlOczxmJqUHcg0T2DQTzpe_pjpgiUNvufmg,7089
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_okta_spike_in_group_application_assignment_changes.toml,sha256=aiVqBwYUd2JBbOggcHiOoZlBQu46DVRMvZqcVuZV-fs,7149
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_okta_spike_in_group_lifecycle_changes.toml,sha256=GbJFzqFUrjZFy5B1AmaYAJFb5kSGa0tstiVpzpPu-d4,7780
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_okta_spike_in_group_membership_changes.toml,sha256=a7U3rhLRrEtbNwW_UBGWD4T3VD6dUnD309AsLe_gRHU,7266
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_okta_spike_in_group_privilege_changes.toml,sha256=vb5-JwMfTRMC8eM4SOHOT7BZH7BTH-7RkGktpPCBElE,7129
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_okta_spike_in_user_lifecycle_management_changes.toml,sha256=S5yuNQg7vKb79Up8BznV4HOE19lgjK5idlXsKJkB-lw,7348
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_windows_high_count_group_management_events.toml,sha256=pi6US9sW0oSKPozJVQU6mgCvBvuIk4U--lpMFnvNGCk,7365
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_windows_high_count_special_logon_events.toml,sha256=xrnwezpfP5SsAyAZV48l80zBWNgziZcS-uW7mPwoPf4,6927
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_windows_high_count_special_privilege_use_events.toml,sha256=52f-U9VPrS2uA2IkNxNmwjhLQoibnXWtLHRs8WWrguk,7331
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_windows_high_count_user_account_management_events.toml,sha256=UY7KxEPdDX3kOUimLUmSdE2onZhVBjOum3NEH6P4NxM,7788
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_windows_rare_device_by_user.toml,sha256=_InD6Zgxm83NEeVzmmwSSTxL6P3bUJLU_qXidsdAkTM,6918
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_windows_rare_group_name_by_user.toml,sha256=CsqMzTXU6ApI110UNMc9dRTYYZltkbCI00BFdJnxPpo,8351
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_windows_rare_privilege_assigned_to_user.toml,sha256=Ak27MFFwhQr3t-GcytD7-JWoWRuCp_-EXRsYqo0uvt4,7435
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_windows_rare_region_name_by_user.toml,sha256=hzj3B4L-wZaF1oTbH7wn0mF3k6Qjlkn1pEm5kSumBas,6892
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_windows_rare_source_ip_by_user.toml,sha256=PMZ5syly75nV2kMg-tFl8wSOQ76vv9L5W8P-DqQ2eEk,7170
nldcsc_elastic_rules/rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml,sha256=qSUZhQwBd-g6KqVqRf0_ZPmEhczTuPrUhfzz4kJw8yg,7263
nldcsc_elastic_rules/rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_parent_process.toml,sha256=279WsUQBnaj7GMk6N6TXg9vVGyC04jKIWsmgSsx--7o,7366
nldcsc_elastic_rules/rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_user.toml,sha256=y_hdcpdovzJRSYIjTEfcrsq1VK_n2obA0_8TM188gx4,7533
nldcsc_elastic_rules/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_event_high_probability.toml,sha256=sC4SJ2Q_P3e9WtAPzzHCI_5w4zMREsPco8LPMSBkeGM,9188
nldcsc_elastic_rules/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_event_low_probability.toml,sha256=kHM9OajwjzIOPj6xmn71Itwn3PwdKYfT8C79ynmpwhA,9066
nldcsc_elastic_rules/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_host.toml,sha256=PiJH3oCat4hZQzZEiepNPc8LeWTwvqY1VcyP0SZ-6is,7705
nldcsc_elastic_rules/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_parent_process.toml,sha256=wwShFU5FPjAmPqO-Xc8KetHEzoY52-OZ8W4MNbHfd6c,7939
nldcsc_elastic_rules/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_user.toml,sha256=fK-hbiijv7JkVQFR916fV-hdcwa5COt85qmWKite87U,7683
nldcsc_elastic_rules/rules/linux/collection_linux_clipboard_activity.toml,sha256=FAsn6lsYvAMFavE8zj7_aqUKwEft-BAXn_6xIHN4BN8,5978
nldcsc_elastic_rules/rules/linux/collection_potential_audio_recording_activity.toml,sha256=OC4X__cNq-KY74ZxpNuQzgJjSvHrcjxuDTBoGrYQ5YQ,6165
nldcsc_elastic_rules/rules/linux/collection_potential_video_recording_or_screenshot_activity.toml,sha256=TjTb98tsPIBguBl66a9EGmqhP9l9lCt_OVLywFs-jbk,6124
nldcsc_elastic_rules/rules/linux/command_and_control_auditd_curl_wget_from_container.toml,sha256=GOLYwd-DSyy2b0pqKURl6Lsd8CI5PAUBI4WwzFDBajo,5456
nldcsc_elastic_rules/rules/linux/command_and_control_aws_cli_endpoint_url_used.toml,sha256=DuESge9UrDtrm4SfViTHOUW8v-7ZmeZr6oiiGRZA8J4,6282
nldcsc_elastic_rules/rules/linux/command_and_control_cat_network_activity.toml,sha256=2SqI3xjoa4dFJlPrRSRDuOuCQlGHcivcP8dIORpSRp8,10423
nldcsc_elastic_rules/rules/linux/command_and_control_cupsd_foomatic_rip_netcon.toml,sha256=t6OCz-Xpb7Mg_YHmIxeO1iMvXCZrwFtyYU5sYymOJPw,8529
nldcsc_elastic_rules/rules/linux/command_and_control_curl_socks_proxy_detected.toml,sha256=7kxhx4_feIaklCaB-7vO94rdIETaDTR394Wvrky9RJs,9690
nldcsc_elastic_rules/rules/linux/command_and_control_dns_query_to_sus_top_level_domain.toml,sha256=5HybgShur9rH7fOXd8-av0VeCRytJCU1kKrMA18vIXg,9026
nldcsc_elastic_rules/rules/linux/command_and_control_elastic_endpoint_shell_execution.toml,sha256=GQ50cA1-K7sN1VDMzT_2I1yECgPmPvctcYivTM-1smI,9117
nldcsc_elastic_rules/rules/linux/command_and_control_frequent_egress_netcon_from_sus_executable.toml,sha256=kyzEpOYAFhuB439gNrTZhj34bHF6oTqqVUJsGfwtFOs,10181
nldcsc_elastic_rules/rules/linux/command_and_control_git_repo_or_file_download_to_sus_dir.toml,sha256=-byZOV_vmY4zcV5Y953ZmRh_BzxKfDSNk7WPH8Lhppo,9275
nldcsc_elastic_rules/rules/linux/command_and_control_ip_forwarding_activity.toml,sha256=jRnJ9H5crakAZShRj8WLTdoMnHeh5LjxfpQ9f7Nfvzc,6885
nldcsc_elastic_rules/rules/linux/command_and_control_linux_chisel_client_activity.toml,sha256=AcNC7lhQQfPWP7Ngecu4ojoyJdaroa4LXtC1XphoiT0,10598
nldcsc_elastic_rules/rules/linux/command_and_control_linux_kworker_netcon.toml,sha256=FrYSc84tYGxZrrz72UE7AQ2Gq9K51d_bjMFrH6gK70Q,8685
nldcsc_elastic_rules/rules/linux/command_and_control_linux_proxychains_activity.toml,sha256=i4l5iP4omwOG9zUGHprPoJLjMTsw8Jvtb2nVWYwb5ik,8130
nldcsc_elastic_rules/rules/linux/command_and_control_linux_ssh_x11_forwarding.toml,sha256=Vv_8U5wP2J2-QewWY5V-yJgj5aiJ9w0UPh5wfcqnT5M,8009
nldcsc_elastic_rules/rules/linux/command_and_control_linux_suspicious_proxychains_activity.toml,sha256=WRK6RHVx8OHEkcYf6QMz86ElmuDTs0qnNLKgLs0AbtA,10620
nldcsc_elastic_rules/rules/linux/command_and_control_linux_tunneling_and_port_forwarding.toml,sha256=_z6ecGQYAaUfPb5QGDNrR8WWilXLM6LT45ruCBgyfo0,11793
nldcsc_elastic_rules/rules/linux/command_and_control_linux_tunneling_via_ssh_option.toml,sha256=033bjMHhhbCy7lYPvkYROmrKyIgMgV_FVsr3HZZd1Ok,8525
nldcsc_elastic_rules/rules/linux/command_and_control_netcon_file_creation.toml,sha256=nJW5CoBAJ9CTA47_FAvpzr78SwNWZKXNvY8c0fSSB30,10395
nldcsc_elastic_rules/rules/linux/command_and_control_potential_tunneling_command_line.toml,sha256=VQGhBcy9-5Z15BVnw3SAYwsQpUEKPXKyDM7vCkA1f94,10695
nldcsc_elastic_rules/rules/linux/command_and_control_suspicious_network_activity_from_unknown_executable.toml,sha256=JzO_eJpUO0P15OzqF2r9cyH2dtcC_hYyEI44Icf174Q,15712
nldcsc_elastic_rules/rules/linux/command_and_control_telegram_api_request.toml,sha256=nLXnG3lhNGTaOKF1VjzP_HTZntNEAM5tifG4lFIQifU,9048
nldcsc_elastic_rules/rules/linux/command_and_control_tunneling_via_earthworm.toml,sha256=i4GovCgA1JjAp48ojeu8rstmXuWCrQSj9TAdf2_VEuo,11643
nldcsc_elastic_rules/rules/linux/credential_access_auditd_sensitive_cloud_and_host_identity_file_open.toml,sha256=Thw9z2ZeeuWhnxwikMxTPfuVpx3Lc83XjScTrgJ3y0E,9797
nldcsc_elastic_rules/rules/linux/credential_access_aws_creds_search_inside_container.toml,sha256=nPTP2QyzoLrDrHxNbvWrHyj0ENwpMWtjXb4oOAvk5Bo,8961
nldcsc_elastic_rules/rules/linux/credential_access_azure_wireserver_openssl_cms_decrypt.toml,sha256=9k4OzaSrU3trHk0zcs2iUyQxR2Ygavoy0qeABcJVdGM,5277
nldcsc_elastic_rules/rules/linux/credential_access_collection_sensitive_files.toml,sha256=pp2fQbf8cLIq0y7AmM8p0caA5eZuk44VE73UpJiio1c,11207
nldcsc_elastic_rules/rules/linux/credential_access_collection_sensitive_files_compression_inside_container.toml,sha256=CFA7O7w56k0hGyPPX78YRBXfm--V1xh-YwBCo_KuEXI,8606
nldcsc_elastic_rules/rules/linux/credential_access_credential_dumping.toml,sha256=FdyC5dxg9NhtclzQKb2BKw-SnHPJSwfcgkbBZHsQpXU,8504
nldcsc_elastic_rules/rules/linux/credential_access_gdb_init_process_hooking.toml,sha256=6_tFM0g5G0cVcQ7lbkFJx12XrRXGsuL3OegZ1JXHmMs,8352
nldcsc_elastic_rules/rules/linux/credential_access_gdb_process_hooking.toml,sha256=wMyG6KS3dI4l3qhXQmik8u9IXDy7aGZdhOJe12l_1xs,6448
nldcsc_elastic_rules/rules/linux/credential_access_gh_auth_via_nodejs.toml,sha256=8v_IAixIXUglrIyNTqH7WE91zCDtqi4SSwonYcZLKzA,5151
nldcsc_elastic_rules/rules/linux/credential_access_kubernetes_and_cloud_credential_paths_via_process_args.toml,sha256=Wx_YH1ACdctmNwIg7NE8Qgy-sTkDhLhyqgoHlmgEfME,5397
nldcsc_elastic_rules/rules/linux/credential_access_kubernetes_service_account_secret_access.toml,sha256=G4xEfoVZOjXv5J8wJHXn6cTHC6_YfCEdgZRqrlFzqPg,10044
nldcsc_elastic_rules/rules/linux/credential_access_manual_memory_dumping.toml,sha256=bdiJH8XwmCHEh2gXwP-NmSvm_zQtq0cUbd3vlrN4Mko,9055
nldcsc_elastic_rules/rules/linux/credential_access_potential_linux_local_account_bruteforce.toml,sha256=v_h32SUOQRWamnoOAVaMCpN-Q0pC4NpI24XCpOikIg4,8988
nldcsc_elastic_rules/rules/linux/credential_access_potential_linux_ssh_bruteforce_external.toml,sha256=xCbeCpJMSPx-uPoCxiFtrGnK1fhd1F5YfPukANfv66M,6401
nldcsc_elastic_rules/rules/linux/credential_access_potential_linux_ssh_bruteforce_internal.toml,sha256=_kns4WfforrM6CSMjlzlJsEhgIh_dmFV3_uGg9DSR00,6377
nldcsc_elastic_rules/rules/linux/credential_access_potential_password_spraying_attack.toml,sha256=hZID2UDjA8P5digN4yA22vzyUJfEimZArWyVtubeQx4,6543
nldcsc_elastic_rules/rules/linux/credential_access_potential_successful_linux_ssh_bruteforce.toml,sha256=d6kN2ICSFDQQQVWM57v8qy-lQsizAcKeO_8AYl99slk,7245
nldcsc_elastic_rules/rules/linux/credential_access_proc_credential_dumping.toml,sha256=1ZzV_3eiyA_vB-agKLVRmWJ7d7K108SmW76f7mi4Dl0,9234
nldcsc_elastic_rules/rules/linux/credential_access_segfault_from_sensitive_process.toml,sha256=l982eYCQ-4ksDhrvse4exo73dGwojHiWySEjL6pvUeY,7056
nldcsc_elastic_rules/rules/linux/credential_access_sensitive_keys_or_passwords_search_inside_container.toml,sha256=SSkYQuGQQtjchLYANoOpRgGI6EyveYhi96-6gQUdWzk,8585
nldcsc_elastic_rules/rules/linux/credential_access_ssh_backdoor_log.toml,sha256=w18ljdEKdjYM6absHhtdHAedL7h2ryPxxLXCYR5NGYk,11552
nldcsc_elastic_rules/rules/linux/credential_access_ssh_password_grabbing_via_strace.toml,sha256=iqGjtWGlmp2QX1a9rSZwOWKnVt70QXKCvVBpxxWAhaA,5776
nldcsc_elastic_rules/rules/linux/defense_evasion_acl_modification_via_setfacl.toml,sha256=cnIEQDUJHcbcfJZna5e1Sl9PWE_JKvKFP3IbkhaMA-s,6212
nldcsc_elastic_rules/rules/linux/defense_evasion_apparmor_exploitation_via_sys_fs.toml,sha256=ky2J8hKMVTvQGaIeHQpQjOEi8T7Zl5H3ryHhARgWLBs,9319
nldcsc_elastic_rules/rules/linux/defense_evasion_apparmor_policy_access.toml,sha256=1vxYCaJM6d_pK6Z3na46LX3B7ah08ga-YcBdybT0oHc,8416
nldcsc_elastic_rules/rules/linux/defense_evasion_apparmor_policy_violation.toml,sha256=-oVcEMBWUP0AatWrcp5i4sYjxZmjw-RBZ2u8_Qos_As,7787
nldcsc_elastic_rules/rules/linux/defense_evasion_apparmor_profile_compilation.toml,sha256=tq4MhGBiuZg792IqlT24JHV9atAuo1Z-qi9ISe7xLlc,8992
nldcsc_elastic_rules/rules/linux/defense_evasion_attempt_to_disable_auditd_service.toml,sha256=v995x7kiVcqRB_IIcFwGPBzA5orkdqXCMPUzRRleGNo,8214
nldcsc_elastic_rules/rules/linux/defense_evasion_attempt_to_disable_iptables_or_firewall.toml,sha256=v2Z5NP0KgGjPonlz7N9Pbg9g0vfriloeyc--OIXFUBw,9211
nldcsc_elastic_rules/rules/linux/defense_evasion_attempt_to_disable_syslog_service.toml,sha256=dmK0xyXFaUxKefMw0OgBWB1MWqPQTNQ1ptg2ZvXRbRg,10289
nldcsc_elastic_rules/rules/linux/defense_evasion_authorized_keys_file_deletion.toml,sha256=8ZcCPxQmA6sNrR_8DdVnAaN-DBPIHarm7mYdzhqObRA,8181
nldcsc_elastic_rules/rules/linux/defense_evasion_base16_or_base32_encoding_or_decoding_activity.toml,sha256=aJztI9udVOvevpHaLeEtIl7H357aCBXLTDlc6_9tNNs,10236
nldcsc_elastic_rules/rules/linux/defense_evasion_base64_decoding_activity.toml,sha256=bV2udWGKQY5b2USwv8OhxyjOT5PLlQTH0HsEP4qv7R0,11266
nldcsc_elastic_rules/rules/linux/defense_evasion_binary_copied_to_suspicious_directory.toml,sha256=eyyAMDoyY0xcMdzHSgnHFgMQs35z5gYCSiNJqblBK7k,8471
nldcsc_elastic_rules/rules/linux/defense_evasion_bpf_program_tampering.toml,sha256=ztmqLyFeRVpB2D2mxlkHonnT2xkfV_pD4k8JRFjo09Q,6774
nldcsc_elastic_rules/rules/linux/defense_evasion_busybox_indirect_shell_spawn.toml,sha256=-Jr4QHh4UMRq9lTFLoDpSEWSq50vlLiXeeUJI3dur5M,8931
nldcsc_elastic_rules/rules/linux/defense_evasion_chattr_immutable_file.toml,sha256=yuowWfqn7FvBCdLxjou1O2n6t_TAyydkqvHOfhLIzIo,10473
nldcsc_elastic_rules/rules/linux/defense_evasion_clear_kernel_ring_buffer.toml,sha256=ztdq_KOGIXTenT6P-sY7PPQB397RXPpTliteeCbwLj8,8099
nldcsc_elastic_rules/rules/linux/defense_evasion_creation_of_hidden_files_directories.toml,sha256=mx1Dy5rl8BqEfjcx5UaQlguxkjYWY-hCCd4x2aBUYE0,5599
nldcsc_elastic_rules/rules/linux/defense_evasion_curl_or_wget_executed_via_lolbin.toml,sha256=T-3aLbNYeOwzWX53iBL9CAAuxknO7FXhvzbHIvOtfzs,12733
nldcsc_elastic_rules/rules/linux/defense_evasion_directory_creation_in_bin.toml,sha256=SAHwdVOXtOn4WOfOss_36ceVgPgde7d7DAoIjBME5D4,8736
nldcsc_elastic_rules/rules/linux/defense_evasion_disable_apparmor_attempt.toml,sha256=y5HRmdGDKWhVNG1iYLUtfU2KdUUpp0gAsl6Afelun_w,8772
nldcsc_elastic_rules/rules/linux/defense_evasion_disable_selinux_attempt.toml,sha256=BIDFvCa5G-b_8aKU_I3xa56PYCEfnJaKCbnDZrdzlvk,9318
nldcsc_elastic_rules/rules/linux/defense_evasion_doas_configuration_creation_or_rename.toml,sha256=CC9iLRtafn5uwnmel_VyD6cB1q9C9b1LhFEGFTnevE0,8078
nldcsc_elastic_rules/rules/linux/defense_evasion_dynamic_linker_file_creation.toml,sha256=T3xBJyAwd3rFPf76MXrlpf-UVVIkLM66R7iIKVbNrSk,10763
nldcsc_elastic_rules/rules/linux/defense_evasion_esxi_suspicious_timestomp_touch.toml,sha256=J4JvVhZu4y9pBNHMUK3oPb_p4oaDqB92CbGSOlLABsw,8445
nldcsc_elastic_rules/rules/linux/defense_evasion_execution_followed_by_self_deletion.toml,sha256=Z6AEQdta5Mebz4Al-uBTK2ncEuNIUr4O2lVWVs8N6fo,7576
nldcsc_elastic_rules/rules/linux/defense_evasion_file_creation_world_writeable_dir_by_unusual_process.toml,sha256=zw_trxqloL7ynJ7BWQDgFCpkmHmiSA73csDztv-D2fw,9352
nldcsc_elastic_rules/rules/linux/defense_evasion_file_deletion_via_shred.toml,sha256=MN9uWhzzQXAyJO2N5IngMVOwaMYr5sYLqtxg-aIaGao,8132
nldcsc_elastic_rules/rules/linux/defense_evasion_file_mod_writable_dir.toml,sha256=G04yztTzczJ7_nQxfRxkOXz7YUJSisJyx9UXC31BX54,9895
nldcsc_elastic_rules/rules/linux/defense_evasion_fileless_execution_via_o_tempfile.toml,sha256=FOGVKfEQJE423AlGP6lp2agtYRTITn68JkHXvh9f_X8,7927
nldcsc_elastic_rules/rules/linux/defense_evasion_fileless_execution_via_unusual_memfd_create.toml,sha256=noQY3pVzAxrQ0JtOM-lMblwFJ2Nw6ShimdxKC4-b4H4,8637
nldcsc_elastic_rules/rules/linux/defense_evasion_hex_payload_execution_via_commandline.toml,sha256=jWvdsIcF-ao8yqzuwLuJsuz0R72AcT4yuP6lRJdaBRg,8762
nldcsc_elastic_rules/rules/linux/defense_evasion_hex_payload_execution_via_utility.toml,sha256=Jllw_0BDL_ITJWCmBvJA3xD-HSnrY97G-YdKKi93np8,9708
nldcsc_elastic_rules/rules/linux/defense_evasion_hidden_directory_creation.toml,sha256=w6SAj2rlHTq1aXxjpFeAMAaUkK18ztDiS3VfQE_n1L4,8782
nldcsc_elastic_rules/rules/linux/defense_evasion_hidden_file_dir_tmp.toml,sha256=WOHegCwZfe4j3RAmlih4dG1_4jWnarGUse7n-IHwDSE,10281
nldcsc_elastic_rules/rules/linux/defense_evasion_hidden_shared_object.toml,sha256=kyTjYQ9NbB05wnxLPp24KeLap9czuK59xrJ5_JHPkJM,9485
nldcsc_elastic_rules/rules/linux/defense_evasion_interactive_shell_from_system_user.toml,sha256=BewAE1VlDUhG3nVxN9-zKJa6fOgh2QzTgGeEYyDFVwU,10220
nldcsc_elastic_rules/rules/linux/defense_evasion_interpreter_launched_from_decoded_payload.toml,sha256=8aP27fjO-ImaYKVMnJqmdGorn3fLqDvLemG8Pz1dj_U,11079
nldcsc_elastic_rules/rules/linux/defense_evasion_journalctl_clear_logs.toml,sha256=lWeY6e3kYTCO_5Ee6bttLbKaTp1zfdnzza3V7O365VY,8574
nldcsc_elastic_rules/rules/linux/defense_evasion_kernel_module_removal.toml,sha256=FYTa8KrNWpMuZoHI7eYnpMQdHVwrnmjQ6iO6GEMBG24,9122
nldcsc_elastic_rules/rules/linux/defense_evasion_kill_command_executed.toml,sha256=qorY3xGI8-4LKt4przRDWWsdejHnpahReAhixIghr9k,9627
nldcsc_elastic_rules/rules/linux/defense_evasion_kthreadd_masquerading.toml,sha256=qS55YeCoZbDdJhh0kJn6kVmIzFWBvplKFz3OsAP4l4Y,8555
nldcsc_elastic_rules/rules/linux/defense_evasion_ld_preload_cmdline.toml,sha256=j5hcNStuMudK-odWkmbjQifinkyEtakCvUCMS8pUUy4,9950
nldcsc_elastic_rules/rules/linux/defense_evasion_ld_so_creation.toml,sha256=QSkonAHr7Uoif6sNmJdQBfMS4TMnu98tKfOguZ9UyvE,10445
nldcsc_elastic_rules/rules/linux/defense_evasion_linux_firewall_rule_creation_or_modification.toml,sha256=lwrbpTkccZH48aMXrG6-GCGXL9YYzrn_5CKn4J0Lcy0,8836
nldcsc_elastic_rules/rules/linux/defense_evasion_log_files_deleted.toml,sha256=ybIbPMWe6R4BZvATrdMe6NY3C5GCA2VMfvqJjcxkNmI,10206
nldcsc_elastic_rules/rules/linux/defense_evasion_lolbin_so_load.toml,sha256=ezFGKwNDiBR9IRG42Mldnk1sagyEmgSDm-Bzp46EH9Q,10384
nldcsc_elastic_rules/rules/linux/defense_evasion_mount_execution.toml,sha256=zmFbBvU1C2Gt_QVej0I8Vswn-ZDt3COZpsASJJdS4gk,8511
nldcsc_elastic_rules/rules/linux/defense_evasion_multi_base64_decoding_attempt.toml,sha256=NuG08LGsEJjaSQK8q9k90MiizwR_J5ywZehJoBpg9PE,10118
nldcsc_elastic_rules/rules/linux/defense_evasion_potential_proot_exploits.toml,sha256=8oE6o9LQyBD4NZtUMlLy1HyJ4cF1rzHEULg1lzUrNac,8456
nldcsc_elastic_rules/rules/linux/defense_evasion_prctl_process_name_tampering.toml,sha256=wXSsPfUHVyixVJpmPp9YG74W-gCX59nlLMDxe3Eevm8,7961
nldcsc_elastic_rules/rules/linux/defense_evasion_proxy_execution_via_systemd_run.toml,sha256=j0au6qF2nVg6xxSHcLvYl5RUpKRmGDYevur825760Cg,12202
nldcsc_elastic_rules/rules/linux/defense_evasion_rename_esxi_files.toml,sha256=-ylXxxphZJTLrDCG-XoWinlvXJAUfe8YZLaIjDFPdaQ,8671
nldcsc_elastic_rules/rules/linux/defense_evasion_root_certificate_installation.toml,sha256=olU8zMZnOl2b4anHkOyqkRwFU8dCMQ91oVXdM2D3K3M,9232
nldcsc_elastic_rules/rules/linux/defense_evasion_selinux_configuration_creation_or_renaming.toml,sha256=PoSgBcwHGpcV8ucPbmxsiWj2Qni0Pjq-ZJXMZGhuRbk,8454
nldcsc_elastic_rules/rules/linux/defense_evasion_shell_history_clearing_via_environment_variables.toml,sha256=1oJz_8XMfm5uzU0HlIPsawk6nQnMoltjGdOhmRM4-U0,9328
nldcsc_elastic_rules/rules/linux/defense_evasion_ssl_certificate_deletion.toml,sha256=yIoaO0ScK2R3dMQC1GVnI2B9vygmkkumF2JqoibhK1o,8170
nldcsc_elastic_rules/rules/linux/defense_evasion_sus_utility_executed_via_tmux_or_screen.toml,sha256=-72DnHgP6ERSZRSiQAketCnFxSIAtV6mFU2AP6i32yQ,6964
nldcsc_elastic_rules/rules/linux/defense_evasion_suspicious_path_mounted.toml,sha256=9GmZc0dVH6ypypmmiMBjjuQALqi_AKeAQlktpFXDiU0,7870
nldcsc_elastic_rules/rules/linux/defense_evasion_symlink_binary_to_writable_dir.toml,sha256=4A7ZdCbjwxBG_CO3jJpM3SZM3Dxf_s3DeqW6CQ4ee80,6812
nldcsc_elastic_rules/rules/linux/defense_evasion_sysctl_kernel_feature_activity.toml,sha256=fPoGfeJIDfWocdmoQFB1p6hSrGR7vuYaYROnpKYwYSs,8614
nldcsc_elastic_rules/rules/linux/defense_evasion_unsual_kill_signal.toml,sha256=vC41rVgQpCwZkGcBWDNaTGrRYdsl7P8qgVP5F2pREdU,7122
nldcsc_elastic_rules/rules/linux/defense_evasion_unusual_preload_env_vars.toml,sha256=6tfsciTXBjM1eh7C_BYaiXgN0lo7PqPaoA3Rw7TLsIw,9696
nldcsc_elastic_rules/rules/linux/defense_evasion_user_or_group_deletion.toml,sha256=sXdeMsCG1L_VIS1rDbF_sY1TStlr3YZ918sUDHFkpxU,7301
nldcsc_elastic_rules/rules/linux/defense_evasion_var_log_file_creation_by_unsual_process.toml,sha256=tw51fBTEUdUzD-663930_GgY842BjCEA4rep3TZ_MMM,9216
nldcsc_elastic_rules/rules/linux/discovery_curl_external_ip_discovery.toml,sha256=ZCuEgL3bm9ORKFq1KHNU65cuDHYQKnj9V1tNkj63sbM,10253
nldcsc_elastic_rules/rules/linux/discovery_dmidecode_system_discovery.toml,sha256=LRDnThTER4mWs_7cwqhUBULa5dPAU7dO8qVSW2eInuI,9643
nldcsc_elastic_rules/rules/linux/discovery_docker_socket_discovery.toml,sha256=O5CE3tbOJpLRoNY6-I_LxCgJjVK-J1AIouD7B9K-A7U,9105
nldcsc_elastic_rules/rules/linux/discovery_dynamic_linker_via_od.toml,sha256=ABlNc2CRyJIB9jChZJgdbHYwCyr27Xl844VJ8apdPmY,8671
nldcsc_elastic_rules/rules/linux/discovery_esxi_software_via_find.toml,sha256=IpD7Avoq_UU71dXE05b_expKq1FxBBG7G38HYIpRHZw,8149
nldcsc_elastic_rules/rules/linux/discovery_esxi_software_via_grep.toml,sha256=R6YQZ2N14eWcqPT0ByMndfLwTbaZS5gqnterkRExdww,8246
nldcsc_elastic_rules/rules/linux/discovery_kernel_instrumentation_discovery_via_kprobes_and_tracefs.toml,sha256=qLn32gpYl6csoJWGUoDqRtAvuhOttqy4dUWPjeNcJ1k,6699
nldcsc_elastic_rules/rules/linux/discovery_kernel_module_enumeration.toml,sha256=QfFaJCnqRaaC3gH0V4ez4lJ6a8Lmujj1a8tAwYH56QQ,8966
nldcsc_elastic_rules/rules/linux/discovery_kernel_seeking.toml,sha256=SPadnR2hBpuZbU0mBP1aGvh67aWuQm5QZ1TYh6jSljU,8730
nldcsc_elastic_rules/rules/linux/discovery_kernel_unpacking.toml,sha256=adUib2CnIRcx0VAR8MpWXsctPbDpCVsTkvQR4pUF9-o,8427
nldcsc_elastic_rules/rules/linux/discovery_kubeconfig_file_discovery.toml,sha256=cULs2F68gVLNi8EP45STSeT78H-HuV_lLol4YNkWpgc,9971
nldcsc_elastic_rules/rules/linux/discovery_linux_hping_activity.toml,sha256=noQPb1WDsvKWk_l6Uc-W56l82vT7pvRdk_ZsNZF8aNg,9670
nldcsc_elastic_rules/rules/linux/discovery_linux_nping_activity.toml,sha256=XF2Z-sISVRRjK0U-ozJtIL4we92_lUkf8QvLkbKlwXo,9686
nldcsc_elastic_rules/rules/linux/discovery_manual_mount_discovery_via_exports_or_fstab.toml,sha256=MEG6SEY0neXdj3cZUXWfchnU3ZwMioiUPhWCCfbvU4E,8204
nldcsc_elastic_rules/rules/linux/discovery_pam_version_discovery.toml,sha256=IPnfR9QASa1U3CLTUsKm9O8rqRbZdsMmdKlBJjq2rGc,9509
nldcsc_elastic_rules/rules/linux/discovery_passwordless_sudo_probing.toml,sha256=dcdh_d3xQgK_jQYN9vZQoUgUMpFOA7oWQvNTLh3m_bU,7939
nldcsc_elastic_rules/rules/linux/discovery_ping_sweep_detected.toml,sha256=FWKl8r2s7nw_59-nDBpBXufIlvARX3Ar5YAxVk8RGL4,8436
nldcsc_elastic_rules/rules/linux/discovery_polkit_version_discovery.toml,sha256=mO-BoNDsIOdePldb91qLugUEPduYQMI5g8QvX1jCMUw,8324
nldcsc_elastic_rules/rules/linux/discovery_port_scanning_activity_from_compromised_host.toml,sha256=FWP_3NEemfh4VEoIiJn2v_XOZ0o05U17DIS_EABb9b8,10114
nldcsc_elastic_rules/rules/linux/discovery_potential_kubeletctl_execution.toml,sha256=q6ubBuJcwYi0Pq5hqqyN5xFQBHUfmzXBpkg8w3Fgj9E,4486
nldcsc_elastic_rules/rules/linux/discovery_private_key_password_searching_activity.toml,sha256=mH66enBiRK5EF1G2D9pWnfu9L-b73ZA6gsG-x57TiWk,8619
nldcsc_elastic_rules/rules/linux/discovery_proc_maps_read.toml,sha256=-Z60d-s3Hk17ufjZ7tss6-CsmQ1wGx87IUivsqspX8Q,9317
nldcsc_elastic_rules/rules/linux/discovery_process_capabilities.toml,sha256=Pc9h9B6CPubIzB-R69GQl4bM5cx2fy2Qo6fL2DuBZRA,7416
nldcsc_elastic_rules/rules/linux/discovery_security_file_access_via_common_utility.toml,sha256=6MpcQ1pSw8qG9UWwhy59GscJpBMtiY5Jk0L7KsqsI44,9740
nldcsc_elastic_rules/rules/linux/discovery_subnet_scanning_activity_from_compromised_host.toml,sha256=ulMm01LjmeZaPpALceXml_fnPNkhOHlzagskfnvSTpE,9498
nldcsc_elastic_rules/rules/linux/discovery_sudo_allowed_command_enumeration.toml,sha256=PN44vRhxJOlcy0MD_07jbk5BEQt2s6MFolt8gvpml4Y,8199
nldcsc_elastic_rules/rules/linux/discovery_suid_sguid_enumeration.toml,sha256=wt5f6HZEfNOsxfKapC0gJxH_51ful5meaAb-VU7ysFA,8742
nldcsc_elastic_rules/rules/linux/discovery_suspicious_memory_grep_activity.toml,sha256=6ibJzpYXT6d7wn1FaALlAoituJQpJtWrD7gLYvjhYnc,6071
nldcsc_elastic_rules/rules/linux/discovery_suspicious_network_tool_launched_inside_container.toml,sha256=iAWvcE4aNC7WGHCwKYXWHfGfxJJksiX3kvjrViy-aJg,9185
nldcsc_elastic_rules/rules/linux/discovery_suspicious_proc_pid_syscall_read.toml,sha256=KyQBlacLCMYfmtJFQV3zmIOlvBen5igqz0wd2-deQLk,6144
nldcsc_elastic_rules/rules/linux/discovery_suspicious_which_command_execution.toml,sha256=tG0VVxCQcWfo1s7W5TM5wvjDbmeOOoNBQ4ngAsbUmf4,6122
nldcsc_elastic_rules/rules/linux/discovery_unusual_process_connection_to_container_runtime_socket.toml,sha256=wQRrAMwQaA3fdlA6UU6wRklxNffJVfKBlls-xSNq6H8,5389
nldcsc_elastic_rules/rules/linux/discovery_unusual_user_enumeration_via_id.toml,sha256=tb5GC8T8CxK7RlpsL4vmx8khbKc5RnwVGvpV8s0ul1E,8368
nldcsc_elastic_rules/rules/linux/discovery_virtual_machine_fingerprinting.toml,sha256=9ZXQQbJTD4cQeEpN_7P2iFRZM3-o5atd8VrFsjAFeOw,10711
nldcsc_elastic_rules/rules/linux/discovery_yum_dnf_plugin_detection.toml,sha256=FMoe-xHBMbD7MQje5N0mfMroDKgDKYFTq8AX1h6uqMI,8574
nldcsc_elastic_rules/rules/linux/execution_abnormal_process_id_file_created.toml,sha256=7Q2MizYRMXI8iQyCmn4_dmzrYuW9q_SnHkQdKD0pshM,9719
nldcsc_elastic_rules/rules/linux/execution_busybox_unusual_execution.toml,sha256=s6X_Z-MGijF25OzjLg4b4LsG2PSi11BcV_x6Kbjprvo,10060
nldcsc_elastic_rules/rules/linux/execution_container_management_binary_launched_inside_container.toml,sha256=ZR46aoVzLH2T326kT9ceQ0IWKJJU1h_rfS_SSqop8e4,8700
nldcsc_elastic_rules/rules/linux/execution_container_runtime_cli_suspicious_arguments.toml,sha256=9lY8tiZ_IKN_4oph5oZVlL4BSceBr3sySuDYKpXpScE,4590
nldcsc_elastic_rules/rules/linux/execution_cupsd_foomatic_rip_file_creation.toml,sha256=xNljnPRh0O4jQ07G7dW4G687nX4o250lS9w7WL8Jxqs,8278
nldcsc_elastic_rules/rules/linux/execution_cupsd_foomatic_rip_lp_user_execution.toml,sha256=BS7r6BZjnX2LiCO_Ygto1tEchOUeqkcf21-2cA2xM0k,8501
nldcsc_elastic_rules/rules/linux/execution_cupsd_foomatic_rip_shell_execution.toml,sha256=EhiLpiZdgGHw8eDHMOJdXb5Omhz3cnd_EIfmciDoa24,8308
nldcsc_elastic_rules/rules/linux/execution_cupsd_foomatic_rip_suspicious_child_execution.toml,sha256=9v9PbiL7Esz3D81Fy8vZPQ07DWLZs7kyblqf0q0v-_8,10309
nldcsc_elastic_rules/rules/linux/execution_egress_connection_from_entrypoint_in_container.toml,sha256=FVHs6HVvT7hx8nHM_vUWH3rlR9sYDtn0L1Zi52O2k3M,7548
nldcsc_elastic_rules/rules/linux/execution_executable_stack_execution.toml,sha256=zyvZg818ujyK3LGViVGGwcYKu866Cdn7qIdcTmx1-XA,7286
nldcsc_elastic_rules/rules/linux/execution_file_execution_followed_by_deletion.toml,sha256=aH6oIEDjsKdFpc-eLckTixtbZnMSBBI-KbeivScTrYc,9366
nldcsc_elastic_rules/rules/linux/execution_file_made_executable_via_chmod_inside_container.toml,sha256=zaDDUl6pTRYpqGxRYBMe6QP3ckfxLqfbFnwHxjEW1pM,9388
nldcsc_elastic_rules/rules/linux/execution_file_transfer_or_listener_established_via_netcat.toml,sha256=Ci4mGUj0UqhMPZUlbCq__xBNJjf1vAh2JaOHHyakpd4,10317
nldcsc_elastic_rules/rules/linux/execution_interpreter_tty_upgrade.toml,sha256=ZGuwM6_IFzE76qsQLhsEpprPHeMXhMUOOgSzjRwLoe8,8073
nldcsc_elastic_rules/rules/linux/execution_kubectl_apply_pod_from_url.toml,sha256=7YRUwg8gs_m2PTNYqmZy4E-ASWCs1WIntRcbDhAr5sU,8566
nldcsc_elastic_rules/rules/linux/execution_nc_listener_via_rlwrap.toml,sha256=JphR0zmC4QLQKMGCvaF5BLM3od1oaVwd2BKcUS_kMc0,8363
nldcsc_elastic_rules/rules/linux/execution_netcon_from_rwx_mem_region_binary.toml,sha256=Y7avAOesVTJREl6jJcFMa7R5t1n1DyXkX7s8cI_grcU,8746
nldcsc_elastic_rules/rules/linux/execution_network_event_post_compilation.toml,sha256=MAfh04-p_4f1SjVTOEZbV5ZdmKW0jtx1G4fZRqh2Hmw,9121
nldcsc_elastic_rules/rules/linux/execution_payload_downloaded_by_curl_wget_and_piped_to_interpreter.toml,sha256=DlHnQGSec76eB2mTqiAT099SR68F6bLDQLFV6ah5zvw,10217
nldcsc_elastic_rules/rules/linux/execution_payload_downloaded_by_interpreter_and_piped_to_interpreter.toml,sha256=45CNJQ5TIPnYRnXoxhgX8Koz4Xe6KcVl4iUUuQxzwzM,10822
nldcsc_elastic_rules/rules/linux/execution_perl_tty_shell.toml,sha256=zhmsj32MTid9nVQ3j2V4RjjU1RErDwFvRucyFPJtTcg,9531
nldcsc_elastic_rules/rules/linux/execution_potential_hack_tool_executed.toml,sha256=qLX-HfLVlG0hX0539Pc2RZKlIlfyW04n51e7XYGF9tQ,10897
nldcsc_elastic_rules/rules/linux/execution_potentially_overly_permissive_container_creation.toml,sha256=KFdVtNOz4g4hOC0bqVrs2Ckq-60k09XxL8PSfquNX50,8745
nldcsc_elastic_rules/rules/linux/execution_process_backgrounded_by_unusual_parent.toml,sha256=PSgMQ4joPuAUftRML-cIG5GF4xEi_nJ536wrJKqsgA8,9991
nldcsc_elastic_rules/rules/linux/execution_process_started_from_process_id_file.toml,sha256=HWNh21pynngSK5zRfKJXwxnZmv3FtrXCK8P9M6-wWRw,5850
nldcsc_elastic_rules/rules/linux/execution_process_started_in_shared_memory_directory.toml,sha256=DJhNAeElr8koBSFta5eL05KK2slz7iteXzV96XOFlNE,8856
nldcsc_elastic_rules/rules/linux/execution_python_tty_shell.toml,sha256=6YYzgm9UmTKJT9EbSaFdzNn7r8N2TZl7MqJpAoS7bA8,8533
nldcsc_elastic_rules/rules/linux/execution_python_webserver_spawned.toml,sha256=y4uIcIazWsrZ4-cX8h2Wh8kuVbIeDqAkStJIUJCFKU8,8367
nldcsc_elastic_rules/rules/linux/execution_remote_code_execution_via_postgresql.toml,sha256=d1Qisjlbw60aoJKwsoGmqn9MhRuhDkguzmyTuc9JkLc,8726
nldcsc_elastic_rules/rules/linux/execution_setsid_nohup_disown_direct_process_execution.toml,sha256=_4o1Kq-bme8VrJj_yemvrCiK_eYULKaZM80TASKBCTE,9300
nldcsc_elastic_rules/rules/linux/execution_shell_openssl_client_or_server.toml,sha256=5xDqgH0yaX745FEttuXCEOC8T6CHsvHkniYY4H0ZY24,9196
nldcsc_elastic_rules/rules/linux/execution_shell_via_background_process.toml,sha256=z7X-a9mUuY7bKSNLJPf1FbQt1gXWjCnLRLHrMMMrXbQ,8493
nldcsc_elastic_rules/rules/linux/execution_shell_via_child_tcp_utility_linux.toml,sha256=ZFaFcVA6n331fOpiZ-k81cVCcX6bUb38fWte02xuiAU,9337
nldcsc_elastic_rules/rules/linux/execution_shell_via_java_revshell_linux.toml,sha256=plXVSFnDNJMUoWok5O6ktvH3MEue2l-mANM3OPWswG0,9692
nldcsc_elastic_rules/rules/linux/execution_shell_via_lolbin_interpreter_linux.toml,sha256=kQ6IdsU7S922zMaf83RRUfachSVxNtkOHskDcncQJ0s,10266
nldcsc_elastic_rules/rules/linux/execution_shell_via_meterpreter_linux.toml,sha256=VC7PUphF8_6Ae10tfbYkO_6RBjvc72HBVmoLs_4Uvgs,10776
nldcsc_elastic_rules/rules/linux/execution_shell_via_suspicious_binary.toml,sha256=ITIQqhaSalzPOTHJw1J4Lha80yiEJ8u4sspH11gcJ60,9587
nldcsc_elastic_rules/rules/linux/execution_shell_via_tcp_cli_utility_linux.toml,sha256=zhAMuWjJg9WzDteohGHxSYv0MyGhcs2kFYolqVORL1o,8987
nldcsc_elastic_rules/rules/linux/execution_shell_via_udp_cli_utility_linux.toml,sha256=3LCpEAWBmc0hwASm4EiRsuYlQfGpElBCycJvXrBtLss,11282
nldcsc_elastic_rules/rules/linux/execution_sus_extraction_or_decrompression_via_funzip.toml,sha256=KD5F5i4iLdXjstQ0bvj4PB69go0jIwpvVqnQ4Y9fhb4,9019
nldcsc_elastic_rules/rules/linux/execution_suspicious_executable_running_system_commands.toml,sha256=v3pCMnipkvJy37YtQyY6aEAhr2exUp7fOS7-xav16S0,11039
nldcsc_elastic_rules/rules/linux/execution_suspicious_mining_process_creation_events.toml,sha256=MGXkYuk83D1SxJIWwtFf2hMxRX0TXoJHlrTXqHM4Gaw,8602
nldcsc_elastic_rules/rules/linux/execution_suspicious_mkfifo_execution.toml,sha256=dJQY5evW-5XcYTIwXtuB4IZLX20-PfLSVtCjjJ5xpws,8667
nldcsc_elastic_rules/rules/linux/execution_suspicious_pod_or_container_creation_command_execution.toml,sha256=3VRFdPDOa1n4yXMsAD3a4ZmWBKF9euYkf1pDP3_nUNw,10235
nldcsc_elastic_rules/rules/linux/execution_suspicious_xdg_open_command_execution.toml,sha256=4dhjzyt2s0wL4kbSr0ZialQi-hNfVLrvGqewfE-HbBk,8865
nldcsc_elastic_rules/rules/linux/execution_system_binary_file_permission_change.toml,sha256=cxbg3ZeAia9ArhFtK_I-qJqDyS_Wu0eldaBU-eTdYm8,9780
nldcsc_elastic_rules/rules/linux/execution_tc_bpf_filter.toml,sha256=BizCsSR82vsR91ohJ3OhO54ITjV51mPvOyOM2FoaOOo,8800
nldcsc_elastic_rules/rules/linux/execution_unix_socket_communication.toml,sha256=Nx0tEKvoVYQekIddWY8XF4-oinogVtPWwUHzNbm1s0A,6560
nldcsc_elastic_rules/rules/linux/execution_unknown_rwx_mem_region_binary_executed.toml,sha256=31svZWfxG_gnKk_bdW0w4Bylb_3WnCInuZZxQlNgfPg,7954
nldcsc_elastic_rules/rules/linux/execution_unusual_interactive_process_inside_container.toml,sha256=tnPvhQiuYYv9WfTwl37yNoepk4uNijvy0u7sYV8DrPE,4261
nldcsc_elastic_rules/rules/linux/execution_unusual_kthreadd_execution.toml,sha256=THQXbtVSo8LqS7BrnPw3eSh9Pa0iAfoPrY6YaIs6DfI,9939
nldcsc_elastic_rules/rules/linux/execution_unusual_path_invocation_from_command_line.toml,sha256=rAn3LSqR97tI2hs1_IUVAy-F28IgXZnbOfE6q8rLTcY,9476
nldcsc_elastic_rules/rules/linux/execution_unusual_pkexec_execution.toml,sha256=sBFr2XcmFGhWzc_zYEgT2m8-8bsOYAQbv-qjlfJ7kZs,10840
nldcsc_elastic_rules/rules/linux/exfiltration_potential_data_splitting_for_exfiltration.toml,sha256=cGbPY5OpYtlyrjE08HLdgicx82438CP39TIX8uqSrYk,8468
nldcsc_elastic_rules/rules/linux/exfiltration_potential_database_dumping.toml,sha256=oh29y6rp5pwD29ItQAkZK8Qxp8VhSy6bRzVWxuJemh4,8570
nldcsc_elastic_rules/rules/linux/exfiltration_potential_wget_data_exfiltration.toml,sha256=wLJV-k86V0bCwhSg8mfY9wiBOM9FjyMc4WvHjy90aqI,8757
nldcsc_elastic_rules/rules/linux/exfiltration_unusual_file_transfer_utility_launched.toml,sha256=eO-euSNmHH8i8Jns8DYsAn6uqjLZv-R1BPiMYqkBbBE,10525
nldcsc_elastic_rules/rules/linux/impact_data_encrypted_via_openssl.toml,sha256=tB18IDzSXkg_p38GV5bCSVZYHiTcsb_zlBPxYjKMiAA,8608
nldcsc_elastic_rules/rules/linux/impact_esxi_process_kill.toml,sha256=IRMDe88ENI9NQhwbAxm2HnbFeFkgwpFZ7QuF9v8VI9I,7786
nldcsc_elastic_rules/rules/linux/impact_memory_swap_modification.toml,sha256=Mmrluyla2_6zZuprIVHstNuDoAKRwvX2pFNECUHn-pk,8829
nldcsc_elastic_rules/rules/linux/impact_potential_bruteforce_malware_infection.toml,sha256=TW9fDn0wiW1JSt9s4CFxXpGf6kzyPHuUs5qXtkjikt8,11181
nldcsc_elastic_rules/rules/linux/impact_potential_linux_ransomware_note_detected.toml,sha256=2UQgM_46BAAEGpUV0xmpXwRoEIWxS7pyYOQXfPUv7g0,9140
nldcsc_elastic_rules/rules/linux/impact_process_kill_threshold.toml,sha256=fA1HK6WeEAPRUTV8oH80jasS0mvJvcKK-Andjj5mH20,6478
nldcsc_elastic_rules/rules/linux/initial_access_apache_struts_cve_2023_50164_exploitation_to_webshell.toml,sha256=C6QsqP27slFqDgO-hb7Af8HiH-_1tVoyDovVgKqaEFI,9991
nldcsc_elastic_rules/rules/linux/initial_access_first_time_public_key_authentication.toml,sha256=YjxdWngeZmySWnuaklREYu-M3Rq1D5va6VmhLTIHHaU,8242
nldcsc_elastic_rules/rules/linux/initial_access_successful_ssh_authentication_by_unusual_ip.toml,sha256=6CCD_UOlX5X-y4lF3v0JlE5SXDZmjZF4194i7tnViHo,7495
nldcsc_elastic_rules/rules/linux/initial_access_successful_ssh_authentication_by_unusual_user.toml,sha256=w9bquynuFkQTOngdDvdDDoFTQA6bm3udMGr7_VwRDnA,5775
nldcsc_elastic_rules/rules/linux/initial_access_telnet_auth_bypass_envar_auditd.toml,sha256=J6bjshM8AIgoaApbbza8uqT5LvtJy5mzpO8IPdf0gBA,5715
nldcsc_elastic_rules/rules/linux/initial_access_telnet_auth_bypass_via_user_envar.toml,sha256=pND2E-VvAatahd_jAvMQJ1qDotUZ0aDJZj0gfASG__0,5775
nldcsc_elastic_rules/rules/linux/lateral_movement_direct_kubelet_access_via_process_args.toml,sha256=va09LjgDq74iT7bHXcuFludWqXL4tnHC95Hqf04kONs,5539
nldcsc_elastic_rules/rules/linux/lateral_movement_kubeconfig_file_activity.toml,sha256=zPMc929PQwNN2qWHxoDwzqJTVUWYAykeh_Ln4C0r-z8,9800
nldcsc_elastic_rules/rules/linux/lateral_movement_kubelet_api_connection_attempt_internal_ip.toml,sha256=urNugT3bjIGpeC5El0ucmgQepBViaqJczQhUKycRkJg,5921
nldcsc_elastic_rules/rules/linux/lateral_movement_remote_file_creation_world_writeable_dir.toml,sha256=8oMnT0exGhmHoclMyP31XpFXchx3JS5LOieI1F_aqJk,9902
nldcsc_elastic_rules/rules/linux/lateral_movement_ssh_it_worm_download.toml,sha256=fkyPiA_kn3-nB74SvHBsV87KgyX0MHYDgje6h6cvQ7Q,9187
nldcsc_elastic_rules/rules/linux/lateral_movement_telnet_network_activity_external.toml,sha256=SvxMxcL2udhNIPS-lWGYkEulwR8SbYqK-GehM2_E2f8,10134
nldcsc_elastic_rules/rules/linux/lateral_movement_telnet_network_activity_internal.toml,sha256=t86cw1fkBdmG4VG6NDtpIAJa8kbTJs5tIKfcz712t50,9820
nldcsc_elastic_rules/rules/linux/lateral_movement_unusual_remote_file_creation.toml,sha256=1CgggiQiLvSm3FnMcBQubgX_bDiE8n7xHSR3U6VyP58,10307
nldcsc_elastic_rules/rules/linux/persistence_apt_package_manager_execution.toml,sha256=KLtWdfIMjsH3jMK9ip2fEnJb-G6iAnK87NTBidU1xkc,11856
nldcsc_elastic_rules/rules/linux/persistence_apt_package_manager_file_creation.toml,sha256=-k9zcfxAr6wvUP7jDx_n0kVMqcEn71lZn3LM-fwAG8w,11455
nldcsc_elastic_rules/rules/linux/persistence_apt_package_manager_netcon.toml,sha256=4ArJACD9gPzaTMrdDDsvp71ixRxCmcxtpz6outARZoE,10376
nldcsc_elastic_rules/rules/linux/persistence_at_job_creation.toml,sha256=UhtuLvJ6hJLALLm0rIORBQ5n5rNgfOC6uy6Ce5aNFKM,10078
nldcsc_elastic_rules/rules/linux/persistence_binfmt_configuration_file_creation.toml,sha256=xjXlQ_W7EF9hkJyiBqToa9oBFTHmXjWrhwONAvfhrrA,7582
nldcsc_elastic_rules/rules/linux/persistence_boot_file_copy.toml,sha256=N3QzTd2IhdHFtEli-2hqEUwN5dFFPqBs5CWUEr12XOo,10680
nldcsc_elastic_rules/rules/linux/persistence_bpf_probe_write_user.toml,sha256=iXIUJnvsZo2aDP721IvhGWUk2lkd2u5IG6Jjl_gfqO4,7556
nldcsc_elastic_rules/rules/linux/persistence_bpf_program_or_map_load.toml,sha256=n-YYoANN4FgBzv_vz0Hiat5EHPY3P8_VjYLj2TM-eH0,7517
nldcsc_elastic_rules/rules/linux/persistence_chkconfig_service_add.toml,sha256=6xu7RRAL2NZ2werYjoXsvvcWi7nETpp7H6_LsaBtRqQ,12501
nldcsc_elastic_rules/rules/linux/persistence_credential_access_modify_ssh_binaries.toml,sha256=QRYHId-K8iYg6_J5ZHXo96th0kgyBBRkzhFzfy-3Oq0,12976
nldcsc_elastic_rules/rules/linux/persistence_cron_job_creation.toml,sha256=bbLfu3BpWG_Gl7Z5HJlM-z0xnhbSzHJMf5e9KCAZ53A,14720
nldcsc_elastic_rules/rules/linux/persistence_dbus_service_creation.toml,sha256=uwN26Z3G0i5z8GpsVFYXaJTf59XWWlE5SU-cOsDAn64,10745
nldcsc_elastic_rules/rules/linux/persistence_dbus_unsual_daemon_parent_execution.toml,sha256=ayn8W7yHEBkyosfAsJi87d-PfWJuQqC5xmBUx8DanW4,9807
nldcsc_elastic_rules/rules/linux/persistence_dnf_package_manager_plugin_file_creation.toml,sha256=1ZwuC6AgPf9wg4dmT8JLG_YrDtFDdOiT7Wte5ajT3Gs,11022
nldcsc_elastic_rules/rules/linux/persistence_dpkg_package_installation_from_unusual_parent.toml,sha256=sJ1NDtgaaOWZ_MkakC2lSTkr__lIbVxuHAC_Q8dWXAU,9083
nldcsc_elastic_rules/rules/linux/persistence_dpkg_unusual_execution.toml,sha256=aFCtq5w8LkSj6biAcB77UdT3thqSq4TbiDWLGvkET2U,9371
nldcsc_elastic_rules/rules/linux/persistence_dracut_module_creation.toml,sha256=Dm3ZwYv0dwfgluX0QVE-PMliGx4NqH4W2_NwZhQXPbo,10846
nldcsc_elastic_rules/rules/linux/persistence_dynamic_linker_backup.toml,sha256=OzVPmHa5Y9F5uPzUNJ8SApib3V8TTqvdHeTjcYcfayc,12416
nldcsc_elastic_rules/rules/linux/persistence_extract_initramfs_via_cpio.toml,sha256=dJEptsEM0-Wjlu2zT_jk-We_HPWlfZ8KW74PVRXJYKc,8667
nldcsc_elastic_rules/rules/linux/persistence_git_hook_execution.toml,sha256=vYxvpiHwf0boEcKJK9lZUFmaBD11ZylSEp8iI8Hbyfo,8961
nldcsc_elastic_rules/rules/linux/persistence_git_hook_file_creation.toml,sha256=XadvTr-hxvUEYg_XWXHC44kqnRwBINUEsuByeTOeCYA,10091
nldcsc_elastic_rules/rules/linux/persistence_git_hook_netcon.toml,sha256=PZKvsNj6Xc-YCfwgq53JMddNPl4KwO8B8SxquoBtCdI,10166
nldcsc_elastic_rules/rules/linux/persistence_git_hook_process_execution.toml,sha256=T38R99Q3EIa0wJHrKNntE2zc2ma-heFpa1xupMm-3Rw,9706
nldcsc_elastic_rules/rules/linux/persistence_grub_configuration_creation.toml,sha256=-8s0Y-u4ujMYhzqZ2uyLZyQFbPFQcJIPUzYKPR1Ujvw,10413
nldcsc_elastic_rules/rules/linux/persistence_grub_makeconfig.toml,sha256=910550zdASN3brjjYxcSK5zSMONVzxSk1i3HuuUdQXg,9185
nldcsc_elastic_rules/rules/linux/persistence_init_d_file_creation.toml,sha256=4T9R4l19iUyWk83BCOZzO-QKpHGYNTFsdbDQnjoLwJ0,13481
nldcsc_elastic_rules/rules/linux/persistence_insmod_kernel_module_load.toml,sha256=_K1j68oCLtdOYgCzTs1Uf1KPLTs2S1FFHdnoFGVtu0U,12999
nldcsc_elastic_rules/rules/linux/persistence_kde_autostart_modification.toml,sha256=NYZTeEKf9Hlk-zeePpAErGbTCIJcJnacud5W08B44U8,16976
nldcsc_elastic_rules/rules/linux/persistence_kernel_driver_load.toml,sha256=Te-WD_-OIMiNBcdKCnGc7TVC86El06DLT8LJMaTBUO8,8258
nldcsc_elastic_rules/rules/linux/persistence_kernel_driver_load_by_non_root.toml,sha256=ur6MgD51uTbXG-BeanBc3PiIRynXczzfMMWPx5qyEKk,8540
nldcsc_elastic_rules/rules/linux/persistence_kernel_module_load_from_unusual_location.toml,sha256=k7PMoio2_FsKXAK3re9gopYTOyLhnL0Ln64YwIBX2UQ,9738
nldcsc_elastic_rules/rules/linux/persistence_kernel_object_file_creation.toml,sha256=MnHtze-kXXhrB8j65R56rs3G5k0CLec6KaaFDO3mATw,9150
nldcsc_elastic_rules/rules/linux/persistence_kubernetes_sensitive_file_activity.toml,sha256=CuBT7uvqHq1c_U_yncGWsvfqxFC2a-bEvGSmooGveFE,9547
nldcsc_elastic_rules/rules/linux/persistence_kubernetes_static_pod_manifest_path_process_execution.toml,sha256=v6zavFGzbBOtuZHH5WTpnB8Cy0IuDU5g6LFUsHlMn5o,4966
nldcsc_elastic_rules/rules/linux/persistence_kworker_file_creation.toml,sha256=f2FizNJvZga_Fg8ImGWr_xd8C0hN0Ce-7hHQhWEq9pg,11593
nldcsc_elastic_rules/rules/linux/persistence_linux_backdoor_user_creation.toml,sha256=hiyYnT-q6s8epS_ejrj0BfyPYG7e8qF_cgplXc9r-WI,8876
nldcsc_elastic_rules/rules/linux/persistence_linux_group_creation.toml,sha256=Hpyf374-nwvBBnr-CdMnuJUkSrG_2GbrIAof7CP0YWQ,7565
nldcsc_elastic_rules/rules/linux/persistence_linux_user_account_creation.toml,sha256=lWoACRcAVrwCwWS9HcX6Pp1sPX71xAtzcwkd6x8X5-Q,7153
nldcsc_elastic_rules/rules/linux/persistence_linux_user_added_to_privileged_group.toml,sha256=rE4MGOpTl0pWEdt607CzqSVjlCIO45e6lOmVWQXV8hk,9445
nldcsc_elastic_rules/rules/linux/persistence_lkm_configuration_file_creation.toml,sha256=GBTf3wYGR91l3R5eTTNpQR9tWroMO4SbC775vfax_Wc,8398
nldcsc_elastic_rules/rules/linux/persistence_manual_dracut_execution.toml,sha256=dErjtZ0QbP0AT8yWkdjMdmZODE-sIvRoxx5D_yfYIZs,8745
nldcsc_elastic_rules/rules/linux/persistence_message_of_the_day_creation.toml,sha256=A1URLyRgXDsxEj9M--5AVFcevmQCDBr72GDThpbeR3I,11154
nldcsc_elastic_rules/rules/linux/persistence_message_of_the_day_execution.toml,sha256=1fXzYWB-Bmo0bFoiwDlx93qOhYtzS1ycPDWtrzGZ8rc,12280
nldcsc_elastic_rules/rules/linux/persistence_network_manager_dispatcher_persistence.toml,sha256=LZxfi4mxTOl6ugnPxbt4drkJdszxy6CrDrvBdhU3UJY,10685
nldcsc_elastic_rules/rules/linux/persistence_openssl_passwd_hash_generation.toml,sha256=B-DV6zCOk1BFWqMYwaZv3SS8nsmY_aID72C88y5kfcU,8557
nldcsc_elastic_rules/rules/linux/persistence_pluggable_authentication_module_creation.toml,sha256=YKS8tU-ls8DYNaNPYVij765gztxQYeTTKT5yk2USzek,9511
nldcsc_elastic_rules/rules/linux/persistence_pluggable_authentication_module_creation_in_unusual_dir.toml,sha256=vx4QHM52_nY0FiTJpPqVkxMvsP3Aj_0S8zfSCKwCo9o,7889
nldcsc_elastic_rules/rules/linux/persistence_pluggable_authentication_module_pam_exec_backdoor_exec.toml,sha256=o_ZylH_nvjFYA4eXLekeD1xmiB1ISoaW8yI3upJzFMk,8477
nldcsc_elastic_rules/rules/linux/persistence_pluggable_authentication_module_source_download.toml,sha256=h38mV5z5u1c0Lq95EGpF_ksRXGgZiJEQwarQx6Nb-uA,6768
nldcsc_elastic_rules/rules/linux/persistence_polkit_policy_creation.toml,sha256=VG_XdIJY9rP7_atVwfgknbjzCmNz6hQR_fqxQS-q-rY,8788
nldcsc_elastic_rules/rules/linux/persistence_potential_persistence_script_executable_bit_set.toml,sha256=y0CCBiGXOhpZAhNFFQgfCylrcvXRonOgF5OqCA8OnFQ,10582
nldcsc_elastic_rules/rules/linux/persistence_process_capability_set_via_setcap.toml,sha256=6z8vUHNiMX6LcM1cFZfZFA8xiNSf2VRgcZUOPXDY91E,8534
nldcsc_elastic_rules/rules/linux/persistence_pth_file_creation.toml,sha256=CZqkWI5XVymJmvzPv97bTg5RbxvZHvmBHMNeKyQRkxY,10089
nldcsc_elastic_rules/rules/linux/persistence_rc_local_error_via_syslog.toml,sha256=7HTUz0cT5JdCPBOioV2YbIMCmTHd18zl6JQo_Kr8W0A,8182
nldcsc_elastic_rules/rules/linux/persistence_rc_local_service_already_running.toml,sha256=WuBtb_Opp0xNPAnu_Va3LUIrJ7BmIZiJHB-9Goz3An0,8960
nldcsc_elastic_rules/rules/linux/persistence_rc_script_creation.toml,sha256=x3No5yP83cwMIbKrnS9JhO-k3jrUGyJgwhtEaL2M2ug,12333
nldcsc_elastic_rules/rules/linux/persistence_rpm_package_installation_from_unusual_parent.toml,sha256=i_dRYGdE68UxHTExTDBtnaxEGleNGhoK3qUVAEG_OSY,8492
nldcsc_elastic_rules/rules/linux/persistence_setuid_setgid_capability_set.toml,sha256=xcOgUehilokybn1baziy3ERH2cz-a_HN9mXPFc6cCtU,10636
nldcsc_elastic_rules/rules/linux/persistence_shadow_file_modification.toml,sha256=-eamLKbnMMeACcxn3Fon4B-6vljbjZ86v31ZTn5dlGo,8354
nldcsc_elastic_rules/rules/linux/persistence_shared_object_creation.toml,sha256=i04h9dW6wlFzIl2JKWoPb2j-ETjhMfpKJu5R77W242A,13720
nldcsc_elastic_rules/rules/linux/persistence_shell_configuration_modification.toml,sha256=ND28qEL30OkCdkItJKRqf72E3Axu2UdwBO2gK1gMqFY,11291
nldcsc_elastic_rules/rules/linux/persistence_simple_web_server_connection_accepted.toml,sha256=Ln5hzF175hshsk7AUlUSpLLWNNcfl5u5lT2HxrJMH6A,9327
nldcsc_elastic_rules/rules/linux/persistence_simple_web_server_creation.toml,sha256=l6fKkynsc4PxwMZ6FM0QnawDWSOY2BcbUjGWOEFJkEE,9590
nldcsc_elastic_rules/rules/linux/persistence_site_and_user_customize_file_creation.toml,sha256=FnA788UzhnreOUKl55hHKdV3EYG5HxefB1bvZKN_S2g,9924
nldcsc_elastic_rules/rules/linux/persistence_ssh_key_generation.toml,sha256=-EKkIo8E5xEmFXicgBNxCe0atudI93y4qOf25VJ6fX0,6711
nldcsc_elastic_rules/rules/linux/persistence_ssh_netcon.toml,sha256=oA8rPxIM0NiHw6mZOzEllKj1yx0hAjcnnNNq4KlBur4,8487
nldcsc_elastic_rules/rules/linux/persistence_ssh_via_backdoored_system_user.toml,sha256=JwwlzL5944Vws08wdPefVPtUtiLoKG9ARYj0CLFMap0,9101
nldcsc_elastic_rules/rules/linux/persistence_suspicious_file_opened_through_editor.toml,sha256=cIGyCsejg4OvI-dzfmgI-mDzaOl_4Tr1eRIsy5HdPck,9126
nldcsc_elastic_rules/rules/linux/persistence_suspicious_ssh_execution_xzbackdoor.toml,sha256=GkFMXpP_Fxm6awHleM0WcNX2zIkplHduNOScS8UPLN4,8263
nldcsc_elastic_rules/rules/linux/persistence_systemd_generator_creation.toml,sha256=fTzfgs_q2RnCS8ZP23n_zH7fqdGWlNr-x5hOhuPm1K8,10714
nldcsc_elastic_rules/rules/linux/persistence_systemd_netcon.toml,sha256=SRAfyLh9hOj8yj5UGb6DhInusnDhlLbx-W8JlwrRcNs,10777
nldcsc_elastic_rules/rules/linux/persistence_systemd_override_conf_creation.toml,sha256=sShg6Y2HvoLSMnjkWfuiY3Gpg9YOkAw_zPSuRx1OCSc,10181
nldcsc_elastic_rules/rules/linux/persistence_systemd_scheduled_timer_created.toml,sha256=VrFA7j0T8Ckzt8Stbw9tIzBfFucvd-lKzKl2xL6Edq4,13540
nldcsc_elastic_rules/rules/linux/persistence_systemd_service_creation.toml,sha256=om-eJyhch4cxwwn-Sqqo38OOgJXxPV7NGZkotj-S49o,15871
nldcsc_elastic_rules/rules/linux/persistence_systemd_service_started.toml,sha256=DWuv-WbbMXvbgK52uw-GoqY0B4OOqp-zOfeY9Dma9p0,13893
nldcsc_elastic_rules/rules/linux/persistence_systemd_shell_execution.toml,sha256=aH44y1iteMjlINAOh3PKSWq_Yh9WIh3tPlHGLsuSX8s,8444
nldcsc_elastic_rules/rules/linux/persistence_tainted_kernel_module_load.toml,sha256=WF78bI5iP7PtgytEqI1u6-_rKcWtU4aq5GMnNw1Mtts,8343
nldcsc_elastic_rules/rules/linux/persistence_tainted_kernel_module_loaded.toml,sha256=CSbV2k9Bupyg85jzWY02cUndrCj6obIdjwtkvSH9Bsk,8638
nldcsc_elastic_rules/rules/linux/persistence_tainted_kernel_module_out_of_tree_load.toml,sha256=34d5tuZ-QcMoMmMDoxD7L_m80DOGnDDeqLYzcfAceUg,8305
nldcsc_elastic_rules/rules/linux/persistence_udev_rule_creation.toml,sha256=pmxh0GBitx0e6aYto46LZBGtL9wfJw_48FegjlBPTfI,10180
nldcsc_elastic_rules/rules/linux/persistence_unpack_initramfs_via_unmkinitramfs.toml,sha256=ELpxYmxxQL2tNrDlWLM7TlBQxS5-UuwWHXwfT-lqt1M,9040
nldcsc_elastic_rules/rules/linux/persistence_unusual_exim4_child_process.toml,sha256=2Biv4TEg_o_4z4aXJrSwbPodkEwJGxsIlpdfvX8TZNk,6689
nldcsc_elastic_rules/rules/linux/persistence_unusual_pam_grantor.toml,sha256=pZDLLmIuz9Oqnmz370VmDwB9jJevjzuppkpPQnpAv8g,7467
nldcsc_elastic_rules/rules/linux/persistence_unusual_sshd_child_process.toml,sha256=Gg6ramM_PDJLI19CateuvGAuALHkNgswb8GJyZtPurM,7198
nldcsc_elastic_rules/rules/linux/persistence_user_credential_modification_via_echo.toml,sha256=qxMnN8CrY_gk9z0Ett1vXeNv1EVbtFFkMFYOnxQ0EdE,7730
nldcsc_elastic_rules/rules/linux/persistence_user_or_group_creation_or_modification.toml,sha256=pefm7TFka3NPDFIMRxVYkUcc1FSMJeRghJ-ObP4y7io,8813
nldcsc_elastic_rules/rules/linux/persistence_webserver_file_double_dangerous_extension.toml,sha256=t-qnK7ZAD_oUWbKoNezzZD96WszHEZJmpRdBjni_S9E,9382
nldcsc_elastic_rules/rules/linux/persistence_webserver_file_high_entropy.toml,sha256=V_3ZgJGH4qJj_oMGXC88sDU4V0nf7R6vo_gvpo_QITI,9970
nldcsc_elastic_rules/rules/linux/persistence_webserver_file_polyglot_bypass.toml,sha256=MEVEiO8mziP_9V5eeALZ-HGrVYVq81GLVZx3HSN9n8Y,10394
nldcsc_elastic_rules/rules/linux/persistence_webserver_php_file_creation_in_wordpress_plugin_dir.toml,sha256=xYm4qbrR_38oKBaLRpScZiv-esvY8SSpjxNAfF4dB5E,9042
nldcsc_elastic_rules/rules/linux/persistence_webserver_suspicious_child_execution.toml,sha256=OAgH-xuFCSF_zoYDE59ULrGJhwLFXSq5-7q2F9TL014,14501
nldcsc_elastic_rules/rules/linux/persistence_webserver_suspicious_command_execution.toml,sha256=bPywxFhb2hGDisck6N-tfLfqIG9YEM8QJBBma8wWOQk,19170
nldcsc_elastic_rules/rules/linux/persistence_webserver_unusual_child_execution.toml,sha256=T_UoJ-nN22qksoEsjPghga1CfYq8yKV6gNnoKhj1Gos,10561
nldcsc_elastic_rules/rules/linux/persistence_webserver_unusual_command_execution.toml,sha256=8D1Gne-q44C4NFCbyNlC6zfc1mlUKDGnELGEMrD-Pqc,9632
nldcsc_elastic_rules/rules/linux/persistence_webserver_unusual_file_creation.toml,sha256=agQCZl3Bvg0uvIWRJF1cqrK2VOFcAt-By-zfkYHIcVY,10446
nldcsc_elastic_rules/rules/linux/persistence_xdg_autostart_netcon.toml,sha256=j1SsH7wV7EBVArwBAYQ7X0Nd47gLo6Xal6lAsRa0RuI,11573
nldcsc_elastic_rules/rules/linux/persistence_yum_package_manager_plugin_file_creation.toml,sha256=x1OdCP6KZkEbpRwHOCWJnv_YQeZnlGJKwPpoU6tSJa0,10133
nldcsc_elastic_rules/rules/linux/privilege_escalation_auditd_euid_root_shell_from_non_standard_path.toml,sha256=0raYamTaiIsfFMGS-HTwuGC_GHZCf7RafaunCNndQms,4727
nldcsc_elastic_rules/rules/linux/privilege_escalation_auditd_nsenter_target_host_pid.toml,sha256=Lksc7lV4nBS1T0xTWixPXxilPzzohEJGSaAdsfaortE,3232
nldcsc_elastic_rules/rules/linux/privilege_escalation_chown_chmod_unauthorized_file_read.toml,sha256=-M5QJnh2r5ZyBo7NTW1XA-WL1zZdfjLqZZjwgnIs-hQ,9416
nldcsc_elastic_rules/rules/linux/privilege_escalation_chroot_execution_container_context.toml,sha256=fp03MtuNOzXaMQZwCeerMcg4Zn8l-B5T1nRTLGpA59k,7437
nldcsc_elastic_rules/rules/linux/privilege_escalation_container_escape_via_kernel_core_pattern.toml,sha256=_iOYmepWvwhUfGc4NumX6KJk3D3k2rN6B4mvrhjIiUg,9930
nldcsc_elastic_rules/rules/linux/privilege_escalation_container_runc_init_effective_root_auditd.toml,sha256=w2CI6VIWU9DEeQHynC9uO_hBmrtAJWF_523MBF8n_yI,3972
nldcsc_elastic_rules/rules/linux/privilege_escalation_container_util_misconfiguration.toml,sha256=GQ7u3ojm9eIxdZa9J1T17tAwtRA6FzyeyJOndR-A57g,9746
nldcsc_elastic_rules/rules/linux/privilege_escalation_cve_2025_32463_nsswitch_file_creation.toml,sha256=NUyutlw4lpNv4i5pcAZiYYmseQJO00Ue2YGbMq1Oiuk,8743
nldcsc_elastic_rules/rules/linux/privilege_escalation_cve_2025_32463_sudo_chroot_execution.toml,sha256=2tLNkdxTVD0SutnuMsahjydozF3EwxccAd6yLAglqMU,9083
nldcsc_elastic_rules/rules/linux/privilege_escalation_dac_permissions.toml,sha256=GW-YQ9aC-_mF3A1PeEyYRuT_rkGVNfshC4p3D5Zhf7I,9722
nldcsc_elastic_rules/rules/linux/privilege_escalation_debugfs_launched_inside_container.toml,sha256=jQnrKSmY8AMRLbaSxc3LnLq0Wix1X-Y6ZgDpcyR8qIw,8397
nldcsc_elastic_rules/rules/linux/privilege_escalation_docker_escape_via_nsenter.toml,sha256=8nDp8ItmCpxxnDpYmcBEDtdBWGX1N5vJdSSO824zQec,6167
nldcsc_elastic_rules/rules/linux/privilege_escalation_docker_mount_chroot_container_escape.toml,sha256=zuE7ZkOSa4WfShHuFc24Kc_rFCuXfKxM2g8nKV7eJ0M,9525
nldcsc_elastic_rules/rules/linux/privilege_escalation_docker_release_file_creation.toml,sha256=SF0Ubvap7dpfzmJ4zST-bfXGyBTLh6A2rdPRTr_X5Dg,6287
nldcsc_elastic_rules/rules/linux/privilege_escalation_enlightenment_window_manager.toml,sha256=UHRbaUg6aEEKW4P6yw4vOOGQvasef-JeooWEzxbWK2k,8302
nldcsc_elastic_rules/rules/linux/privilege_escalation_gdb_sys_ptrace_elevation.toml,sha256=aFs2TUHRALaPdOEn6I1Oo4sIP0oEvLmJHOmQKd7ZDw0,8438
nldcsc_elastic_rules/rules/linux/privilege_escalation_gdb_sys_ptrace_netcon.toml,sha256=4tUtDlQFcJvUb8dKnaSwvCkv3C9w1faZjNsAFwJiQ74,9639
nldcsc_elastic_rules/rules/linux/privilege_escalation_kworker_uid_elevation.toml,sha256=aH3oPrrN-bVbTMOi57HeZAZRJ-vKFcOKRAlt9DASYC0,8247
nldcsc_elastic_rules/rules/linux/privilege_escalation_ld_preload_shared_object_modif.toml,sha256=eBCCjrCJZbFcixzhHkpvqawI1Z4qPYcIA-bW02zBndY,10422
nldcsc_elastic_rules/rules/linux/privilege_escalation_linux_suspicious_symbolic_link.toml,sha256=CnirlUr6X7MH5WEhkbNVxcYRt9P9n2L0btoaVv126D0,10253
nldcsc_elastic_rules/rules/linux/privilege_escalation_load_and_unload_of_kernel_via_kexec.toml,sha256=_fiNpR-sR1HsQxb2lVFQ8V7_HNRRYSbVRtg2uKkDSKs,9647
nldcsc_elastic_rules/rules/linux/privilege_escalation_looney_tunables_cve_2023_4911.toml,sha256=MROmf4G4YyNZ5q7BSfpK4aBKyVKafHRDm5ItMgoebPM,9083
nldcsc_elastic_rules/rules/linux/privilege_escalation_mount_launched_inside_container.toml,sha256=4RZHFTnVjtSQ7bHjkHLTB_unvPn3t3MJyMjAH8gn89Y,8586
nldcsc_elastic_rules/rules/linux/privilege_escalation_overlayfs_local_privesc.toml,sha256=2tglPfoN75dcnJdmOFaxHbH-jsfobDwcsJ-YqHEedWc,6519
nldcsc_elastic_rules/rules/linux/privilege_escalation_pkexec_envar_hijack.toml,sha256=95GmhKcdAAStlUN0DbD3NWUVJEKe3qsa8YHQgZTyY3M,8785
nldcsc_elastic_rules/rules/linux/privilege_escalation_potential_bufferoverflow_attack.toml,sha256=U72kunZ1d8UROxX0QmNuC3mE9fXlO3X6pIR31f8CDMw,6572
nldcsc_elastic_rules/rules/linux/privilege_escalation_potential_copy_fail_cve_2026_31431_exploitation_via_af_alg_socket.toml,sha256=UmRF13imKYpy2znF8awsJSukib36Pmst8A6A8YWjji0,10595
nldcsc_elastic_rules/rules/linux/privilege_escalation_potential_privesc_via_general_sequence_child.toml,sha256=fd8wbGwBizAoTXCw163vsAgIg9FNe7yVmQ-yeicLlB4,6711
nldcsc_elastic_rules/rules/linux/privilege_escalation_potential_privesc_via_general_sequence_parent.toml,sha256=QHTtBd8IcQOsNhQGkd5v4f4AetALY5eI0NgGIwSu_iQ,6929
nldcsc_elastic_rules/rules/linux/privilege_escalation_potential_privesc_via_general_sequence_parent_child.toml,sha256=QwuE__pWmxMKQ1ljgEjEJPa1QEojh9-8sUOIyXZuiwk,6930
nldcsc_elastic_rules/rules/linux/privilege_escalation_potential_privesc_via_python.toml,sha256=MwM46w3rPG7alyLuAAJSd7JCwVB9rWkMy-Te18Jeilk,7538
nldcsc_elastic_rules/rules/linux/privilege_escalation_potential_suid_lpe_via_process_args.toml,sha256=nRGZbADoK_jB9rYim-iefurhJHF5xWct-AdcBwomeTg,4379
nldcsc_elastic_rules/rules/linux/privilege_escalation_potential_suid_sgid_exploitation.toml,sha256=QTL93l9ctFdTPCenphRWQHeFWDqJZBGSeQ33X4j74Dk,12063
nldcsc_elastic_rules/rules/linux/privilege_escalation_potential_suid_sgid_proxy_execution.toml,sha256=U5Q2G9QyxJXmXpKoy8r5wi1qLFXXDXymN1VlvBFA6K0,10551
nldcsc_elastic_rules/rules/linux/privilege_escalation_potential_wildcard_shell_spawn.toml,sha256=cTy0pILrbJONU_vLXaNd3FFqpv-8v3oC2QDeU0XY_6E,9403
nldcsc_elastic_rules/rules/linux/privilege_escalation_sda_disk_mount_non_root.toml,sha256=fxhRLXWekMKPrOsVNhk1tBS3TCUc-FGxHpCnG8E5lmc,8445
nldcsc_elastic_rules/rules/linux/privilege_escalation_shadow_file_read.toml,sha256=bMq-pPgiHhCVjZ0o5wT2145jtowF82QLjY3BJNoxfGI,8987
nldcsc_elastic_rules/rules/linux/privilege_escalation_snap_confine_lpe_via_cve_2026_3888.toml,sha256=9aaNUIoMOL3byVjmSgGmQJcBM_njpxuuuxeAV9-t5hQ,8965
nldcsc_elastic_rules/rules/linux/privilege_escalation_sudo_cve_2019_14287.toml,sha256=HPAhKlykNu_LvVoAZSZlkXa-e6l7aqeOzebl1Bt0liA,8643
nldcsc_elastic_rules/rules/linux/privilege_escalation_sudo_hijacking.toml,sha256=Fe2aKl0WOkD9yzompTDCYxDq9hFzg4vbAjvoioSIva0,10307
nldcsc_elastic_rules/rules/linux/privilege_escalation_sudo_token_via_process_injection.toml,sha256=Gn_WLx5tunhdOOVrvAYHv2VPW7lCEqrIlQSz1p2ySH0,9183
nldcsc_elastic_rules/rules/linux/privilege_escalation_suspicious_cap_setuid_python_execution.toml,sha256=9F2lBnX054xxZ8SvYHsRJVoAiz7Xifc6v-6id2QaVTA,8570
nldcsc_elastic_rules/rules/linux/privilege_escalation_suspicious_chown_fowner_elevation.toml,sha256=a3OYBgCzrS8c9-j39dolzhC9InrFwiZb5dgnUO4cqnU,8741
nldcsc_elastic_rules/rules/linux/privilege_escalation_suspicious_passwd_file_write.toml,sha256=FOIzx7X52LE6Q1cGJSAwcOvri5K4252_3EhwecWJXa4,10466
nldcsc_elastic_rules/rules/linux/privilege_escalation_suspicious_suid_binary_execution.toml,sha256=bW5Gw9dKqZr1PeQoloq2eyaljlKvBdNSV2gX0dKD1Pg,4178
nldcsc_elastic_rules/rules/linux/privilege_escalation_suspicious_suid_binary_execution_auditd_sequence.toml,sha256=Yi_3IL7DF2ycCR19JtnK_3LZX8CSw-G7fk2qM7eA7Zc,4274
nldcsc_elastic_rules/rules/linux/privilege_escalation_suspicious_uid_guid_elevation.toml,sha256=NMgcETzoGMMhA2FBpT2txH4C_l_ZnppjfeDkk0xqKrs,10636
nldcsc_elastic_rules/rules/linux/privilege_escalation_uid_change_post_compilation.toml,sha256=olJwomQURrdKjg8SUXlRrSmIJfHAa4Edmea-fFQPBFU,8911
nldcsc_elastic_rules/rules/linux/privilege_escalation_uid_elevation_from_unknown_executable.toml,sha256=2iVymhHI9DeAEPO2dIHbWFH8T0Qk9Oc7kzI2zJtgR3s,9989
nldcsc_elastic_rules/rules/linux/privilege_escalation_unshare_namespace_manipulation.toml,sha256=QODT1Pb66TSRVbQvivg2KsQ2hS83C6149El-azCdQ78,9544
nldcsc_elastic_rules/rules/linux/privilege_escalation_unshare_to_root_process_auditd_sequence.toml,sha256=kZB-rqB_Xn-nwi5YHxt4AlNd6BvF6XbyJvPvJtg478I,5272
nldcsc_elastic_rules/rules/linux/privilege_escalation_writable_docker_socket.toml,sha256=2cXH-BDuHIzzybxj3Rj-yaINk3yYJdJD2PKjDpDmjX0,8565
nldcsc_elastic_rules/rules/macos/collection_discovery_output_written_to_suspicious_file.toml,sha256=Z3a2jrTLP9g3ISonkbPpnY6bOKYG4GlfdkexqcWEja4,6633
nldcsc_elastic_rules/rules/macos/collection_pbpaste_execution_via_unusual_parent.toml,sha256=q_W_Ey4qgP3PpK-q842M6N9dSGTmXzduCD_wefRDyiY,5342
nldcsc_elastic_rules/rules/macos/collection_sensitive_file_access_followed_by_compression.toml,sha256=VSr4KqWxHqA5aRCNjxBe2-bMhcDCeDw261nCBmjUmTM,6161
nldcsc_elastic_rules/rules/macos/command_and_control_aws_s3_connection_via_script.toml,sha256=y2oXmhYdlOIFA3v0RCT4Re41ItTj_IZxv-dzfZ2DBqQ,7362
nldcsc_elastic_rules/rules/macos/command_and_control_etherhiding_c2_via_blockchain_rpc_request.toml,sha256=wBw0e7ein9TrmNvtIalmHfeWW1jnxX285at0WMeykJs,5276
nldcsc_elastic_rules/rules/macos/command_and_control_executable_download_via_wget.toml,sha256=eRY4SYTdGSuiKTPrVQgKd8BwABcOBPABVAvOXso3Fa4,5844
nldcsc_elastic_rules/rules/macos/command_and_control_google_calendar_c2_via_script.toml,sha256=9w_n0nJ_LSsJaRlCDN26GxYthoL2EA51SKeYhdiKS8E,6779
nldcsc_elastic_rules/rules/macos/command_and_control_network_connection_to_oast_domain.toml,sha256=fqqFqJdbu7DKC5Lq75QNS8MG2tbUjkRV2ZySHcL3rpU,6450
nldcsc_elastic_rules/rules/macos/command_and_control_perl_outbound_network_connection.toml,sha256=_L1SLGhx9i0hO1NYJp24Nj5d_kTdOxnSIr-j4YMrqCc,6401
nldcsc_elastic_rules/rules/macos/command_and_control_potential_etherhiding_c2.toml,sha256=SfBUy6s7273FznJ8ZSazqodFi-NxyhTwQIirpZJxwsA,7357
nldcsc_elastic_rules/rules/macos/command_and_control_script_interpreter_connection_to_non_standard_port.toml,sha256=oqVEN4WKpCehBBNWeD8EJQH189Ad29BuZbC1oe1HZJU,7381
nldcsc_elastic_rules/rules/macos/command_and_control_suspicious_curl_from_macos_application.toml,sha256=aprYtZ85Jf11SWYOVvSn5gS1KFY5Hei1BGSTf5vTuYs,6686
nldcsc_elastic_rules/rules/macos/command_and_control_suspicious_curl_to_google_app_script.toml,sha256=0aZzz7wFSta6pnbMaz5BjjbtzoNjL_pIJ8YIrF6sCc4,5945
nldcsc_elastic_rules/rules/macos/command_and_control_suspicious_outbound_network_via_unsigned_binary.toml,sha256=GZZJrSFm1QO-GVNYyLNvtWfi-GXNiBvk4IMtCqnfeZ4,6321
nldcsc_elastic_rules/rules/macos/command_and_control_unusual_connection_to_suspicious_top_level_domain.toml,sha256=-XGn1eFnw_bcGEosxgzh0U3j-TPNuQMPgCQ8lRh5vrU,6071
nldcsc_elastic_rules/rules/macos/command_and_control_unusual_network_connection_to_suspicious_web_service.toml,sha256=0PJgPSzXsrBzmwfStLVlcuzJI1fi7swLt3Q4m1c4hyE,9715
nldcsc_elastic_rules/rules/macos/credential_access_credentials_keychains.toml,sha256=cL4BbVaH9hxAz0M8L1vpPzSochzyttcR5x_wefni4Nk,8187
nldcsc_elastic_rules/rules/macos/credential_access_dumping_hashes_bi_cmds.toml,sha256=JXkaQNUF9TQtgA2Vf6SrX2JjtckmS79L6SyLeenzgmM,7975
nldcsc_elastic_rules/rules/macos/credential_access_dumping_keychain_security.toml,sha256=UYPUJny2yLlZzz2TVPDf5yedM-RtNRIp_ZgNXpNfZ4k,7655
nldcsc_elastic_rules/rules/macos/credential_access_high_volume_of_pbpaste.toml,sha256=N-WctIiKwfCdd9Lhc26iTPlduAxhuMOo9ZIPHW9G0h8,6075
nldcsc_elastic_rules/rules/macos/credential_access_kerberosdump_kcc.toml,sha256=WMI953r7aT0tyk77n5mRxnkyDoxAhJJVCzpss6jGS38,7885
nldcsc_elastic_rules/rules/macos/credential_access_keychain_pwd_retrieval_security_cmd.toml,sha256=TvD17K_AWT6t52NE75j8ahwBQo80FnVxe1N97eZ8bik,8751
nldcsc_elastic_rules/rules/macos/credential_access_mitm_localhost_webproxy.toml,sha256=wGi2Pl3fOhVr-vAXZzupAGlnQ0HBTw-L61RK2P7kHIY,8455
nldcsc_elastic_rules/rules/macos/credential_access_potential_macos_ssh_bruteforce.toml,sha256=aqaoq_GXPvF4fFWV7sfTHdkC8MJE72AZCnWARmC_dy8,6963
nldcsc_elastic_rules/rules/macos/credential_access_promt_for_pwd_via_osascript.toml,sha256=T4XAjcmHRd1ggLNNzCkHWPzyZzm5NhhTP_hbuuPIMd0,9471
nldcsc_elastic_rules/rules/macos/credential_access_python_sensitive_file_access_first_occurrence.toml,sha256=NfLhnRtuo0iCxgab7H0kW2N0fUzHQ09ipoX_52yMXpI,5491
nldcsc_elastic_rules/rules/macos/credential_access_suspicious_web_browser_sensitive_file_access.toml,sha256=6G1l1OtyBs94cZq-XpFvZNWpHQmi7eos8us1w_oKTTo,8503
nldcsc_elastic_rules/rules/macos/credential_access_systemkey_dumping.toml,sha256=pbfE2lbkm-Y2zaePyKLRa0luvLhQn32rOXhiA54SSWk,8017
nldcsc_elastic_rules/rules/macos/defense_evasion_apple_softupdates_modification.toml,sha256=VgR5u-7spOIBd29fLNXqRLCqymY3Snrv-O3jYjdSwRk,7981
nldcsc_elastic_rules/rules/macos/defense_evasion_attempt_del_quarantine_attrib.toml,sha256=tT4tnZdLwnn5AdAxKbKbPhyqH29HGPX4FhJHlHVzwyw,8733
nldcsc_elastic_rules/rules/macos/defense_evasion_attempt_to_disable_gatekeeper.toml,sha256=4E2AR_5IxCRunaCzRCAbipV6e6rAuZ4ToK_jIf2GriE,7779
nldcsc_elastic_rules/rules/macos/defense_evasion_dylib_injection_via_env_vars.toml,sha256=A8q5KwKjTy1BlOrICXmd1ZsB5u9I2NBLCv7PBtgR9R0,7287
nldcsc_elastic_rules/rules/macos/defense_evasion_gatekeeper_override_and_execution.toml,sha256=LqUkIzZQEPLXuWVeKwphMga7FbEU-DduIy3GCaw6Nyo,5958
nldcsc_elastic_rules/rules/macos/defense_evasion_install_root_certificate.toml,sha256=7DzVjrayPerYwWMEbGwMP0A-Z75YH0V_1FcuvwImc-4,8386
nldcsc_elastic_rules/rules/macos/defense_evasion_modify_environment_launchctl.toml,sha256=-5sldNn6DoKhq8ElcQk9TUVG1lVnGY05Feup7wZyC_w,8257
nldcsc_elastic_rules/rules/macos/defense_evasion_privacy_controls_tcc_database_modification.toml,sha256=zutIb2FhbvXohAge5qH5eUWTraOL-vqbxeTlmh-hQBc,8530
nldcsc_elastic_rules/rules/macos/defense_evasion_privilege_escalation_privacy_pref_sshd_fulldiskaccess.toml,sha256=-V0Og4OL1I_HmdDNaAQ5KTd2keqJd-bXNGD3lt7xjLg,8458
nldcsc_elastic_rules/rules/macos/defense_evasion_safari_config_change.toml,sha256=FwMaztGAqzDC55hTzDxPJr1UbA0IvtnCHBGxeM4t4ps,8121
nldcsc_elastic_rules/rules/macos/defense_evasion_sandboxed_office_app_suspicious_zip_file.toml,sha256=q0iFwwOsSk3OnWDmiO_LI5dv7ggGMS-FVze0Z2tywpQ,7826
nldcsc_elastic_rules/rules/macos/defense_evasion_suspicious_tcc_access_granted.toml,sha256=QDg2VAO6OmnHml-rGoReHa5ZEd_zjz9s2At0Z61C8Rc,6540
nldcsc_elastic_rules/rules/macos/defense_evasion_tcc_bypass_mounted_apfs_access.toml,sha256=SmvFdzGMz29rPK1DmXVq_r53rclZ39wsu-jbN5NeiNM,7727
nldcsc_elastic_rules/rules/macos/defense_evasion_unload_endpointsecurity_kext.toml,sha256=oPyS4pe0FpiOkm8qA6Zvb0IdkRw-4JA5v9gdpbOw5Jg,8160
nldcsc_elastic_rules/rules/macos/discovery_dns_request_for_ip_lookup_service.toml,sha256=XMF4HSGV9opu9RuLPLVyVUcOARzqhGZlm4QrTjzN3Ag,6657
nldcsc_elastic_rules/rules/macos/discovery_external_ip_address_discovery_via_curl.toml,sha256=TtPlCeIyE88R5Yih0uHIiLiGDjv2IszmK3njuSltwVA,6642
nldcsc_elastic_rules/rules/macos/discovery_full_disk_access_check.toml,sha256=aMahH6Pd_URyTLEFFQnwXt4-z1kt32ZgZCqTtkZyuAs,6587
nldcsc_elastic_rules/rules/macos/discovery_suspicious_sip_check.toml,sha256=dDM2NamLcGBgvb6TONhp4L12ZX152IWdnoK-m06bbC8,6819
nldcsc_elastic_rules/rules/macos/discovery_system_and_network_configuration_check.toml,sha256=5i-xR7no7XBhB7HlZH-KHsKAviw9OUEF_V9Kt1Ctckc,5978
nldcsc_elastic_rules/rules/macos/discovery_users_domain_built_in_commands.toml,sha256=EFKFB_csG3KnZzSLB16pY5Kmw3RejcYlIAk1_vbgSnw,8953
nldcsc_elastic_rules/rules/macos/execution_defense_evasion_electron_app_childproc_node_js.toml,sha256=x9uXwLeXXvhNiev-9aqVW0o0CfcCogJT5XsPgl8U90s,8278
nldcsc_elastic_rules/rules/macos/execution_initial_access_suspicious_browser_childproc.toml,sha256=1AVOsesbxW4xZgcuZ9tIT3tL3krE5oYEZuUTclDAPXc,9565
nldcsc_elastic_rules/rules/macos/execution_installer_package_spawned_network_event.toml,sha256=r592mvM8utLsHPQWvkqVHUJI0CSSku1GVK-MrspxMsc,9887
nldcsc_elastic_rules/rules/macos/execution_python_shell_spawn_first_occurrence.toml,sha256=2bOB0N7GMvOLRM1QuvVLY51IT0EcRrvcTPNttHR9I7M,5078
nldcsc_elastic_rules/rules/macos/execution_script_via_automator_workflows.toml,sha256=0r9nu2lhizGyhM-9ycLhRANNKJmxEu5Z49DG40zSl00,7681
nldcsc_elastic_rules/rules/macos/execution_scripting_osascript_exec_followed_by_netcon.toml,sha256=mVVX0sestZJ9HM1NXcRf7UwdPNU2s7Wh_eTv9FTg1rs,8774
nldcsc_elastic_rules/rules/macos/execution_shell_execution_via_apple_scripting.toml,sha256=a1FtUZnGmmBLE1AUHYd1740AFzjzJFhr1wmus-74MZE,8367
nldcsc_elastic_rules/rules/macos/execution_unusual_library_load_via_python.toml,sha256=4j_bMGWEQ9iq7067JX9FktiU4P0mOGUBLTNGDCle56s,5665
nldcsc_elastic_rules/rules/macos/initial_access_ssfilecopysender_root_execution.toml,sha256=ZGSZnvnnAQxJd0rMjgthkeCKevbjLWY2tuk6F-oHfRI,9400
nldcsc_elastic_rules/rules/macos/initial_access_suspicious_mac_ms_office_child_process.toml,sha256=r3ahjHvQNIDAB6Npx4f_GiNdTRJ0MeF3B7_EJ1G49qQ,10882
nldcsc_elastic_rules/rules/macos/lateral_movement_credential_access_kerberos_bifrostconsole.toml,sha256=0_hpYSLKK-wWuCty1XKnDJXMGjWXm3jMUvEijTuk2HA,9356
nldcsc_elastic_rules/rules/macos/lateral_movement_mounting_smb_share.toml,sha256=puslOgkvweM-mOEKZ88ZehUdIA3Vg49TfI8gxN00nMY,7960
nldcsc_elastic_rules/rules/macos/lateral_movement_remote_ssh_login_enabled.toml,sha256=7kuyRMGd10cGzfClGvMp8GqiPbXjfFeGOqkYvCq5WFE,7999
nldcsc_elastic_rules/rules/macos/lateral_movement_suspicious_curl_to_jamf_endpoint.toml,sha256=OiECMsEZN3tihJ6SH1Jx5Qj3Ap_iLc7kcJYaQl350Mg,6152
nldcsc_elastic_rules/rules/macos/lateral_movement_vpn_connection_attempt.toml,sha256=77wkmc9eyfCLNvcwnjOLXjxqrgP9ulKgqxlv25xwJLM,7820
nldcsc_elastic_rules/rules/macos/persistence_account_creation_hide_at_logon.toml,sha256=ugp-_IXJ5I6pjvpDJQY_qQj9axhUzRLJc266SwhUUOg,8406
nldcsc_elastic_rules/rules/macos/persistence_apple_mail_rule_modification.toml,sha256=wdqiDUuLu82BkdzbIIjij5Dcvckg5d7_teqHM7zSaAE,6701
nldcsc_elastic_rules/rules/macos/persistence_creation_change_launch_agents_file.toml,sha256=Jlm9x5sHxBj3HScOpyamPTW8CpHifOgtSHf2VTTlZ00,8802
nldcsc_elastic_rules/rules/macos/persistence_creation_hidden_login_item_osascript.toml,sha256=apxbKbUCnOZHreo8KAdaJeXx9kNOu8NUCtTlopDN15Y,8028
nldcsc_elastic_rules/rules/macos/persistence_credential_access_authorization_plugin_creation.toml,sha256=B6Q_UwSu48vkWl4JJzpjPH3-viZNOOSXzuKO2TZSpD0,8552
nldcsc_elastic_rules/rules/macos/persistence_crontab_creation.toml,sha256=X4Yjg-TmpV9TdxnK8GSJ0wwRURj0IJ-YT2PaEa-U1As,7999
nldcsc_elastic_rules/rules/macos/persistence_curl_execution_via_shell_profile.toml,sha256=5u5igpaveBK8nVsfzD8-ds_o_GmSC9c_61z6QNTxQiA,6199
nldcsc_elastic_rules/rules/macos/persistence_defense_evasion_hidden_launch_agent_deamon_logonitem_process.toml,sha256=cISluk-qzyf63nlSxJIyeHzN5tz2vozVPZr-NY2k_tA,8405
nldcsc_elastic_rules/rules/macos/persistence_directory_services_plugins_modification.toml,sha256=PYjyu5PDYpksYQyGQUq-vRXbu65AFqxo59weAlXPRlQ,7909
nldcsc_elastic_rules/rules/macos/persistence_docker_shortcuts_plist_modification.toml,sha256=QC-RaB3z7zBlzzzvSFiF68SR9lC7v867ayGpHExn0xM,8050
nldcsc_elastic_rules/rules/macos/persistence_emond_rules_file_creation.toml,sha256=_0FlKzxeDnE9W_LmXaR7wGZjdBxi1a0m_3R5sMDacFg,8151
nldcsc_elastic_rules/rules/macos/persistence_emond_rules_process_execution.toml,sha256=Gst6W-etmem8sh9XqwnP8ZN2h_qtpvS2iRjbnE4Sebw,9151
nldcsc_elastic_rules/rules/macos/persistence_enable_root_account.toml,sha256=EEYJ9N8bVAmc1QTjYD4KwKrrmx0RXie0uqmgsEmdd94,7311
nldcsc_elastic_rules/rules/macos/persistence_evasion_hidden_launch_agent_deamon_creation.toml,sha256=mSJNtNPyL9FNZDYNWt3ZyauRuvPDZ1xMlEPA9cdvXbA,8354
nldcsc_elastic_rules/rules/macos/persistence_finder_sync_plugin_pluginkit.toml,sha256=ku__bnRNJQqGKDXKPQWF0pOckGGD8NjfzD2EenLKv7w,7905
nldcsc_elastic_rules/rules/macos/persistence_folder_action_scripts_runtime.toml,sha256=2rBqBKEzW-Nuwnj_jEZYJTfv2pxRL1S0A_3g8yEhm5Y,8277
nldcsc_elastic_rules/rules/macos/persistence_hidden_plist_filename.toml,sha256=2YpZew6o56tVtmRmCVgkhZvXkwQZKRIckws3mlNyYPU,6395
nldcsc_elastic_rules/rules/macos/persistence_login_logout_hooks_defaults.toml,sha256=7s4KtXwI-Q5BC4cJqsuYX0UH_JlIC5Dk2GKt7dQ_F0A,7420
nldcsc_elastic_rules/rules/macos/persistence_loginwindow_plist_modification.toml,sha256=sd26rTm7h9YTk2p7aYLlf5VfZ9dWRtEeFGtuBQdvEBE,4564
nldcsc_elastic_rules/rules/macos/persistence_manual_chromium_extension_loading.toml,sha256=EkfdzjaazSO0YSwpody9pjEOmT10Jbvw5Am9Hhcvfrg,6415
nldcsc_elastic_rules/rules/macos/persistence_modification_sublime_app_plugin_or_script.toml,sha256=BsyE2G49ny-yUq7hujeIBUHpX4cn18Pk-AdGqOq7Oeg,8318
nldcsc_elastic_rules/rules/macos/persistence_periodic_tasks_file_modify.toml,sha256=MZDRNSRa8vvkQgnxj83Tcn4cVi2LCIJIpyWbghk9beo,7904
nldcsc_elastic_rules/rules/macos/persistence_python_launch_agent_or_daemon_creation_first_occurrence.toml,sha256=ZQIvsrdqF6sWyFncMdZQDDvjLKJWAsFOYlJzSvYPHGg,4784
nldcsc_elastic_rules/rules/macos/persistence_screensaver_engine_unexpected_child_process.toml,sha256=40_pSfhL9Z_px3pjjEpGfCyiCKVyH4iAwdGmO1Hki9A,4262
nldcsc_elastic_rules/rules/macos/persistence_screensaver_plist_file_modification.toml,sha256=P6rgb07K4efL7abFb6mOQm1ZRm-lvidChinYATTtab0,4949
nldcsc_elastic_rules/rules/macos/persistence_ssfilecopyreceiver_file_writes.toml,sha256=PQ-au6LDOmPTg9UmNzdDaCxUoZ-6O2RN_tDxOvJPRNM,10546
nldcsc_elastic_rules/rules/macos/persistence_startup_item_plist_creation.toml,sha256=eSC7zhsXe3Guc7w3HolJQHk3YNuDc5IMxTvLRrrL51s,5093
nldcsc_elastic_rules/rules/macos/persistence_suspicious_calendar_modification.toml,sha256=iJvazcalicvjRtcDDDMwdTDTtuzdd3h5S_s_hPAhMD4,7640
nldcsc_elastic_rules/rules/macos/persistence_suspicious_file_creation_via_pkg_install_script.toml,sha256=KKtu4gWAYQztUxqefoMtJ0tXzoBdPaVnoSJSIn_l5c4,6682
nldcsc_elastic_rules/rules/macos/persistence_suspicious_launch_agent_or_launch_daemon.toml,sha256=iZ2Zjaiyr8weMrcwASBX2EgIcWgzmfyAj1LeTouQURs,7196
nldcsc_elastic_rules/rules/macos/persistence_via_atom_init_file_modification.toml,sha256=tXZmNl3qxQlC5NJpr5yAZv21sa_vnSf1vZU5WwBIntY,7718
nldcsc_elastic_rules/rules/macos/privilege_escalation_applescript_with_admin_privs.toml,sha256=Sdjki60iflZoAYfRJqA6FLgSoP38ZtUUQWAtDCydgyk,8060
nldcsc_elastic_rules/rules/macos/privilege_escalation_explicit_creds_via_scripting.toml,sha256=VFRPoLnV2b0EZxn-DpojFVB68ANHBFH0Qbq1MpVQNEg,9102
nldcsc_elastic_rules/rules/macos/privilege_escalation_exploit_adobe_acrobat_updater.toml,sha256=PrCU4ombJgNnKapwPfF6tifjlRo0mcM_XxjKByaY3pg,8757
nldcsc_elastic_rules/rules/macos/privilege_escalation_local_user_added_to_admin.toml,sha256=iC-n9P4bS7jYdH87mTqRRHjs2qaq9jKKdArT-yRxIuM,8389
nldcsc_elastic_rules/rules/macos/privilege_escalation_root_crontab_filemod.toml,sha256=e96qCW7SwiE1kUQwttbqeMv5cROauTZ3vNj7G6kTzsU,7416
nldcsc_elastic_rules/rules/macos/privilege_escalation_user_added_to_admin_group.toml,sha256=Alg8bYpQ3qQZk1XGzJitk8Zk7Ka_9Zk75QXcRNbLLgM,4146
nldcsc_elastic_rules/rules/ml/command_and_control_ml_dns_tunneling.toml,sha256=S5RKsB4Zt9Qx_sVPHs4RYkkp6KOqXJrVjftZtPjHD1I,9958
nldcsc_elastic_rules/rules/ml/command_and_control_ml_packetbeat_rare_urls.toml,sha256=ckwo3Pnh0XjxNzK06SImiwp1ncxT00UyvJdjcZQM8ec,10914
nldcsc_elastic_rules/rules/ml/command_and_control_ml_packetbeat_rare_user_agent.toml,sha256=xenUm7hhdM_XR-qWxw-g6MHJ6KRdmZKOqarLWa0Oxz8,10110
nldcsc_elastic_rules/rules/ml/command_and_control_ml_rare_dns_question.toml,sha256=QUewdTP2hj4F6B5xQftnfqibFSr1iL-1qWtj24bmi2I,10793
nldcsc_elastic_rules/rules/ml/credential_access_ml_auth_spike_in_failed_logon_events.toml,sha256=Jr7ziZdqzL3B4pu3DgKYm33NHdthKDVWFfT5y8lT5Hk,9777
nldcsc_elastic_rules/rules/ml/credential_access_ml_auth_spike_in_logon_events.toml,sha256=uv0fVocLuSoek1roX87G5mgzeDWZhsTNCLvj_CnmFa0,10967
nldcsc_elastic_rules/rules/ml/credential_access_ml_auth_spike_in_logon_events_from_a_source_ip.toml,sha256=1xIDMrUUG_rDlGlQN9Mrde9Be-FAyV2KQ671Bqw9qt0,9535
nldcsc_elastic_rules/rules/ml/credential_access_ml_linux_anomalous_metadata_process.toml,sha256=bJNUIRpBQvsvnOxGD4yHqTfWdD6QRPsPXdUE9ZDxaDM,10046
nldcsc_elastic_rules/rules/ml/credential_access_ml_linux_anomalous_metadata_user.toml,sha256=1sSQwx-RBH8Ep6rQBvzs7M_ABlMqsyIjLAMCSlOMAn8,10209
nldcsc_elastic_rules/rules/ml/credential_access_ml_suspicious_login_activity.toml,sha256=1LyFdXnk37MYFP_iqHshEuKFjbcjboURucg_iNGXNbY,10492
nldcsc_elastic_rules/rules/ml/credential_access_ml_windows_anomalous_metadata_process.toml,sha256=TVL-JtJDx2FOw7L3BhQLSqI2d8dkGCkbVDaYzeLC-lQ,9210
nldcsc_elastic_rules/rules/ml/credential_access_ml_windows_anomalous_metadata_user.toml,sha256=AxhE7S8jt3w5uMLVSuTxueilLgyYEWJqrJtQ4fLdV5Q,9108
nldcsc_elastic_rules/rules/ml/discovery_ml_linux_system_information_discovery.toml,sha256=l9WNMiGUMgK26gqdvPb83j1ngc_07HSkrTJ9TyN4zVA,10017
nldcsc_elastic_rules/rules/ml/discovery_ml_linux_system_network_configuration_discovery.toml,sha256=BU0bZnW1Jx8TIXgSwpaBdL2pC5PgK5jQ4Op1PMRCTnY,10397
nldcsc_elastic_rules/rules/ml/discovery_ml_linux_system_network_connection_discovery.toml,sha256=3pyPOt2E9sSjk8BAwL7O7QVLD-pmf2RYvFaIQz4E_xs,9769
nldcsc_elastic_rules/rules/ml/discovery_ml_linux_system_process_discovery.toml,sha256=TJLUeSDiiD1-hH6C3QnR1V1DestbBmnOxnqzrwfRzKY,10163
nldcsc_elastic_rules/rules/ml/discovery_ml_linux_system_user_discovery.toml,sha256=yLTAoEu75EG1LT879y1zbWkGLvtWTvRF9_XI-Rm2oGY,9782
nldcsc_elastic_rules/rules/ml/execution_ml_windows_anomalous_script.toml,sha256=q1q4_dv5ofBFvnl7hby8fe6hLTTWXq-XSB01N-BX8iQ,7570
nldcsc_elastic_rules/rules/ml/execution_ml_windows_rare_script.toml,sha256=JALecaDCTj4AaKjWmiChb5FyXu1_pjTgT46lXOhjDEU,7357
nldcsc_elastic_rules/rules/ml/initial_access_ml_auth_rare_hour_for_a_user_to_logon.toml,sha256=Yiki-nnb5jYuTIQEaxsu8rw5suY-K8LW74UIWNDJR0Y,6832
nldcsc_elastic_rules/rules/ml/initial_access_ml_auth_rare_source_ip_for_a_user.toml,sha256=dJr6l9gCODpyG5WOTg7U7SuG95FI1MwkNhr0bEeQFRI,10907
nldcsc_elastic_rules/rules/ml/initial_access_ml_auth_rare_user_logon.toml,sha256=UFsBYUHnRqKgTtXqiQi9t-14aOBaB52v6oKvG4xC6E8,8954
nldcsc_elastic_rules/rules/ml/initial_access_ml_linux_anomalous_user_name.toml,sha256=onrgkIRrzRcqEs4HNT1yEYe4Uaehh9LyhiIygXmhXeA,7613
nldcsc_elastic_rules/rules/ml/initial_access_ml_windows_anomalous_user_name.toml,sha256=rx34SdDgn0proH6OcSujhml3PqmT5n--2tEl7iqC8xY,7322
nldcsc_elastic_rules/rules/ml/initial_access_ml_windows_rare_user_type10_remote_login.toml,sha256=lliC_hIx6XRF3AvUY-kVSIh9B7OtqWdG-g9PuHgxHRQ,4220
nldcsc_elastic_rules/rules/ml/ml_high_count_events_for_a_host_name.toml,sha256=FG0tewBuhqivFzQt1NFy-059Jl4O-lEtROMShyB860Y,13121
nldcsc_elastic_rules/rules/ml/ml_high_count_network_denies.toml,sha256=8sZLevPxhtbNEQZ1ev-jFqDIO18YJUGhFAuq2CaLjL4,11171
nldcsc_elastic_rules/rules/ml/ml_high_count_network_events.toml,sha256=cUl-geF1MbJ7NQGQossVR-Wojj5AWZ2tSDc450KM0KA,10473
nldcsc_elastic_rules/rules/ml/ml_linux_anomalous_network_activity.toml,sha256=IHut_8gL_onrw761zisVl0lPQTLUGlEdL7fBmVQJRHg,7780
nldcsc_elastic_rules/rules/ml/ml_linux_anomalous_network_port_activity.toml,sha256=E8TKjryHFxmr9jdoiGJkfGnns6bko-aHCUPV-CloSTU,10317
nldcsc_elastic_rules/rules/ml/ml_low_count_events_for_a_host_name.toml,sha256=ryjQgdyu8tIcQmrir98Ckf-5d-EgyWDjYl9VFVTWmQc,11575
nldcsc_elastic_rules/rules/ml/ml_packetbeat_rare_server_domain.toml,sha256=DWOZp30I12TizxL1CgFFEcv5yRfoAmKenBQpL3RvQCA,11652
nldcsc_elastic_rules/rules/ml/ml_rare_destination_country.toml,sha256=1V8y0lOyRrLRO95MfJheCbOZFRPVNMuL61-628E3noc,11992
nldcsc_elastic_rules/rules/ml/ml_spike_in_traffic_to_a_country.toml,sha256=b6Pp5EAtE0DCAEwsBfwf1IGBqznvReYlcEZQ1Z4kVfM,10468
nldcsc_elastic_rules/rules/ml/ml_windows_anomalous_network_activity.toml,sha256=vOEzJOMqzkV8VuvTIS6bdTrqCYoXf3lbOSkJ0Gp9gf0,8191
nldcsc_elastic_rules/rules/ml/persistence_ml_linux_anomalous_process_all_hosts.toml,sha256=PQK-xHsZkBbLWnpBKuDeQYPVzeqRy5Bfz2fB7FVbCMg,10891
nldcsc_elastic_rules/rules/ml/persistence_ml_rare_process_by_host_linux.toml,sha256=rT6tN2fHFG8Y0vMB2TmDzss3gpuCrbgdgb5rorX2xFg,9487
nldcsc_elastic_rules/rules/ml/persistence_ml_rare_process_by_host_windows.toml,sha256=rSfiLXPW8bveO5g13M4armmxkdY7EdGUmsrF09rMnXQ,12251
nldcsc_elastic_rules/rules/ml/persistence_ml_windows_anomalous_path_activity.toml,sha256=01vGaKviNJlmyEPKJJF5Huoge9USrbLU5RG83Sxd3kw,9947
nldcsc_elastic_rules/rules/ml/persistence_ml_windows_anomalous_process_all_hosts.toml,sha256=UXYzkklaurNXkA24JDazrvbm8zq_CL70DyygcAMGms4,12148
nldcsc_elastic_rules/rules/ml/persistence_ml_windows_anomalous_process_creation.toml,sha256=wmiuESR4b5z4TxiXpffWwE383ATo9tdhUu6PbhMMlYw,12980
nldcsc_elastic_rules/rules/ml/persistence_ml_windows_anomalous_service.toml,sha256=TVGkysmCzVcFwFuZnMNSMIWSfMYV3qw4YB_8QdUVQnU,9643
nldcsc_elastic_rules/rules/ml/privilege_escalation_ml_linux_anomalous_sudo_activity.toml,sha256=1qu4h5wEU9-dGqrOyEdyIooTxCtqaPsQuNk4zyDCh_A,10052
nldcsc_elastic_rules/rules/ml/privilege_escalation_ml_windows_rare_user_runas_event.toml,sha256=0y__fuPhGqmfuP1Yr0D9on3sE-MpRD_Pj8Zupz8mONI,9321
nldcsc_elastic_rules/rules/ml/resource_development_ml_linux_anomalous_compiler_activity.toml,sha256=zh1lTjV0Tnx1zzp7a3ajvDGzaEkHUUFYTw_laDN_g8s,12031
nldcsc_elastic_rules/rules/network/collection_fortigate_config_download.toml,sha256=k63FTZ2g4-jSW4964BR8QB3CrJOBWN3fsTslI8euP-4,5219
nldcsc_elastic_rules/rules/network/collection_nfs_auth_sys_root_uid_access.toml,sha256=1DEqIeS4S900m2vWi65ml-fFnPFvHRPPGuRvzNVwglU,4455
nldcsc_elastic_rules/rules/network/command_and_control_accepted_default_telnet_port_connection.toml,sha256=wXf1PX96f2LDpbrW-yL-Ib5Q0Jq3RAN1YX_E_t7xuRI,7957
nldcsc_elastic_rules/rules/network/command_and_control_cobalt_strike_beacon.toml,sha256=mFIeMaPq1GojGLV5Qh8mfiZ3iUGVZjG6CHaYjyo8q4s,6976
nldcsc_elastic_rules/rules/network/command_and_control_cobalt_strike_default_teamserver_cert.toml,sha256=9tHo4525LYgyF1DrQJ0DVIWAkRwFGHtIjnuCl4Kv9Zk,6776
nldcsc_elastic_rules/rules/network/command_and_control_dns_tunneling_long_labels.toml,sha256=ecaNI8KxlBgj82bSavnqREZ31G2SNm8xpdxH0ybSx34,8446
nldcsc_elastic_rules/rules/network/command_and_control_download_rar_powershell_from_internet.toml,sha256=B8TxRlYozBflqyML9NAd2XgwF1kvaKl8MZVJw6SjoB4,7190
nldcsc_elastic_rules/rules/network/command_and_control_fin7_c2_behavior.toml,sha256=X4q9TOc8JaFfIgKtIHYHJ9Dg9whJdp9JgN_C6dMMgO0,3075
nldcsc_elastic_rules/rules/network/command_and_control_halfbaked_beacon.toml,sha256=_WCGjJufKUq38ZvsMolxy31wAV6mEQtdwNbPCmk0Z7I,6466
nldcsc_elastic_rules/rules/network/command_and_control_newly_observed_ipsec_nat_traversal_peer.toml,sha256=G5GFD9SLqw7VUvKq6VB7awfmopQMzFbtiRfrBOrWB_E,8402
nldcsc_elastic_rules/rules/network/command_and_control_potential_icmp_tunneling_to_the_internet.toml,sha256=MsIzXJtvrtjnm0emh1CmME_-v_xc_v8eLW-_Iw4zqdg,4695
nldcsc_elastic_rules/rules/network/command_and_control_rdp_remote_desktop_protocol_from_the_internet.toml,sha256=c-TOmeCeuLkXBpTXkqr8i62Na12K6Oa4trmkyAKLFLE,8148
nldcsc_elastic_rules/rules/network/command_and_control_smtp_to_the_internet_port_26.toml,sha256=9oMs0SLh1L1caUAvsqYaq6NWbnguORwbtjo7XdMuPk4,7598
nldcsc_elastic_rules/rules/network/command_and_control_tls_self_signed_recent_external_connection.toml,sha256=uN-sB42RriI0aGj2lrKT_b2qWSi95C5nGk_pVahWyAI,11236
nldcsc_elastic_rules/rules/network/command_and_control_vnc_virtual_network_computing_from_the_internet.toml,sha256=xUVoMkdWUNmhwn1lOw07TeLRoIPISClSknsgXQXUIh0,7317
nldcsc_elastic_rules/rules/network/command_and_control_vnc_virtual_network_computing_to_the_internet.toml,sha256=QGACqD6WaAVNMVrbEeOun01Rcd6t3hpa7YPG5pRs4Ew,7255
nldcsc_elastic_rules/rules/network/credential_access_azure_wireserver_http_request_unexpected_user_agent.toml,sha256=twwnLMVbs60UV9TJyCo8E32AKHEjqfAr-UScXc2rC3Q,6221
nldcsc_elastic_rules/rules/network/credential_access_cloud_imds_credential_http_request.toml,sha256=gLdixoN7UBI1nm4cAMKPC50rRB9ZinMzIJBN-D0WRJk,5176
nldcsc_elastic_rules/rules/network/credential_access_dhcp_multiple_servers_same_transaction.toml,sha256=atnh-5W4GixOD4lL2mtzllfwHcDJoyhEEEvVAKwhRoI,7268
nldcsc_elastic_rules/rules/network/credential_access_icmp_redirect_message_observed.toml,sha256=2E3JIf26DQcpsrfwdteQN9iWXuQlWPb7PMkRQAQ7Kco,3881
nldcsc_elastic_rules/rules/network/credential_access_potential_sip_register_brute_force.toml,sha256=_hPh_Ypolu3JvkU7ofzwO93VxEN8jfKTcOBv9GPhei8,6939
nldcsc_elastic_rules/rules/network/credential_access_sonicwall_login_failures_followed_by_success.toml,sha256=uV0eMNiaWnBTR3aUglqI16Wu6pjWxWcK8ImSo9xKZY0,9036
nldcsc_elastic_rules/rules/network/credential_access_tls_deprecated_or_weak_cipher_negotiation.toml,sha256=UHbujG4ptbF-cjxLkikCd-KcmN0nzD67XhJY5HON2Iw,5652
nldcsc_elastic_rules/rules/network/defense_evasion_fortigate_overly_permissive_firewall_policy.toml,sha256=2Bsd7hK-c2Fwl-0uKpjj6my-LLO_A0nO5l2o-8F5l8g,4710
nldcsc_elastic_rules/rules/network/discovery_icmp_timestamp_or_information_request_from_the_internet.toml,sha256=6LUkAkBFDe3vz5JECxZ-lgi8qX0OP-vzXcLggMt4MxY,4609
nldcsc_elastic_rules/rules/network/discovery_potential_network_sweep_detected.toml,sha256=1lujZmvM3uiDNf63emjrQF9J1RANqT7UMxvYY-1Oj5M,6826
nldcsc_elastic_rules/rules/network/discovery_potential_port_scan_detected.toml,sha256=PBkc4sYsDmbDg3x2FR9zMfTEICto28rBCD9PJBkHSTg,7764
nldcsc_elastic_rules/rules/network/discovery_potential_sip_extension_enumeration.toml,sha256=C8BBF8Z-LWC5CeiDGO6u1r9LB2d5NRPl9JYZ2jdBuh0,5394
nldcsc_elastic_rules/rules/network/discovery_potential_syn_port_scan_detected.toml,sha256=jtOP5oueOEjndXiYCrJ6AUd983jWM2SmgS7OTPleDYI,6765
nldcsc_elastic_rules/rules/network/execution_cassandra_javascript_udf_creation.toml,sha256=WbJfuBkm9Yq6gdoOZ8YUuBokLJTdsqI9RvocLi16acU,4460
nldcsc_elastic_rules/rules/network/execution_postgresql_copy_program_command.toml,sha256=42Tplh7sX-vgm_Rfa-Lbx6zMMAkhnF4jMTdSY63HP9U,4267
nldcsc_elastic_rules/rules/network/impact_amqp_multi_queue_purge_burst.toml,sha256=AxoEM4BOCEKXZe4t0qNPr990-K_FwkUrD7StT1Iyu1Q,5734
nldcsc_elastic_rules/rules/network/impact_destructive_mongodb_command.toml,sha256=QGUVESmld_Kvz7cgSKPERJ7AOIIeahpspNYrxO-D0Jo,4880
nldcsc_elastic_rules/rules/network/impact_dhcp_starvation_high_client_mac_cardinality.toml,sha256=FA--S1ooJZwE8Eh05IaNbCyJeoNGg42WJmrd5b77xoU,5333
nldcsc_elastic_rules/rules/network/impact_first_time_seen_memcached_writer.toml,sha256=8jGzdvxyV43vn7kpWgl_eyotlflNFjv_hyCpzNMrGOk,6294
nldcsc_elastic_rules/rules/network/impact_potential_nfs_destructive_operation_burst.toml,sha256=t7SoezHwSc1V5qKhN1CaKK5Y1bi_0wIdwfgVDMui-BA,4887
nldcsc_elastic_rules/rules/network/impact_tls_alpn_acme_stalled_handshake.toml,sha256=48he2hcuDoVKsDMTuS2-pBsPRB2JaZrWZxb7DPfPEJo,9407
nldcsc_elastic_rules/rules/network/initial_access_dns_rebinding_private_ip_answer.toml,sha256=2PaYJ6u0ZmdpNqeZgl-jN8Dq74i0B99BUWe2LbgcrUg,10134
nldcsc_elastic_rules/rules/network/initial_access_first_seen_sonicwall_remote_access_identity_source.toml,sha256=MEbVex1mvMzandQcKUXkaYSo9uPXccpu4E1PpkBALK4,4857
nldcsc_elastic_rules/rules/network/initial_access_fortigate_admin_login_multi_srcip.toml,sha256=wTGL0cINUU4hPX1Gwcw5ztuD-JFb66Vdl-D_gIYvycc,5482
nldcsc_elastic_rules/rules/network/initial_access_fortigate_sso_login_from_unusual_source.toml,sha256=6yaWkiU6-7IVxqhpw_LqQZYehaycPs98uD-muf3IrgE,6435
nldcsc_elastic_rules/rules/network/initial_access_newly_observed_fortigate_admin_logon.toml,sha256=P2mtO58fdzNlVxPtlb7h_8eIhuyD108we4hLQoSwErs,5026
nldcsc_elastic_rules/rules/network/initial_access_potential_cpanel_whm_crlf_authentication_bypass.toml,sha256=j7Q7qLyksCMzWmN3BhWGn7_BCx3QDu6i5wfEmN17jeE,12590
nldcsc_elastic_rules/rules/network/initial_access_potential_redis_lua_use_after_free_rce_cve_2025_49844.toml,sha256=Q7aD1Pu0TRTP7DB7no3nNptny5a-hNhCBg0fAv1DqNI,6764
nldcsc_elastic_rules/rules/network/initial_access_react_server_components_rce_attempt.toml,sha256=rNHqL1RWGMFG_E97JV9wpEFBh4cutfaxsU4mXtQ-Vps,5239
nldcsc_elastic_rules/rules/network/initial_access_react_server_rce_network_alerts.toml,sha256=O4ST7G0lSCsOxAQGfYN92IMvJvdzkZxCn1KyUDb_p88,5130
nldcsc_elastic_rules/rules/network/initial_access_rpc_remote_procedure_call_from_the_internet.toml,sha256=fdaxN5u1PBarIC-VosppIvatba_5DwhvniZK_zEh7-Q,6486
nldcsc_elastic_rules/rules/network/initial_access_rpc_remote_procedure_call_to_the_internet.toml,sha256=n3VFR8DAfID0DB-8pTYzgOKETqMED_Lh89g2bqS4Osg,7174
nldcsc_elastic_rules/rules/network/initial_access_smb_windows_file_sharing_activity_from_the_internet.toml,sha256=9tltnIsSK_DIhChK-2qN8iX9DRhN4XzWAet3KuXoxJY,7148
nldcsc_elastic_rules/rules/network/initial_access_smb_windows_file_sharing_activity_to_the_internet.toml,sha256=pHufZCUqTUjEYh6KQXIIt7OKaoPpp_qXLZbHbfVJ0vo,7137
nldcsc_elastic_rules/rules/network/initial_access_splunk_postgres_backup_restore_rce_sequence.toml,sha256=jyBFEke6XerArDiY8BilwlC3hnZcokkNKOkJiH36EtY,8187
nldcsc_elastic_rules/rules/network/initial_access_splunk_postgres_recovery_body_injection.toml,sha256=KOu1yeHU8jspbo5OhpJnqdVl86fgaH8bpdDyGY27XME,10719
nldcsc_elastic_rules/rules/network/initial_access_thrift_rpc_method_from_external_client.toml,sha256=KUIX1ofN4rtRRFNhM36IvPg-AA4OmPkYroYh75-B96w,5068
nldcsc_elastic_rules/rules/network/initial_access_unsecure_elasticsearch_node.toml,sha256=-y4cuOpqop_moV-ni30gbbVCY3vTpaVWYhNOi-lOCuk,6591
nldcsc_elastic_rules/rules/network/lateral_movement_dns_server_overflow.toml,sha256=fHNgMmqsyqUo_6Vt4KW6yZ2YphVzJ2zEs0oZ697Fqg8,6604
nldcsc_elastic_rules/rules/network/persistence_fortigate_admin_creation_unusual_source.toml,sha256=sxsFQQl1MxejCWr1UXNPPxW4XfS3zjWdpM70ngbJ7_A,4607
nldcsc_elastic_rules/rules/network/persistence_fortigate_sso_login_followed_by_admin_creation.toml,sha256=461fc5UK9dnoCWObr6atpIngGSpnUH9n0IZnMuiDDpQ,4987
nldcsc_elastic_rules/rules/network/persistence_fortigate_super_admin_account_creation.toml,sha256=5RfmBrfXx8CFDdUnxCujWD7IoHU7sZ8mK6rqfWqAMy0,4302
nldcsc_elastic_rules/rules/network/persistence_mysql_udf_injection.toml,sha256=QLPzu3yitFD9posCME-of849ShEHc3PWdUmGKROvL3w,4211
nldcsc_elastic_rules/rules/network/persistence_potential_redis_config_set_cron_persistence.toml,sha256=cuj5K5uDAae49lDWv4kUdWB9TCNwx0VTfYYO4tulLpA,6553
nldcsc_elastic_rules/rules/network/persistence_potential_redis_config_set_ssh_key_injection.toml,sha256=Qkmpa7FqccJNjp4yxBqtRblcf0i_Fq2SMMmv8fica1w,6336
nldcsc_elastic_rules/rules/promotions/credential_access_endgame_cred_dumping_detected.toml,sha256=z6nBuhaCnYaL-UJtn66PpMIIy0PE8gdaN-Fo6371PlM,5472
nldcsc_elastic_rules/rules/promotions/credential_access_endgame_cred_dumping_prevented.toml,sha256=fTMgE5OaSeG1ttIY3vNhZcTX9mqmUh0U1z3n9ZliTZ0,5336
nldcsc_elastic_rules/rules/promotions/crowdstrike_external_alerts.toml,sha256=Fhq7sied6-0CVpFcYL5zGr-X-wpllOFfwJIwCZXdLAY,4625
nldcsc_elastic_rules/rules/promotions/elastic_security_external_alerts.toml,sha256=lBiECEOwduNwMfnsVOWDea5YUNq4Ptj6_BQus8kn1ig,5417
nldcsc_elastic_rules/rules/promotions/endgame_adversary_behavior_detected.toml,sha256=kHUD1yWpJ9M5XWnjJTM-obM9xAP4vrXi5xTrv16EHJU,4943
nldcsc_elastic_rules/rules/promotions/endgame_malware_detected.toml,sha256=qxk6GJYxP4z3A6di71nq5JjKnTzGddjsGIORg52MD-w,4957
nldcsc_elastic_rules/rules/promotions/endgame_malware_prevented.toml,sha256=yxtTGq6NKFsA0ZmIr5UcToQ0GGv_jQ4hDuX8sKDQlNg,5248
nldcsc_elastic_rules/rules/promotions/endgame_ransomware_detected.toml,sha256=jzHzaCMGEFRZHaY-vx-qjEvxWP0HTEu-W3JbUPJV1tk,5038
nldcsc_elastic_rules/rules/promotions/endgame_ransomware_prevented.toml,sha256=NbkC3mYaZo-9BNdCHkIIDou6qtaGjERlIsRVqx1UgHQ,5205
nldcsc_elastic_rules/rules/promotions/execution_endgame_exploit_detected.toml,sha256=-m18h0GJuJAXgPfZiwrRALgnmTJTAWLoWTTH19KXuC4,5359
nldcsc_elastic_rules/rules/promotions/execution_endgame_exploit_prevented.toml,sha256=y47pQHii-N72d_R9ZOuBy5o115elT56nnkCgfSuuV80,5925
nldcsc_elastic_rules/rules/promotions/external_alerts.toml,sha256=ENogaulAUMTAsCPCbT_GghuWhylEyqu4w3f1FmO3V2Q,5437
nldcsc_elastic_rules/rules/promotions/google_secops_external_alerts.toml,sha256=N-RqHMdp-ShOWRbdjRWAlgpRul7D3HwAMBbTw2_NCtE,5408
nldcsc_elastic_rules/rules/promotions/ibm_qradar_external_alerts.toml,sha256=u4T2mk0OrqDZY8OIN4_GrcELnLF3swv7C4qSL_pmejU,4599
nldcsc_elastic_rules/rules/promotions/m365_defender_alert_external_alerts.toml,sha256=-GF7sxPViocmcmu5b30MjDP40VoAnukcnXcLRTpkmXQ,7183
nldcsc_elastic_rules/rules/promotions/m365_defender_incident_external_alerts.toml,sha256=UeMa79nw8p2pqtfS075tHiQRgU-iUYucndobwUP8DXA,7503
nldcsc_elastic_rules/rules/promotions/microsoft_sentinel_external_alerts.toml,sha256=579FABDjrD2Bx-HtjVbt9Xx_FbGxLZ6V8lwExUnbUjE,5192
nldcsc_elastic_rules/rules/promotions/privilege_escalation_endgame_cred_manipulation_detected.toml,sha256=OsC42xvAWZ73ucgomaH2F3Hz-qH2WgRXmhFvZ4UPFkg,5352
nldcsc_elastic_rules/rules/promotions/privilege_escalation_endgame_cred_manipulation_prevented.toml,sha256=L9F0p1bAIyFqqhvhAh6SrVwXO6sStpEj0RQDpDGyOl0,5404
nldcsc_elastic_rules/rules/promotions/privilege_escalation_endgame_permission_theft_detected.toml,sha256=s1pE0yK3616W1TZ6fmC09oKNNxOv61YAz60iej1VlUs,5475
nldcsc_elastic_rules/rules/promotions/privilege_escalation_endgame_permission_theft_prevented.toml,sha256=czsqKGAlh3ZVrjIgnvaKar28U6vz1iQFRS1xCVHpUDE,5726
nldcsc_elastic_rules/rules/promotions/privilege_escalation_endgame_process_injection_detected.toml,sha256=e6RvjlBLkLA_CSeRnPkMUd7d6nWs6gEVIP3kckyXNBo,5922
nldcsc_elastic_rules/rules/promotions/privilege_escalation_endgame_process_injection_prevented.toml,sha256=g2LXoq92JyjLDT6xuq3EVmdnmOwezNba2mdaLGQTArM,5447
nldcsc_elastic_rules/rules/promotions/sentinelone_alert_external_alerts.toml,sha256=ub8zDEBUmVyUF-DwD2Z0WH4hNjZ4-03lLfPSnzwIJzc,5420
nldcsc_elastic_rules/rules/promotions/sentinelone_threat_external_alerts.toml,sha256=ceyGbQk6Pny24PcURQfR5l-LPMP7CYIP5B5-rcw5vFI,5345
nldcsc_elastic_rules/rules/promotions/splunk_external_alerts.toml,sha256=FTrly6HfH8b2f0Ev3pzEr94aADkPL2aogz9B13BQj-U,5217
nldcsc_elastic_rules/rules/threat_intel/threat_intel_indicator_match_address.toml,sha256=sABfe4Vd_YB_dN7k0TwfcEFz7ForztJQfsK24dBdXPU,9398
nldcsc_elastic_rules/rules/threat_intel/threat_intel_indicator_match_email.toml,sha256=cuh4R_J-fUder7rRHeCDAckV5mC3Tjcw52o0WyyWAko,8113
nldcsc_elastic_rules/rules/threat_intel/threat_intel_indicator_match_hash.toml,sha256=FSffKHLWay2Jyy5_EVHjg33cbS4iVct4BPH9otI20co,10081
nldcsc_elastic_rules/rules/threat_intel/threat_intel_indicator_match_registry.toml,sha256=-8NPSRm082kvQpB-gFdnthoCa_1-5eODRRSlnZbfyCY,8355
nldcsc_elastic_rules/rules/threat_intel/threat_intel_indicator_match_url.toml,sha256=JOmYkXME8BgYPNjCLRJA1mCi-gYEuu9yAemfKHyXWBU,9291
nldcsc_elastic_rules/rules/threat_intel/threat_intel_rapid7_threat_command.toml,sha256=CG1NG4QEb28hBxQIeBqdugJO2bQWs0Xd14mg4uLF81s,4454
nldcsc_elastic_rules/rules/windows/collection_email_outlook_mailbox_via_com.toml,sha256=y0h5jgjzQvI6w40_0xgqbZQoHyyue8VTyZT_fCHHTPU,7569
nldcsc_elastic_rules/rules/windows/collection_email_powershell_exchange_mailbox.toml,sha256=lA63TsVUjpQsen4A_tq34cV7khSnzDh0uvjIHXTRrKw,7654
nldcsc_elastic_rules/rules/windows/collection_mailbox_export_winlog.toml,sha256=Ast2kAmNC-aFSnxfHNbMprS6SvwEpD9bgAfVwclDM4o,11214
nldcsc_elastic_rules/rules/windows/collection_posh_audio_capture.toml,sha256=pKD5vc7fSWTq0U1Mbm0xLvn95CEzTi_7VXMnRgCyWNM,12113
nldcsc_elastic_rules/rules/windows/collection_posh_clipboard_capture.toml,sha256=1QngwNzwvPQvVkYta5AVd03hLv81dSupeSyc1PNDqEs,10765
nldcsc_elastic_rules/rules/windows/collection_posh_keylogger.toml,sha256=M6xfso3JxURicV37IQ04DBA1fRnx_iZDBwvMbGBExRM,13141
nldcsc_elastic_rules/rules/windows/collection_posh_mailbox.toml,sha256=fynlK44P4J30q_tyuI7L57wV2QmoyOIJPdsqpXc0nEI,10792
nldcsc_elastic_rules/rules/windows/collection_posh_screen_grabber.toml,sha256=SAcYET3K3lEXuI6UZE3DdZ9Z_dRuiCSGGekAdtM7FKo,12022
nldcsc_elastic_rules/rules/windows/collection_posh_webcam_video_capture.toml,sha256=AbnGHArZoagurcOTX0XYwWJnTnCvMtf6XRQ8Rjn_m4o,9413
nldcsc_elastic_rules/rules/windows/collection_winrar_encryption.toml,sha256=v_rN1Xs8kdwdDnBnKOCIDavjV9t9JsV7iUI2l_iF2DY,6863
nldcsc_elastic_rules/rules/windows/command_and_control_certreq_postdata.toml,sha256=hOy2m6uzuZubWvbIRR9EeyXPfkJlmAYIJSBt_5gFmzQ,9136
nldcsc_elastic_rules/rules/windows/command_and_control_common_webservices.toml,sha256=Kn_7M--32D2eWxF5NcgbgbSE3S21HkhqWPghOjkIzxU,18494
nldcsc_elastic_rules/rules/windows/command_and_control_dns_rmm_domains_non_browser.toml,sha256=c2OyL6TM0QTLQ4HqXzet6Yoj0ZHQW4g4K1_Mxgd4GbM,10196
nldcsc_elastic_rules/rules/windows/command_and_control_dns_susp_tld.toml,sha256=2sot5fX4D9F1Jb3VZC1xdUyStTrBivDDxYBcFT7rHls,14148
nldcsc_elastic_rules/rules/windows/command_and_control_dns_tunneling_nslookup.toml,sha256=ct9-4-M6tPgVfMnm72soSExSbD0WAe5T-XxdWzQbgQg,5795
nldcsc_elastic_rules/rules/windows/command_and_control_encrypted_channel_freesslcert.toml,sha256=E8d77bK4hSvrd5HwCqv_miI2CjzzUT6LD1eKCZD_e4M,6379
nldcsc_elastic_rules/rules/windows/command_and_control_headless_browser.toml,sha256=CSY8ve-xOnIzovD7kC6hj1cfjOQnM3gnGADDIRNhUyU,12522
nldcsc_elastic_rules/rules/windows/command_and_control_iexplore_via_com.toml,sha256=MlJYulco_Dsi-MjdqjE3IhdtaxX8cfPyuVGxF5sCwL0,8166
nldcsc_elastic_rules/rules/windows/command_and_control_ingress_transfer_bits.toml,sha256=VYXFWyz658DiqiQd5I-wDnRA74MpAj7nlOhIWTdsDxw,9387
nldcsc_elastic_rules/rules/windows/command_and_control_multiple_rmm_vendors_same_host.toml,sha256=LgZGhOY7CBNxbjreAY8kQ8nHVuYm1oAuk7WmA8lo-Yc,14690
nldcsc_elastic_rules/rules/windows/command_and_control_new_terms_commonly_abused_rmm.toml,sha256=Hu7UZ8mMUqFdcmkydMG1LpICNjcapSq5QZ64xUFr9SE,20298
nldcsc_elastic_rules/rules/windows/command_and_control_new_terms_rmm_signer.toml,sha256=krfp8IAhNzMaak58B9FDrBxD9SFZnuCCcfaC4jcMFAY,16550
nldcsc_elastic_rules/rules/windows/command_and_control_newly_observed_screenconnect_host_server.toml,sha256=PZUam4dytIZ9KIkyCBo3zB6O_jQ6CNPf6K3azjycmmU,12386
nldcsc_elastic_rules/rules/windows/command_and_control_openssh_reverse_port_forwarding.toml,sha256=TgKsUq7xMKp1B9vpPRFr9hBA3Kn3OW4VXlFopLF0g4w,10415
nldcsc_elastic_rules/rules/windows/command_and_control_outlook_home_page.toml,sha256=WAOLBiZjf3uq656L7amWcw5fRELvZRsWR88I8x8NRCg,12608
nldcsc_elastic_rules/rules/windows/command_and_control_port_forwarding_added_registry.toml,sha256=UYmH2I592aFTlZ2gLxc2BtkHodLN153YQLMAo8vEeAU,6507
nldcsc_elastic_rules/rules/windows/command_and_control_quick_assist_fullcontrol_sharing.toml,sha256=raAF3IEOZCIrHDuqQm2TqzjlxiSPGUFj9Ieo77QwOnk,5248
nldcsc_elastic_rules/rules/windows/command_and_control_rdp_tunnel_plink.toml,sha256=FAzTj7ylcwbM7kvp8g_pSz4x3bZfWM8dj2NjxK52pDQ,12308
nldcsc_elastic_rules/rules/windows/command_and_control_remcos_rat_iocs.toml,sha256=keP3SEOF4mLjzqnDZn-cjrTXIqIC3fCXY2nYsqYPDzg,11185
nldcsc_elastic_rules/rules/windows/command_and_control_remote_file_copy_desktopimgdownldr.toml,sha256=uuXDFns29E8ECdfd1ivOtImu97NpPo8K19VEOZjwf6M,9908
nldcsc_elastic_rules/rules/windows/command_and_control_remote_file_copy_mpcmdrun.toml,sha256=QDtCLBpKQexEuQucDDcP4kqvJrdRkCfSK8m3hhWKxjs,9749
nldcsc_elastic_rules/rules/windows/command_and_control_remote_file_copy_powershell.toml,sha256=5YELkGA8N--kHFzuSThur9x5HPOVG1VtSZZWclrjNck,10470
nldcsc_elastic_rules/rules/windows/command_and_control_remote_file_copy_scripts.toml,sha256=xX0mjZ3Aj8f6S3HZr2RcSyyflmMmPf-Z8yb8ueo_X4c,8119
nldcsc_elastic_rules/rules/windows/command_and_control_rmm_after_msi_install.toml,sha256=uoxnN7XJ96xZatw2s-WrulkGi7Bz4HvRkED1m6bS31M,4533
nldcsc_elastic_rules/rules/windows/command_and_control_rmm_netsupport_susp_path.toml,sha256=YMjuupwqCr3VoI4CEjNVy1tu5FFhx-SlaY4vwqvQraQ,12232
nldcsc_elastic_rules/rules/windows/command_and_control_rmm_software_installation_from_commonly_abused_web_service.toml,sha256=nYYa5ZpL8KI1gS0WjALGmAy7bArAoTNaV793KV5_UZ4,22554
nldcsc_elastic_rules/rules/windows/command_and_control_rmm_software_installation_from_internet_originated_msi.toml,sha256=lwOhweXgsCjRGLv9g0mxTb9o6XTM9bnL5jkFfcWL4vU,21930
nldcsc_elastic_rules/rules/windows/command_and_control_screenconnect_childproc.toml,sha256=I9Qa-1UctoIq94AUMs5dgFDUN3Wa2gIdrTuPsjvz9_Y,10708
nldcsc_elastic_rules/rules/windows/command_and_control_teamviewer_remote_file_copy.toml,sha256=j058lK-NT17Ij7Iu_6BC_uAkGYyUUrX1XM3fd_WCGds,8077
nldcsc_elastic_rules/rules/windows/command_and_control_tool_transfer_via_curl.toml,sha256=VZxKJpKHe1eHFnXEnSVoM1xOulnHp0vsV0arHVC0VO4,6754
nldcsc_elastic_rules/rules/windows/command_and_control_tunnel_cloudflared.toml,sha256=8KGWpdJf84P-QCqlOE2mr4Ix3uNDiVEX9NIdKAy-RqE,4923
nldcsc_elastic_rules/rules/windows/command_and_control_tunnel_vscode.toml,sha256=RhWU0hgpUxUz7brlT_4GxRehgnKD6SPc0zjOgzlP7L0,7392
nldcsc_elastic_rules/rules/windows/command_and_control_tunnel_yuze.toml,sha256=g3meZmPxrgwt0h8R9jQJ9Wb87f2wcVVYHbAzjmMIrF4,5168
nldcsc_elastic_rules/rules/windows/command_and_control_velociraptor_shell_execution.toml,sha256=ylZMKWG5A2fYXp9TUb5WdaYfvljz3dBJt59AgosM3Nc,7093
nldcsc_elastic_rules/rules/windows/credential_access_adcs_certificate_identity_transposition.toml,sha256=1CdgTPfb5_jNc_SbcTqQQFI5fkJZ9T26S_HZE2irq3M,15610
nldcsc_elastic_rules/rules/windows/credential_access_adidns_wildcard.toml,sha256=Q4n6nF_g0PZnWM9zoYPF4GEdJXV_gTz4XKd2_T3LWIw,12730
nldcsc_elastic_rules/rules/windows/credential_access_adidns_wpad_record.toml,sha256=SQxCXamRQn88-ujIsWXmKF0RH6Zm4J1As-wbtWI_qqs,5766
nldcsc_elastic_rules/rules/windows/credential_access_browsers_unusual_parent.toml,sha256=uzw8RUyK1XMLVHMeE7fFWWvLFIYg1XaOydpWIqyi_GE,16318
nldcsc_elastic_rules/rules/windows/credential_access_bruteforce_admin_account.toml,sha256=fe7_DikLSFSSnpOooORg8PpGFgglgeHoV-wbMR8Odf4,8540
nldcsc_elastic_rules/rules/windows/credential_access_bruteforce_multiple_logon_failure_followed_by_success.toml,sha256=IhFH-1coOzHateuPEkn9DtyBDkoiK0dGLNrhHL9bTkU,7786
nldcsc_elastic_rules/rules/windows/credential_access_bruteforce_multiple_logon_failure_same_srcip.toml,sha256=f8PXYWAoax9n_K5wKn2Spqd5z5vG_ZNMuxuqWH6ecz8,9234
nldcsc_elastic_rules/rules/windows/credential_access_cmdline_dump_tool.toml,sha256=xjtf__j1y_p7NQ0Cd2exvlnjorRbo9NFtE3UAEWJGrw,16370
nldcsc_elastic_rules/rules/windows/credential_access_copy_ntds_sam_volshadowcp_cmdline.toml,sha256=YFb2a_yAfcydRIBpur1vEVc3DHpkBoFEphOYwfqsHK0,15742
nldcsc_elastic_rules/rules/windows/credential_access_credential_dumping_msbuild.toml,sha256=L9rrNmpz7engfx1km0C1w6LlLNssV7RHDs5TgUKVPgU,14898
nldcsc_elastic_rules/rules/windows/credential_access_dcsync_newterm_subjectuser.toml,sha256=V0T6ftjlxCSwZNv1wFdOtknalQCZqRM--UY-IlHQFhY,17327
nldcsc_elastic_rules/rules/windows/credential_access_dcsync_replication_rights.toml,sha256=9Rx-l0llVVqfrksqsab9yMFWE-H-Nh_mcOrDt7oosrY,8645
nldcsc_elastic_rules/rules/windows/credential_access_dcsync_user_backdoor.toml,sha256=cedpq4FK4Jwb0rsXw5r-lsLbSah2O3k4qtnY-7VaSlo,6905
nldcsc_elastic_rules/rules/windows/credential_access_disable_kerberos_preauth.toml,sha256=RuWWvCuk7Skm3XsuwKo3TYvOkJF052j70HqjSolSNC8,6042
nldcsc_elastic_rules/rules/windows/credential_access_dnsnode_creation.toml,sha256=RQ4Rw5UHelGHJm2knEK3m0LDli_YsF8OE7mSg_VqUuQ,6462
nldcsc_elastic_rules/rules/windows/credential_access_dollar_account_relay.toml,sha256=1qPQI3o1adr1r4jSVDQKB7v-qgSn4lKBQEHYsuGbo0A,7462
nldcsc_elastic_rules/rules/windows/credential_access_dollar_account_relay_kerberos.toml,sha256=XXdRcr-HUveqXsFM5z6aSYBpBnFKDyafV7RjtIXlFs4,16306
nldcsc_elastic_rules/rules/windows/credential_access_dollar_account_relay_ntlm.toml,sha256=fj94gAorWUiOrxuXV_WIEAy3n1zjZQX1KpvWORcMZ0E,15448
nldcsc_elastic_rules/rules/windows/credential_access_domain_backup_dpapi_private_keys.toml,sha256=lijkslrvvURYhH0YCR4k_Rje9e35lmq05jPOTINY6Kw,15069
nldcsc_elastic_rules/rules/windows/credential_access_dump_registry_hives.toml,sha256=xevCYVYRTeh7reF3WSrO1aZUhz550Q9ulJ5xBphYuTk,15370
nldcsc_elastic_rules/rules/windows/credential_access_entraid_prt_via_browsercore.toml,sha256=RgIKJIcJiMadFKOoPgl8BZFJPCgg1uXApcPbFQ6fLRg,6645
nldcsc_elastic_rules/rules/windows/credential_access_generic_localdumps.toml,sha256=P6WMBHnGSGZxtXniJVI4RF-BNlUkuvp5dkRpgbir1RA,7837
nldcsc_elastic_rules/rules/windows/credential_access_iis_apppoolsa_pwd_appcmd.toml,sha256=i41I-3QljDUPL2GGDdy8oaDLzjqdFjPa1vUNADhaEN4,6363
nldcsc_elastic_rules/rules/windows/credential_access_iis_connectionstrings_dumping.toml,sha256=FMSURxTcaHH_mk72vXn_ZirUO3m9Ex3kVdDmqRx0438,16474
nldcsc_elastic_rules/rules/windows/credential_access_imageload_azureadconnectauthsvc.toml,sha256=dLuG5LxxYKUv95CkYmuexfgjFvYwCXB9FOdZ0El8rYg,12858
nldcsc_elastic_rules/rules/windows/credential_access_kerberoasting_unusual_process.toml,sha256=r-t9JofX4US9KMUdhfVhLNcA2nZhBCM-Bf5g4nGDiK4,11073
nldcsc_elastic_rules/rules/windows/credential_access_kerberos_coerce.toml,sha256=3KeP9MoLML_IfLS2r9x7GpfBR3P8oI3JewNkNH1r6Qo,14051
nldcsc_elastic_rules/rules/windows/credential_access_kerberos_coerce_dns.toml,sha256=kXGSwr_lvaCIyqlP6OyKMNWmQiC0kZvUnqHIcBcuE60,13371
nldcsc_elastic_rules/rules/windows/credential_access_kerberos_service_ticket_rc4.toml,sha256=ghXZAqITUPYOGWMPhDzFP_r8i_6m60mih0BjIjCujHs,7164
nldcsc_elastic_rules/rules/windows/credential_access_kirbi_file.toml,sha256=oDbpobYblTT9BRm6iurQkPK-ZeaKBBRDTJbBZtFaUYU,14374
nldcsc_elastic_rules/rules/windows/credential_access_ldap_attributes.toml,sha256=XsOG6BkN7PcDSy3vLR1qGO5ceIEWLKBX0HQ99lH2huE,7943
nldcsc_elastic_rules/rules/windows/credential_access_lsass_handle_via_malseclogon.toml,sha256=FsgYyPKDMFpsbpiNXb2hqJWPkez3FPmaeTAuwgfWN0k,14642
nldcsc_elastic_rules/rules/windows/credential_access_lsass_loaded_susp_dll.toml,sha256=FTgTghxTqpqvuqpPvbaqbbFgTYgTarHmxWb_Nk8tjsQ,10258
nldcsc_elastic_rules/rules/windows/credential_access_lsass_memdump_file_created.toml,sha256=pOrYydOCZGBWV5GEPk_A-6bjBHD9rOZmSdO1OuKPAK4,14159
nldcsc_elastic_rules/rules/windows/credential_access_lsass_memdump_handle_access.toml,sha256=UlhlOEkgP3UsrLvIDvtld0jnpXGd7T4YpX2zx4f20lU,9823
nldcsc_elastic_rules/rules/windows/credential_access_lsass_openprocess_api.toml,sha256=f1Q587qcyVpcCS2q4I8Tjxn4ysCDv_BKXxpK_ONrgyw,10819
nldcsc_elastic_rules/rules/windows/credential_access_machine_account_smb_relay.toml,sha256=RV3_cya5P4akebyYfoX_5hQeInEE8OfkOvSPbtceOlY,12606
nldcsc_elastic_rules/rules/windows/credential_access_mimikatz_memssp_default_logs.toml,sha256=VTyWG88xVsCVRqveLggnXKJaCgSgObyL8rrQR645VQs,13259
nldcsc_elastic_rules/rules/windows/credential_access_mimikatz_powershell_module.toml,sha256=Gi2bKVraQaFqHmLAnHl7hgv00yQJxsnvHhguuPC-a7Q,17561
nldcsc_elastic_rules/rules/windows/credential_access_mod_wdigest_security_provider.toml,sha256=PMbr_8k16p-cy-a719414KhbfV8s6i_3HwA_-zGXggo,12872
nldcsc_elastic_rules/rules/windows/credential_access_moving_registry_hive_via_smb.toml,sha256=CkoIyzQqcH9ncBwXpgumFhHon4B1aOSsbNu8xzT8vzA,5683
nldcsc_elastic_rules/rules/windows/credential_access_persistence_network_logon_provider_modification.toml,sha256=DeG9rTDEkWRg4qOaCAs8WitEqIx89PRUhNUE_iMtmLA,9700
nldcsc_elastic_rules/rules/windows/credential_access_pkinit_same_principal_u2u.toml,sha256=eCoQl7t3myH9RePRGPcupyubTsg68rgmM2kpfh5qU_M,10188
nldcsc_elastic_rules/rules/windows/credential_access_posh_invoke_ninjacopy.toml,sha256=Q-iWUIm6z5Qe_3GM1tYa4fGQ9EPQE87j5n3EAIEFiCQ,13541
nldcsc_elastic_rules/rules/windows/credential_access_posh_kerb_ticket_dump.toml,sha256=Lw4k0toq9WDPboQDAF2UDpjwfsDuwBRR2rS1ON-HIAY,14625
nldcsc_elastic_rules/rules/windows/credential_access_posh_minidump.toml,sha256=Jc6T0P9oBrt9u73EFUHNg0o2RtASCTHCzMOYA1ejU_A,13464
nldcsc_elastic_rules/rules/windows/credential_access_posh_relay_tools.toml,sha256=75iCbOXYkJ0cBJDnFmFuSG2_8h2v4T8ND1U2vIQT0Lk,15008
nldcsc_elastic_rules/rules/windows/credential_access_posh_request_ticket.toml,sha256=B7VaqK7Lq6WWq01FtNYSdR056l7MGw8_cHt1iRu4_S4,13588
nldcsc_elastic_rules/rules/windows/credential_access_posh_veeam_sql.toml,sha256=18s-VnVm4aKvXVmB5tCYsfK2ekenaut1rab3KWUGWHA,11730
nldcsc_elastic_rules/rules/windows/credential_access_potential_lsa_memdump_via_mirrordump.toml,sha256=ZCiBTxlJGUGdC_eXanRgtTFXRM6AnzbEykVCsso377s,5831
nldcsc_elastic_rules/rules/windows/credential_access_protected_storage_service_access.toml,sha256=HY4Dcv9JFYKBv2Qyx3N-tSkzYmq0fJxJl9Tb5-4IzT4,4567
nldcsc_elastic_rules/rules/windows/credential_access_rare_webdav_destination.toml,sha256=keN6o4xFJ99nVrAyfYzrErPuAk2TiUwMmTAIZTR8b0s,5553
nldcsc_elastic_rules/rules/windows/credential_access_regback_sam_security_hives.toml,sha256=Tp6wc6zxVQ6Khuekye1OGxnJ86OrAI_Qhxl22qCtP2Y,13279
nldcsc_elastic_rules/rules/windows/credential_access_relay_ntlm_auth_via_http_spoolss.toml,sha256=Le-jgNwH0Sug6BQ8cGkZ4RkYhm1hDeTCCrxAtFkW1kk,15156
nldcsc_elastic_rules/rules/windows/credential_access_remote_sam_secretsdump.toml,sha256=gyKpiwc-fENPpG6Qfo5FA1DYMLUCn2NPcfSMTReIeg8,13043
nldcsc_elastic_rules/rules/windows/credential_access_saved_creds_vault_winlog.toml,sha256=e4TM8yEDkjJWgC4gWJNiTmAz1NtoPeEtOGSuqM6zYkc,6536
nldcsc_elastic_rules/rules/windows/credential_access_saved_creds_vaultcmd.toml,sha256=4lJ58Wi_mwPWKpTX3gxFCyeD-_o3q0sxry7MNICYBMk,7300
nldcsc_elastic_rules/rules/windows/credential_access_seenabledelegationprivilege_assigned_to_user.toml,sha256=XSZyTj4S8i1lEda7InCB89qIMS8QHgOU6XcfPpI8ZCs,16586
nldcsc_elastic_rules/rules/windows/credential_access_shadow_credentials.toml,sha256=kBjVJdr-dNZoPqoICgMmAff8zsdQfLDemglfmFRMVTI,12200
nldcsc_elastic_rules/rules/windows/credential_access_spn_attribute_modified.toml,sha256=9g07M-8kGBfxsZe_FTUJluKtEQRg74jrwRwFwRH7NEc,6026
nldcsc_elastic_rules/rules/windows/credential_access_suspicious_comsvcs_imageload.toml,sha256=nNQIi-k-xZpZrOJ4s6M1PlWgKIuU9d27V-lZtFb1VLw,11380
nldcsc_elastic_rules/rules/windows/credential_access_suspicious_lsass_access_generic.toml,sha256=Loci9FVXfLWXfEPjLKXSIYIFuGSPUR1Lpn5_xi_8eik,7493
nldcsc_elastic_rules/rules/windows/credential_access_suspicious_lsass_access_memdump.toml,sha256=0VhWD8GNSfZ-0gk5rggnd1aSiiGOklX9PIBjJgysOMI,14226
nldcsc_elastic_rules/rules/windows/credential_access_suspicious_lsass_access_via_snapshot.toml,sha256=4GhwmL8u9bzOj4gCawa56FIBobD-CyTP76O24zf6vMY,11577
nldcsc_elastic_rules/rules/windows/credential_access_suspicious_winreg_access_via_sebackup_priv.toml,sha256=Q1wfFvFV7urjIGMJ_mxdFKEUtaMzkAW5zJMbTWuDe2E,5591
nldcsc_elastic_rules/rules/windows/credential_access_symbolic_link_to_shadow_copy_created.toml,sha256=Q3BOxpKPgm472DAgwPtrMGpbcds_mP4MXe4kLJeiEvI,6933
nldcsc_elastic_rules/rules/windows/credential_access_veeam_backup_dll_imageload.toml,sha256=j2zcFjIwOk892xHJMUDc2Arbw-SJ3yNqs7kt1rQTZcI,7163
nldcsc_elastic_rules/rules/windows/credential_access_veeam_commands.toml,sha256=0pWhlScdDKvu3X-FoAVYMwDu4su9ZE6gq1yrXuO1uHM,7864
nldcsc_elastic_rules/rules/windows/credential_access_via_snapshot_lsass_clone_creation.toml,sha256=uaNMgj1yi7y8ReoUmeIdXIPC9aYVIF5cpPo1-ug54nA,10538
nldcsc_elastic_rules/rules/windows/credential_access_wbadmin_ntds.toml,sha256=Qxfq3sewmYAnsdi0Pcs-0el64XOrO0t1Kji9xl3Pvn4,7186
nldcsc_elastic_rules/rules/windows/credential_access_web_config_file_access.toml,sha256=JLdakxkZmh2SFKW8w7serWICmlBdrEOErXbrEW_QbR0,12631
nldcsc_elastic_rules/rules/windows/credential_access_wireless_creds_dumping.toml,sha256=fxltV-gWatldaAFrF2peeKx9kXzvlgiiXRRHxszuUzE,12280
nldcsc_elastic_rules/rules/windows/defense_evasion_adding_the_hidden_file_attribute_with_via_attribexe.toml,sha256=uI_ztgGoClkrDlzt7kDMvclL7rpbPTp4UIyfNh4y5cM,8733
nldcsc_elastic_rules/rules/windows/defense_evasion_amsi_bypass_dllhijack.toml,sha256=pCu4KBjnFKy4VHScWajB-rK19RwkS63XQpICjmlvY3o,14234
nldcsc_elastic_rules/rules/windows/defense_evasion_amsi_bypass_powershell.toml,sha256=utWvn7vWHCtwLrRkecqLjNVIyLMM7cWGtMnA2TsRJpk,12909
nldcsc_elastic_rules/rules/windows/defense_evasion_amsi_bypass_rpc_ndrclientcall.toml,sha256=wPnupKiVfqYQV3Dg6Y0qbpWWWeUP8o4RWbp3xMK8ZKs,6220
nldcsc_elastic_rules/rules/windows/defense_evasion_amsienable_key_mod.toml,sha256=y-PX4hXXQcZKumeTNdVz9Dry4QTS27y5xNSbXH08H90,12810
nldcsc_elastic_rules/rules/windows/defense_evasion_audit_policy_disabled_winlog.toml,sha256=hLbmO8KAhyh8GRteRggz7p1G79azdrCWibx_9AkU1oU,5666
nldcsc_elastic_rules/rules/windows/defense_evasion_boot_time_removal_tool.toml,sha256=5sBhr3dE85QFssJJ3nMIDdvJkNYisCeQCVMCpF_Fyi4,7978
nldcsc_elastic_rules/rules/windows/defense_evasion_clearing_windows_console_history.toml,sha256=Tq7Dn5QIBvEAyHM2wD-Wlx1MyHO49Ba8OzyaKLdoWn8,6495
nldcsc_elastic_rules/rules/windows/defense_evasion_clearing_windows_event_logs.toml,sha256=TCs_hlb6lF-4_6EE_bMnpGtef94VKrLlFCi6waIXaWY,6275
nldcsc_elastic_rules/rules/windows/defense_evasion_clearing_windows_security_logs.toml,sha256=YkIY1D_1f-HVmE1YIpX8CLtzgbF_rMzAwerPIHGzVes,3923
nldcsc_elastic_rules/rules/windows/defense_evasion_code_signing_policy_modification_builtin_tools.toml,sha256=9NculFaLnIAVauqJ2jk7XDDFZzrKwBSv0a85RSRiYjY,7850
nldcsc_elastic_rules/rules/windows/defense_evasion_code_signing_policy_modification_registry.toml,sha256=ptV1w_sUHRnU_hkmqSiXhYESk8lUWZaizvRY7UJpM5w,8013
nldcsc_elastic_rules/rules/windows/defense_evasion_communication_apps_suspicious_child_process.toml,sha256=WLGil1j4pF0XeL5SkO9uk5CL8a14kExDaBMAI6Z2PT4,12598
nldcsc_elastic_rules/rules/windows/defense_evasion_create_mod_root_certificate.toml,sha256=YJlKvMmV0pUdh-4JP1ZP2V6ttDL4ErR5keP4iEquy6M,10321
nldcsc_elastic_rules/rules/windows/defense_evasion_cve_2020_0601.toml,sha256=v2qfUprubjnknhyB7sXWRvwMgpL9SFTuIu7Stz-BcG0,5535
nldcsc_elastic_rules/rules/windows/defense_evasion_defender_disabled_via_registry.toml,sha256=7-XHfzhaCQzIW99DAqPCycp0fD6LxZ_hCFjoGZlaCoE,6157
nldcsc_elastic_rules/rules/windows/defense_evasion_defender_exclusion_via_powershell.toml,sha256=vPeWHBj1rWzP2vAYCsIsf5hIKHY6LQuHZX2aPQMmkqQ,7730
nldcsc_elastic_rules/rules/windows/defense_evasion_delete_volume_usn_journal_with_fsutil.toml,sha256=GH8L9414YdXBOXp8k162QlzmLhR8fBR-5OhblRjLFzo,5644
nldcsc_elastic_rules/rules/windows/defense_evasion_disable_nla.toml,sha256=KUbx-3OOwMBWoD60cJCh3locqyPPDr--d3nrDF0cd0U,7956
nldcsc_elastic_rules/rules/windows/defense_evasion_disable_posh_scriptblocklogging.toml,sha256=F7qPxf6vnW594Ai4bFO3eZu2TkrtwVyHsA3WGYN2maI,10779
nldcsc_elastic_rules/rules/windows/defense_evasion_disable_windows_firewall_rules_with_netsh.toml,sha256=PDo17P8NMxYLKho2ZA6a6gFbcdsQuccKOoTaH26-M70,4920
nldcsc_elastic_rules/rules/windows/defense_evasion_disabling_windows_defender_powershell.toml,sha256=VEoiSRRFGMGkrHWHenBnn1ChXPhBXIfn_Mg3DinEUe4,9386
nldcsc_elastic_rules/rules/windows/defense_evasion_disabling_windows_logs.toml,sha256=-LVDmzP0Eg6fBDauDVL5yI5Kc5DTByeSsPZERA79ezs,6320
nldcsc_elastic_rules/rules/windows/defense_evasion_dns_over_https_enabled.toml,sha256=cxtuEGLFn6pOnObVrjpI36_DlQU-pT_e6fQ0KMrE0f8,6890
nldcsc_elastic_rules/rules/windows/defense_evasion_dotnet_compiler_parent_process.toml,sha256=dx9Y-7Tl3F093e0H4DdAggWgMGVf3q3N-O6OxDBhWx8,8866
nldcsc_elastic_rules/rules/windows/defense_evasion_edr_freeze_via_werfaultsecure.toml,sha256=GTuNscwNMeHkE0W85-yvfVwe5ck6J83nn8RE_7j4CWY,8047
nldcsc_elastic_rules/rules/windows/defense_evasion_enable_inbound_rdp_with_netsh.toml,sha256=U5BHDYJvRnedDzqA2ibwboZoibxwGqcuidTjA0NCNKI,5849
nldcsc_elastic_rules/rules/windows/defense_evasion_enable_network_discovery_with_netsh.toml,sha256=GQYZXY1L9pjpk7wDx8zGoiWnJV7QTcdubaWGrHJ7iXA,5409
nldcsc_elastic_rules/rules/windows/defense_evasion_execution_control_panel_suspicious_args.toml,sha256=dWnKead0CrAu8XVl6nObwOeTlpeHpOuzfMF-NE3l8oM,14200
nldcsc_elastic_rules/rules/windows/defense_evasion_execution_lolbas_wuauclt.toml,sha256=0Je2-5DSP9NNMR_Z40cfs6CIN5z9Ewtx15WITsuxXg0,8874
nldcsc_elastic_rules/rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml,sha256=dPl4TKbf-37a85VxJsvm1ZLPsmvGhxSib8JCo4du25M,13404
nldcsc_elastic_rules/rules/windows/defense_evasion_execution_msbuild_started_by_script.toml,sha256=ahs_g5GumCmYF2Qw_pJhzQNyj_Iu97yTMgsAUI0fwgU,8859
nldcsc_elastic_rules/rules/windows/defense_evasion_execution_msbuild_started_by_system_process.toml,sha256=MuHrm1UFjGqvJKf0hn8f-ua5jMJzhX7FxvcZtSb7RzQ,7127
nldcsc_elastic_rules/rules/windows/defense_evasion_execution_msbuild_started_renamed.toml,sha256=nUMaDueLQeDfInIgblO_p0KMsX9LknS6JGXTIW50OXs,7979
nldcsc_elastic_rules/rules/windows/defense_evasion_execution_msbuild_started_unusal_process.toml,sha256=6UPD7o4QYG9HrzNhRmhQhIvYZXk6t8EYmr83r_apc7A,7545
nldcsc_elastic_rules/rules/windows/defense_evasion_execution_suspicious_explorer_winword.toml,sha256=QW_8OYMxDMRlaPVQNN8kYuqYRiLtKKKOuBdKrBKLf8Y,9266
nldcsc_elastic_rules/rules/windows/defense_evasion_execution_windefend_unusual_path.toml,sha256=VzjWYCqYRJXBO_jlPtJ2FIGk9VmOr2-5VmY3Qxi9BlQ,15318
nldcsc_elastic_rules/rules/windows/defense_evasion_file_creation_mult_extension.toml,sha256=YUtFiX51UoHuslRcmxgR2vaKfnqYhbBJ4YWSgTL2-ps,7819
nldcsc_elastic_rules/rules/windows/defense_evasion_from_unusual_directory.toml,sha256=_fVScLdHSnCqOPlY55hRcjoFALtdaqvLnwR3yGozUU8,11144
nldcsc_elastic_rules/rules/windows/defense_evasion_iis_httplogging_disabled.toml,sha256=oNFqEHNq3JJm5Imnekf7rXGTc2t4JAXVs_NCcKiPHhA,11216
nldcsc_elastic_rules/rules/windows/defense_evasion_indirect_exec_conhost.toml,sha256=fRWHA7IOPNYmc0vTOoEN51YPryGBX-Ub7v0VDK5yu-Y,14342
nldcsc_elastic_rules/rules/windows/defense_evasion_indirect_exec_forfiles.toml,sha256=o5qhov5JXpAGIgf0AY_66VgJ8vJA2HS3OOs_ot_9vm8,4626
nldcsc_elastic_rules/rules/windows/defense_evasion_indirect_exec_openssh.toml,sha256=p2GAkgHDjS6Nepm8wSugecCmKJbudXTGEZUPUk_XQJA,15302
nldcsc_elastic_rules/rules/windows/defense_evasion_injection_msbuild.toml,sha256=A-vL7eR_mIP0wHomm71llIm25PNXZLw-3ZixyD0Nw0w,6551
nldcsc_elastic_rules/rules/windows/defense_evasion_installutil_beacon.toml,sha256=DFRuR7tzHhCXkZulhZHQ_x10TgYT8_uZz6paTP2oT-8,6711
nldcsc_elastic_rules/rules/windows/defense_evasion_lolbas_win_cdb_utility.toml,sha256=aH1m1DQjsGhffSl4qerYyz4tScXt1nxLyiDoFnEs80U,7145
nldcsc_elastic_rules/rules/windows/defense_evasion_lsass_ppl_disabled_registry.toml,sha256=f__ECWp-T2hdgMauCD3PuMcev4sqbW3N_PiHKh1maWE,13791
nldcsc_elastic_rules/rules/windows/defense_evasion_mark_of_the_web_removal_unusual_process.toml,sha256=F3WGS_eS2lGn5lPcyl0T0x62gEsv62ofomKmMoH8xxM,9853
nldcsc_elastic_rules/rules/windows/defense_evasion_masquerading_as_elastic_endpoint_process.toml,sha256=RGAMRIBz1Mo-dI8GbmlahX6FmUdhSBYuF2lNMbJq9i8,8296
nldcsc_elastic_rules/rules/windows/defense_evasion_masquerading_as_svchost.toml,sha256=AY6nm1CR8cWn9__fUCzWIA6fftLHRB6vB9Jz9ssQGdY,11358
nldcsc_elastic_rules/rules/windows/defense_evasion_masquerading_business_apps_installer.toml,sha256=9coCD5XdvldCvQ-qbWQaSm5_lv25zKG46Jz0oWG-s84,12238
nldcsc_elastic_rules/rules/windows/defense_evasion_masquerading_communication_apps.toml,sha256=6hxkDyB0F9KAfLbGZ6kcDXKw8zXqq8oCD7CKZypPqYE,9369
nldcsc_elastic_rules/rules/windows/defense_evasion_masquerading_renamed_autoit.toml,sha256=aYLEZ31Wj3VigtuRmuEmkd4PqpVAebly31WNkoxl1Vg,13370
nldcsc_elastic_rules/rules/windows/defense_evasion_masquerading_suspicious_werfault_childproc.toml,sha256=pwpVg84NdnR_Nouu8eGDRQgZTOK7d-x3r3lhkWA6V_8,8095
nldcsc_elastic_rules/rules/windows/defense_evasion_masquerading_trusted_directory.toml,sha256=20QlDitgLcmWyPTnkwTOc5bZsjm_5Mm8qhKIKLqKRVU,7859
nldcsc_elastic_rules/rules/windows/defense_evasion_masquerading_werfault.toml,sha256=pdpl1dzVtouqbnLVzIoIUl_be1mWoVoszmjL2x3lWP8,8280
nldcsc_elastic_rules/rules/windows/defense_evasion_masquerading_windows_dll.toml,sha256=cYtZwHD4FjCtGT1pcikCXpBxRarbpDcW05F9IzT2ORA,53794
nldcsc_elastic_rules/rules/windows/defense_evasion_microsoft_defender_tampering.toml,sha256=8XAjIRYm1umnHUM9nUBBHTwztlEFd6G4S92aBzY3tjM,9248
nldcsc_elastic_rules/rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet.toml,sha256=JJb0mDY2DI0CAutUwInVA_-bCQxT3ZjNFyMl7O5qPBg,8672
nldcsc_elastic_rules/rules/windows/defense_evasion_modify_ownership_os_files.toml,sha256=Qlxscgx5fKP9MCL7mN7F6i2sn7pGAS476H3_bkysULw,5374
nldcsc_elastic_rules/rules/windows/defense_evasion_ms_office_suspicious_regmod.toml,sha256=YOxKB_UDmPWQpYD68U3-jCs2ff4-tgu9UIF156390js,6892
nldcsc_elastic_rules/rules/windows/defense_evasion_msbuild_making_network_connections.toml,sha256=1cj9F0388ifnETYlLH866c56W1uDo-nDEx-ZivJC6a0,8753
nldcsc_elastic_rules/rules/windows/defense_evasion_mshta_beacon.toml,sha256=7Zr2_N0_A8CNRpTonkNzBsZI00JVX559IyVGF9vlLpw,6634
nldcsc_elastic_rules/rules/windows/defense_evasion_mshta_susp_child.toml,sha256=n7U-NoiOnVrP_FbB6BNGG6_NfPX4ncCaqalrcmoOsy8,16547
nldcsc_elastic_rules/rules/windows/defense_evasion_msiexec_child_proc_netcon.toml,sha256=WidjCPD4W8YzFsMMk-xtkYx5dAbLMJJzgqAJNOjS-Fs,8605
nldcsc_elastic_rules/rules/windows/defense_evasion_msiexec_remote_payload.toml,sha256=K23D8eIoXm-5BBkLCg7Ay_2O-Md9mDC-f7bEDzY-l4g,12623
nldcsc_elastic_rules/rules/windows/defense_evasion_msxsl_network.toml,sha256=QrLlgIuWM2j_t_1dZUrfsYE3kO9fe6JQeHz0sz_EZVw,7057
nldcsc_elastic_rules/rules/windows/defense_evasion_network_connection_from_windows_binary.toml,sha256=iD30ZiS40wBc4u51aO0OfYz9_5BvLXy0LUUdO7PTqqs,11377
nldcsc_elastic_rules/rules/windows/defense_evasion_ntlm_downgrade.toml,sha256=yUya7P-_rvReJ38rHrkLE_7dKCtHQBKRPyOOnB3tfRc,5771
nldcsc_elastic_rules/rules/windows/defense_evasion_obf_args_unicode_modified_letters.toml,sha256=_ukw14k8ROMkE0hGo4ymJUOg9Cb34FDqGxwgv0sgoU4,14862
nldcsc_elastic_rules/rules/windows/defense_evasion_parent_process_pid_spoofing.toml,sha256=JZXGrpRGRaKo75eLgL7JPHA0mcbmswgihUyY8ttNVzw,14170
nldcsc_elastic_rules/rules/windows/defense_evasion_persistence_account_tokenfilterpolicy.toml,sha256=DWgytdFIcbqxcVunNXxvj9g2FgWfu0sUCymKQwSUMiA,8681
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_assembly_load.toml,sha256=crnXLpwjCJ_pnD9op6XvXGJjdp9k1CjnAFuzl3EyeFc,11913
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_compressed.toml,sha256=LAQAscQ8LJpd1g3dhiTcE1c5Gc3U3WlCkMOqK-01vu4,14137
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_defender_tampering.toml,sha256=kE1wzd1rV_IYDibBIzzXBiBe-7rXFgF5vQg47yt544Y,11126
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_encryption.toml,sha256=11XtS_4eM2THb0NdStYie1P8cq677dckRtHkDDeG2A4,11493
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_high_entropy.toml,sha256=JjpW72rCbrBMQAHNFKK_Hz86x3YvC_aMWyZ_tbwKnrs,12635
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_backtick.toml,sha256=fbPdVifuLTQ-UbMjwUg5lg0BQjW0fpvPB0NvwmKRNos,13035
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_backtick_var.toml,sha256=b7D2J8AOpj8z8qdoqzJjyl1-_xkMU7FfFU_tiYutz38,14245
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_char_arrays.toml,sha256=2kx64gA_9UHsEi7x0ScJssNZMFfIDTJnSf1fD2b3FeI,15666
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_concat_dynamic.toml,sha256=G2Wy48XXfA-raJiiyVfSOVB5f5_pys4aFwip5Ajacqs,16473
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_high_number_proportion.toml,sha256=9COS8AMGi5F7ywD0pqR4qy8sOruKYMZ_N8BkJU3muVs,11051
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_iex_env_vars_reconstruction.toml,sha256=rsrZm48ilfYoYCavG35o5X0z3V-TnkbeCRlypaBNFk0,12352
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_iex_string_reconstruction.toml,sha256=h43wSU5ceFxRer6HNZGdyBOuQwzjeNZGCN7k4nESp1o,12308
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_index_reversal.toml,sha256=I2x2Bp9vlu3aBqWSJ355AiFnv57GqJkIT7lamWkGdqo,11178
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_reverse_keyword.toml,sha256=UGPXBkMhZCEJKVL_oXvU0RVj-QFQUvqaXS9MQThrcqc,12959
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_string_concat.toml,sha256=jvgMj4mEztGbURXHKoTtW-CL0qDvrrYxm4Jlvj4LN2Q,16403
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_string_format.toml,sha256=UhgXvotX_3EEwXE_U3eSBIwzAoClAb3P76auchRDYdI,13058
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_whitespace_special_proportion.toml,sha256=UzYDTMXkOJPH9QelY03vttc_Mk44VOxH8B1FMYGkJlY,12822
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_process_injection.toml,sha256=0E5ppOahHd-6QjfWL3TNFAmyRTSfQmZvfB-MwgYdoG0,16203
nldcsc_elastic_rules/rules/windows/defense_evasion_powershell_windows_firewall_disabled.toml,sha256=MFuRlXZ9QYTRKe2SzCfiiRg7GPXGY7sLy5Auwaj5LmQ,6692
nldcsc_elastic_rules/rules/windows/defense_evasion_proxy_execution_via_msdt.toml,sha256=VMBcgIoEgdItw3l_-bbRR1Ni1y3iGFrZW-ZoOqg_SUs,15128
nldcsc_elastic_rules/rules/windows/defense_evasion_reg_disable_enableglobalqueryblocklist.toml,sha256=TU6GCB8-47HrnGlWwUx01tH2qP-Awq17YEE_cLFWnyw,7746
nldcsc_elastic_rules/rules/windows/defense_evasion_regmod_remotemonologue.toml,sha256=tiEq2oH3Rpo1pOpTnPvPnwf5CJYchEi1IwZHWaMQ4Og,6523
nldcsc_elastic_rules/rules/windows/defense_evasion_right_to_left_override.toml,sha256=aCab5sBSRV4-C3Kc3fcjeUr_Fi91UOQsMM8Q4_SENKY,7339
nldcsc_elastic_rules/rules/windows/defense_evasion_root_dir_ads_creation.toml,sha256=tYwhlTOlPFJwyfj64awVc3fr9fyCnMVEch_r-KLsF7E,6908
nldcsc_elastic_rules/rules/windows/defense_evasion_run_virt_windowssandbox.toml,sha256=16PyL9XxqBVZC604BdUjCAdwF87bb7LPYsFa-ZsdBhE,7248
nldcsc_elastic_rules/rules/windows/defense_evasion_rundll32_no_arguments.toml,sha256=oXGIG4oKEQPtE_VgzpWQUJilcgHqWFsX_L_vNpUBS6A,11634
nldcsc_elastic_rules/rules/windows/defense_evasion_sc_sdset.toml,sha256=bpI64-SSBmponPUPOmxP4V9FqGBXuJMnMd1blXu5mw8,7599
nldcsc_elastic_rules/rules/windows/defense_evasion_sccm_scnotification_dll.toml,sha256=HJ7vN-LcUrlU-hT9GysS8STrUeTKpN76g-W1wUqX6YE,5712
nldcsc_elastic_rules/rules/windows/defense_evasion_scheduledjobs_at_protocol_enabled.toml,sha256=MU1DlPSJfB_6bDQXmTSoef-r1hnmmzKflEXHAawob38,7126
nldcsc_elastic_rules/rules/windows/defense_evasion_script_via_html_app.toml,sha256=PY-_svf54iUEMs33cumkYuA38QiIo5Y5duipVUzsMXA,15306
nldcsc_elastic_rules/rules/windows/defense_evasion_sdelete_like_filename_rename.toml,sha256=QliO7FMk_-WZjC49JMBCq8c4nvl0CphVuIskY49i90E,5599
nldcsc_elastic_rules/rules/windows/defense_evasion_sip_provider_mod.toml,sha256=Oxh8yg583ZxMh5ZwSAkQ8qVpi5QHGecAxI5y9k-jgys,7320
nldcsc_elastic_rules/rules/windows/defense_evasion_solarwinds_backdoor_service_disabled_via_registry.toml,sha256=C6wplVSHSznYVeUcWn2Mbitf2zXaTKlj9HX01xagWAM,8066
nldcsc_elastic_rules/rules/windows/defense_evasion_suspicious_certutil_commands.toml,sha256=RauCRX0gZCze5-V4xHkTzZnXTV1ESpp_-4Rpq4E5xwc,9159
nldcsc_elastic_rules/rules/windows/defense_evasion_suspicious_execution_from_mounted_device.toml,sha256=EmqwS-vAD5W0pWmIEatRQJq2sEGIZPuKy8QgeN7oZyk,8474
nldcsc_elastic_rules/rules/windows/defense_evasion_suspicious_managedcode_host_process.toml,sha256=lPlCWbYfZ43p_GlcUF3tqKwZDJRdkG5n6Bm5zAJrVxU,15111
nldcsc_elastic_rules/rules/windows/defense_evasion_suspicious_process_access_direct_syscall.toml,sha256=SAPK62CqTE1oAM4hDskXl97RP_YHTJQY5OaXaEAPB60,14713
nldcsc_elastic_rules/rules/windows/defense_evasion_suspicious_process_creation_calltrace.toml,sha256=n1v9XlvUGjyNawXo048RmxwetsWa00PHoTLpNOaxa6Y,5540
nldcsc_elastic_rules/rules/windows/defense_evasion_suspicious_scrobj_load.toml,sha256=u26ysxaLpqaWTB2FNAiBExrU6WDEmmi4T3NbcMQsWys,7200
nldcsc_elastic_rules/rules/windows/defense_evasion_suspicious_short_program_name.toml,sha256=HwxsfjrV-f84NvHWnPDp7320lNWZ848n9xeo9PVDgEM,7265
nldcsc_elastic_rules/rules/windows/defense_evasion_suspicious_wmi_script.toml,sha256=q2e2ayNa5IipGaYCGHdC7lZ8mlJz1V92gET7FBEn6us,7234
nldcsc_elastic_rules/rules/windows/defense_evasion_suspicious_zoom_child_process.toml,sha256=SWPS3HJa-RX1_pqFOC3B7v-MQtb51YpokuewaPYlAi0,8605
nldcsc_elastic_rules/rules/windows/defense_evasion_system_critical_proc_abnormal_file_activity.toml,sha256=JZOJKau5hJPyb1WZf7CC5yT1cZmIRknL3wCPpAQDk1Q,14226
nldcsc_elastic_rules/rules/windows/defense_evasion_timestomp_sysmon.toml,sha256=e1qkfLlXmvUopcOE4Ar4uL0iY398l71eegEvCXim2R4,8902
nldcsc_elastic_rules/rules/windows/defense_evasion_unsigned_dll_loaded_from_suspdir.toml,sha256=iV40Fg2pDJ6Px_D1lrcHUiCKj4f7riB0NzTAIaYzMq0,10181
nldcsc_elastic_rules/rules/windows/defense_evasion_untrusted_driver_loaded.toml,sha256=D7MnlTEPcjUYBsUjrlTEVMSof7yhBThNQvHYaMXG604,12878
nldcsc_elastic_rules/rules/windows/defense_evasion_unusual_ads_file_creation.toml,sha256=oyiLw-O2jZ_PHyBscUd0PnIcs8gNR3JM04gCAvu1_wg,12799
nldcsc_elastic_rules/rules/windows/defense_evasion_unusual_dir_ads.toml,sha256=U47OjCzV3lJFZINTAdkJStXK_zIbCgCcGLdj0YH6rO8,6528
nldcsc_elastic_rules/rules/windows/defense_evasion_unusual_network_connection_via_dllhost.toml,sha256=xgQ7ki7ZeYzf40F7YTOSBSsutWLuCHFUzq-S6sUMZQ4,7109
nldcsc_elastic_rules/rules/windows/defense_evasion_unusual_network_connection_via_rundll32.toml,sha256=JurqHK61bjQEOWNo8iSulqkBdmYWvZhfUxmazSZCTUk,6262
nldcsc_elastic_rules/rules/windows/defense_evasion_unusual_process_network_connection.toml,sha256=hpDWT1_HO7t3ar9bfgxAxcW09tCfjwd6HupSScAFKmA,5834
nldcsc_elastic_rules/rules/windows/defense_evasion_unusual_system_vp_child_program.toml,sha256=lHv9P6f3HPcxBCb_i_NDqR2gliYymqKCVEGzQ717rk8,11340
nldcsc_elastic_rules/rules/windows/defense_evasion_via_filter_manager.toml,sha256=N34BZEFwlwEySBofQbv9uH_kLOcAFhd0Ekp3OlqaGC8,8594
nldcsc_elastic_rules/rules/windows/defense_evasion_wdac_policy_by_unusual_process.toml,sha256=hXfFRRF8SO4uLKY1vNw0xvQ_AGH5QIQKXlFo3ZYF1RM,13874
nldcsc_elastic_rules/rules/windows/defense_evasion_windows_filtering_platform.toml,sha256=ZD--ZnmzzafuMthAbNiE6RXjc5gvOgGo6bxCXi210bw,10870
nldcsc_elastic_rules/rules/windows/defense_evasion_workfolders_control_execution.toml,sha256=GjmGkPCBY1NRVIY0CIObe83m_rCMS4X_-xV-AJSVmTI,6148
nldcsc_elastic_rules/rules/windows/defense_evasion_wsl_bash_exec.toml,sha256=Q58YQqK6P3rpVaUIHBJ0xz6AzNRkzCIPyj7KPW5btks,10444
nldcsc_elastic_rules/rules/windows/defense_evasion_wsl_child_process.toml,sha256=9FhBaUgCDwttUNpMhRqmjCmbI12WoJdx5R8pXkHsAjg,8596
nldcsc_elastic_rules/rules/windows/defense_evasion_wsl_enabled_via_dism.toml,sha256=d-Xsr_O_6DHMQNoKXVsZd2eb3SSUzo38ZDOE8R-9PVc,5634
nldcsc_elastic_rules/rules/windows/defense_evasion_wsl_filesystem.toml,sha256=_-pabU5CNxY7_rYi-d6Ec6ImpA4oBfywKq4AbOPUgoU,6872
nldcsc_elastic_rules/rules/windows/defense_evasion_wsl_kalilinux.toml,sha256=V5TIwlKmTG8kj3X4D-gPlvQ9OkIJqIAs_0s2665T8vw,14323
nldcsc_elastic_rules/rules/windows/defense_evasion_wsl_registry_modification.toml,sha256=0tC7C0_j-nj1wym1GjV2mGnJ-UJBP-wkO6rwZohBuic,6167
nldcsc_elastic_rules/rules/windows/discovery_active_directory_webservice.toml,sha256=Zu2cLnHeEtATN1Hz7bui4j64NWUmOdrOtFCrT6DXnjs,7043
nldcsc_elastic_rules/rules/windows/discovery_ad_explorer_execution.toml,sha256=nZoo1L7iYbiJzLLvyDShZLmNNLaCy5ZuklTSXMKkEuE,5684
nldcsc_elastic_rules/rules/windows/discovery_adfind_command_activity.toml,sha256=dgIpQTHkF4LpVDAw2jyuOug1hP4IfRCkNrePbPqOKjQ,7717
nldcsc_elastic_rules/rules/windows/discovery_admin_recon.toml,sha256=CAqwr_Gp-OSSuP-P1wfPUha-8HOwnks18uh4OJeE-mU,5990
nldcsc_elastic_rules/rules/windows/discovery_command_system_account.toml,sha256=pmdC6aFeXKg1wWeFZ4trpQYi8g_u6uclvB3gkdRA9_4,6555
nldcsc_elastic_rules/rules/windows/discovery_enumerating_domain_trusts_via_dsquery.toml,sha256=mmx1qCk0oK-myuCJiElY7Ke7jQY58W476E-Q-MUYS7Q,5539
nldcsc_elastic_rules/rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml,sha256=eaKM2gJXoIs8WvDvIt9wNII5qls322kFM4m5A9YZaO8,5820
nldcsc_elastic_rules/rules/windows/discovery_group_policy_object_discovery.toml,sha256=YcZ_-ihalsBhSe0u7-c_JU-Elue71pKf-MhOmb1yZng,5975
nldcsc_elastic_rules/rules/windows/discovery_high_number_ad_properties.toml,sha256=DwzqazHCFRftckNnGw5y7TOtIxGZoZ1YgFnMpEl8Tlw,6231
nldcsc_elastic_rules/rules/windows/discovery_host_public_ip_address_lookup.toml,sha256=rPyOM0rKBo8dExn_MWgxlQF7Djh4cSucGsZkjC3RLOE,15502
nldcsc_elastic_rules/rules/windows/discovery_newly_seen_abused_scanners.toml,sha256=A0FCN924JpvbwzKScifq-n-HVvexrD5Ij4k1M-xDYTo,7595
nldcsc_elastic_rules/rules/windows/discovery_peripheral_device.toml,sha256=uRyBVXv9hEZ0zJwYmuGcst6fBIIZVCoH83Aki8U0_SQ,5153
nldcsc_elastic_rules/rules/windows/discovery_posh_invoke_sharefinder.toml,sha256=L4o9QZv_x_TO6OaVwIBX08D8jQhyDgphrHf5hfiYSsU,13733
nldcsc_elastic_rules/rules/windows/discovery_posh_suspicious_api_functions.toml,sha256=07zLN2n4TSEhHqN6dE1KIr6bGfo0O7Amu05UH31t4_c,14667
nldcsc_elastic_rules/rules/windows/discovery_privileged_localgroup_membership.toml,sha256=1u4R3NvNB53TgUUJjJqMUEAzBvD2KvM2IlXy7Y8-Ai8,10244
nldcsc_elastic_rules/rules/windows/discovery_signal_unusual_discovery_signal_proc_executable.toml,sha256=LjaxO6-mzTvtUyhBlZL40pC8-PdyHWuRAkfMeLRBuu0,5386
nldcsc_elastic_rules/rules/windows/discovery_whoami_command_activity.toml,sha256=HnXooUghYh7oBwDPd3R1QrhI4M7TJz3WQn945psBpkg,6330
nldcsc_elastic_rules/rules/windows/execution_apt_solarwinds_backdoor_child_cmd_powershell.toml,sha256=bsN5qQyn6_fuA9Es9eWzsw3snWVAkyBi79habKYuz58,8326
nldcsc_elastic_rules/rules/windows/execution_apt_solarwinds_backdoor_unusual_child_processes.toml,sha256=VSYwfnjue8w_DOmMSwR8w5HxZ-NBvFFl_yGFOryQwfc,7673
nldcsc_elastic_rules/rules/windows/execution_azure_customscript_extension_suspicious_descendant.toml,sha256=mWVHTwFwA3uahe9fFySeojJLRtZm2dHnyim4i4dCGCo,7567
nldcsc_elastic_rules/rules/windows/execution_com_object_xwizard.toml,sha256=VATOPKllwkC_RobNY6l4hJsHhk0RCyrORQbnM4cy0rQ,7881
nldcsc_elastic_rules/rules/windows/execution_command_prompt_connecting_to_the_internet.toml,sha256=q94P4kRde_PsSPONZ2TDzves_T0cM3Kd3nzaFWBE0_U,10658
nldcsc_elastic_rules/rules/windows/execution_command_shell_started_by_svchost.toml,sha256=R_dMbR-E__s6AuqX94fR8VUvyY8Ofpy5mmTKhK7fwas,8588
nldcsc_elastic_rules/rules/windows/execution_command_shell_started_by_unusual_process.toml,sha256=-_L-k2M7P_6YJoC0fL9iQa2QL8k6DGFzutD3jK4cJqs,7340
nldcsc_elastic_rules/rules/windows/execution_command_shell_via_rundll32.toml,sha256=xxH4M33VUC593zPiw6gJ5kFv7uSIVFr3wBA75dPkJzY,7357
nldcsc_elastic_rules/rules/windows/execution_delayed_via_ping_lolbas_unsigned.toml,sha256=NY0oBGk_PQqZFTE-_DrSBuzvsrwEXw-5cPVUVqSH3jQ,10015
nldcsc_elastic_rules/rules/windows/execution_downloaded_shortcut_files.toml,sha256=YRBIOwF0Br-ywhk3fyBrxj5YChbApfN5_bneshz9t_0,6012
nldcsc_elastic_rules/rules/windows/execution_downloaded_url_file.toml,sha256=pRM7OJ-h2RXg4RC1XsAS8gE5SX7l_lKVyXZSB95NjD8,6063
nldcsc_elastic_rules/rules/windows/execution_enumeration_via_wmiprvse.toml,sha256=Kp3PZ9ijwa3U36EZKP9bRu4cXTG6MGKBiZ8pZPJUoXg,9043
nldcsc_elastic_rules/rules/windows/execution_from_unusual_path_cmdline.toml,sha256=YblmE0kBjdr6GqJiL6UjOe_DERGWXQ-pjH08aAggHp8,14118
nldcsc_elastic_rules/rules/windows/execution_html_help_executable_program_connecting_to_the_internet.toml,sha256=zg1e8sNDEDNRYOaTSmNM0jQwMfVezrZTRAzk2-eFczM,9927
nldcsc_elastic_rules/rules/windows/execution_initial_access_foxmail_exploit.toml,sha256=MRRrJX6rxQnoYm9yc6Iolcq9yhLLvDWZM3J8EHgWn_c,13889
nldcsc_elastic_rules/rules/windows/execution_initial_access_via_msc_file.toml,sha256=wApAcUNSrFZhZ8Fd_xC4YeFeIYrL0O-VBDW5BC-coHk,14490
nldcsc_elastic_rules/rules/windows/execution_initial_access_wps_dll_exploit.toml,sha256=00Dr4RqfpV3YVMFTgYCZii7wrXRVnZS1Vg-R0PDQh4E,12828
nldcsc_elastic_rules/rules/windows/execution_java_dropped_jar_immediate_dns_lookup.toml,sha256=4S3tluhZiALl4n6VtN_2leXL6eawuRsjOL31tiw-HMs,5063
nldcsc_elastic_rules/rules/windows/execution_mofcomp.toml,sha256=rsW4bxPJNtMRTpPTipmQEZguksOCW9tnLsGqf6ZAnSU,7225
nldcsc_elastic_rules/rules/windows/execution_ms_office_written_file.toml,sha256=DKFVxirG-tbSHx2vOXcVfI-RxSO7HiBeUmeghbGPr2o,12481
nldcsc_elastic_rules/rules/windows/execution_nodejs_susp_patterns.toml,sha256=hBlpurH3i9mUKyxtgze-V2WTBEkuHyA2vP7jajC4pEA,14018
nldcsc_elastic_rules/rules/windows/execution_notepad_markdown_child_process.toml,sha256=y5RgAeRUF2vGv6G3qvWm7paVZMR-VSc85y77QLAx3Ck,13828
nldcsc_elastic_rules/rules/windows/execution_posh_hacktool_authors.toml,sha256=isw1vc0YN-T-pRbz5wxKvz0HkmDF4frQ1CmD-vgf8BA,14743
nldcsc_elastic_rules/rules/windows/execution_posh_hacktool_functions.toml,sha256=HIh7-SyYKR8xO3U2l4vYRRNeu7N2WkJu63VyKTlbjAs,23841
nldcsc_elastic_rules/rules/windows/execution_posh_malicious_script_agg.toml,sha256=WXs-vpqhqTPGmFWKEmnQYRZHN0u2ntzPjx_7doNDjoI,11542
nldcsc_elastic_rules/rules/windows/execution_posh_portable_executable.toml,sha256=TY6hOkw5VhMnzkeAYA-FzqYEdAJ55v60qo-HWnKqJXI,10338
nldcsc_elastic_rules/rules/windows/execution_posh_psreflect.toml,sha256=Tk2TPT1nWcvlMIjVcQ3FBw82ecYjQ2leYlzhqNgGj_Q,14074
nldcsc_elastic_rules/rules/windows/execution_powershell_susp_args_via_winscript.toml,sha256=JxLCs68ys5DDvyE1dDg9FArqg9SYKb8oHWbdPnkYheI,16337
nldcsc_elastic_rules/rules/windows/execution_psexec_lateral_movement_command.toml,sha256=3Nz7cTWN9rKLlEO1hys0LEwHf8sly_LfuUsmef4uMDE,6511
nldcsc_elastic_rules/rules/windows/execution_register_server_program_connecting_to_the_internet.toml,sha256=7lRwZk91DjWUVenuWX1Ce4IxOLVWZD0tXpVlnHs2FYM,9243
nldcsc_elastic_rules/rules/windows/execution_revshell_cmd_via_netcat.toml,sha256=ApiMgxpNoFwUE4IXFimDuhdwcfr1uYFceMDIuR-1Y5E,11593
nldcsc_elastic_rules/rules/windows/execution_scheduled_task_powershell_source.toml,sha256=OyXcLoplXiI7XMR4MNyfKY6JJv7IozezgnO5YPFEqUg,7479
nldcsc_elastic_rules/rules/windows/execution_scripting_remote_webdav.toml,sha256=4O_HmWXwe_dbhEjhLCPb2PtsUbWGRIsxmHmkoxJlbEQ,15286
nldcsc_elastic_rules/rules/windows/execution_scripts_archive_file.toml,sha256=BPCSWHdr768kh9UYtJdj_545LaltP9cyLFvsQJX9RbQ,7841
nldcsc_elastic_rules/rules/windows/execution_shared_modules_local_sxs_dll.toml,sha256=yfP4nFXk2-LzK7GKzCmuiuBeMYj29tsFqIGg4O5FraE,3419
nldcsc_elastic_rules/rules/windows/execution_susp_javascript_via_deno.toml,sha256=dA-ZwH0Ti-4zx3ykRwvSIzRWUO1fiA_BtVfj6lbm-hA,14407
nldcsc_elastic_rules/rules/windows/execution_suspicious_cmd_wmi.toml,sha256=AFWQi97K46TlNwKNC-agIGlEgEdsWk9xHlQnV__zAq8,12978
nldcsc_elastic_rules/rules/windows/execution_suspicious_image_load_wmi_ms_office.toml,sha256=CWAi5yTwPCDJ1a-Ax-mGA5kLML9yy-CoLMtE4cUI7V4,6324
nldcsc_elastic_rules/rules/windows/execution_suspicious_pdf_reader.toml,sha256=560GkhmxTNHT4uBVp1e2_hCugmc5qTqO1jTulWX7UTI,9860
nldcsc_elastic_rules/rules/windows/execution_suspicious_powershell_imgload.toml,sha256=5UQ5DCsccHqUDtucEa4wDw7Lf5wYGQMGI7wDS-Dtw8g,7218
nldcsc_elastic_rules/rules/windows/execution_suspicious_psexesvc.toml,sha256=rdMAFK8GwdSg4tew0CkawTDgiSLjdWh1ixx3Z-Shn04,6044
nldcsc_elastic_rules/rules/windows/execution_via_compiled_html_file.toml,sha256=xnIfjIUsGP2Vu6UunBwISAczUZlw_hTWfGn0eSak8z4,9989
nldcsc_elastic_rules/rules/windows/execution_via_hidden_shell_conhost.toml,sha256=Xm07KcFb3YYw5w0KpjK99sdzWu18C5Ekq7sw35wbfbk,16307
nldcsc_elastic_rules/rules/windows/execution_via_mmc_console_file_unusual_path.toml,sha256=caQFoPWTttxRmdZvWncFNTW_mP32wZFt305dVt91xCw,8247
nldcsc_elastic_rules/rules/windows/execution_windows_cmd_shell_susp_args.toml,sha256=NL2xjk9ZLo_bVpiyQXtXHs-TV2RraajIxrW8Mc3aPNQ,19054
nldcsc_elastic_rules/rules/windows/execution_windows_fakecaptcha_cmd_ps.toml,sha256=FbXN8V62K8USdIPj-4nfQeIDpyIQHoHk9OXcbJFz9p0,15407
nldcsc_elastic_rules/rules/windows/execution_windows_phish_clickfix.toml,sha256=9PG-bBWhHSZqL78vYITkyHhBWmFOf5YWXqMfXyxfZiQ,16031
nldcsc_elastic_rules/rules/windows/execution_windows_powershell_susp_args.toml,sha256=qo05UpappR3xw11NSKRTr0psvT8D1e9We_KkQGUNDl8,11226
nldcsc_elastic_rules/rules/windows/execution_windows_script_from_internet.toml,sha256=YlJLvHzVm4iwBTmSTprjE4CJZhoP3bpVRz8t6KD4Xcw,8590
nldcsc_elastic_rules/rules/windows/exfiltration_azcopy_storageexplorer.toml,sha256=nIrg3OgQ3U14EVE0VREVVEC8VqANvqvApkLMw7aLjWg,8581
nldcsc_elastic_rules/rules/windows/exfiltration_excessive_dns_queries_by_process.toml,sha256=5_fVqJXuRA3bBZEioNcCISuQHnqzYcedkwNuCJU_BXs,6066
nldcsc_elastic_rules/rules/windows/exfiltration_rclone_cloud_upload.toml,sha256=nNLcr8Vz34dmiAs5wMSVE_h2juOB0ISOExkdAiq65eo,5681
nldcsc_elastic_rules/rules/windows/exfiltration_smb_rare_destination.toml,sha256=KWRbW3-cyBjiv6cNSI8vumQn23lmiBWN8xJw89ZVFXg,7522
nldcsc_elastic_rules/rules/windows/impact_backup_file_deletion.toml,sha256=JA4MycghCJ1uYbJRMahq7AK3fYtLyqNFWuswpQZrMzk,6196
nldcsc_elastic_rules/rules/windows/impact_deleting_backup_catalogs_with_wbadmin.toml,sha256=ksF-u5YdbNxQFRvpkoJL4zL0GkKXle1-Gq7bpAcLZCA,5677
nldcsc_elastic_rules/rules/windows/impact_high_freq_file_renames_by_kernel.toml,sha256=9G60lgE-9VN5RcPPwnfQS8mwa-gLja5h6EX6OpRyuQE,5767
nldcsc_elastic_rules/rules/windows/impact_mod_critical_os_files.toml,sha256=4RllEVvFw3e9_HFLNs_499Qu9uKrCISHzUnzdg6aYZo,13838
nldcsc_elastic_rules/rules/windows/impact_modification_of_boot_config.toml,sha256=F-2gMookfI6uFr1VQOF04JgQX-ylQ0_4_EsRzJptGVM,5475
nldcsc_elastic_rules/rules/windows/impact_ransomware_file_rename_smb.toml,sha256=2qMDdA4ygihOb__CqSGXU01_YIl2HKEx81kHOVt7j_c,10361
nldcsc_elastic_rules/rules/windows/impact_ransomware_note_file_over_smb.toml,sha256=lV1CgZ_TU7GskNvgDQ4slA--h98QeJvZMDLUJcVRmB4,11915
nldcsc_elastic_rules/rules/windows/impact_stop_process_service_threshold.toml,sha256=_SlAsEGeri9wKeYm_y7IIRqCO4QqgFXl7bnzFAlYcuI,5352
nldcsc_elastic_rules/rules/windows/impact_volume_shadow_copy_deletion_or_resized_via_vssadmin.toml,sha256=Mb9zWs1mORDBqJiQkRXOO1p7c5hnYSuat71qGC4ukKk,12114
nldcsc_elastic_rules/rules/windows/impact_volume_shadow_copy_deletion_via_powershell.toml,sha256=J_FNjxNm9vHCLi-Vpr1FYN1l7dxf759010UmQoJdTGM,14880
nldcsc_elastic_rules/rules/windows/impact_volume_shadow_copy_deletion_via_wmic.toml,sha256=obWYRzEsilHpJ0O2uFQ0QyRPiwzte720xuO3Py6XQng,10742
nldcsc_elastic_rules/rules/windows/initial_access_evasion_suspicious_htm_file_creation.toml,sha256=E2SpvOePGdbZlQJQyghS4yHZLY6MUAR9bAk0ywm6rio,8908
nldcsc_elastic_rules/rules/windows/initial_access_execution_from_inetcache.toml,sha256=qVMOI5VfpaS2JFKPTQxhM75BItaQKSzP1FCgE9HtMwM,16150
nldcsc_elastic_rules/rules/windows/initial_access_execution_from_removable_media.toml,sha256=aKbxCXn-3npUhL7yvKWE26Ihhq4W_Z7iqTq_Ykt3v2Y,6299
nldcsc_elastic_rules/rules/windows/initial_access_execution_remote_via_msiexec.toml,sha256=qHqGJX-cjeT3nfMNSO-13jNyfp2-nPt41T5gEC7b454,9151
nldcsc_elastic_rules/rules/windows/initial_access_execution_via_office_addins.toml,sha256=3K0Wq5t4ujYnOq7FgRjT5JA_jRxtPTs_vrYpZMCrjj8,9685
nldcsc_elastic_rules/rules/windows/initial_access_exfiltration_first_time_seen_usb.toml,sha256=IwWGA3PNAJJG9OpWPS3hl3zpVE0RMNzil5v0G2edYUI,6871
nldcsc_elastic_rules/rules/windows/initial_access_exploit_jetbrains_teamcity.toml,sha256=LipPLozM-MxoJYW2ORPL8P1TJDKZMNNPVQG3beXrzGU,11483
nldcsc_elastic_rules/rules/windows/initial_access_mssql_potential_sql_injection.toml,sha256=_xW1asCWTXoXrVijtCEB1ianux733VWM3brrtE_NsgQ,5740
nldcsc_elastic_rules/rules/windows/initial_access_papercut_suspicious_child_process.toml,sha256=U-5XQfH2YUFf6FDKVmE9hyII_jhxuK3tLHaX3Ng_VCY,8442
nldcsc_elastic_rules/rules/windows/initial_access_potential_webhelpdesk_exploit.toml,sha256=kvjrpYi0t5EGEevAK9SmYcpPE0b34fereYqBRVxGw0Q,13688
nldcsc_elastic_rules/rules/windows/initial_access_rdp_file_mail_attachment.toml,sha256=miBsjfL4aRe9jBWOnHE4p-Q4cUV184OpjgbopobGDs4,7998
nldcsc_elastic_rules/rules/windows/initial_access_script_executing_powershell.toml,sha256=iYOdjS-PFWbu22WfXDr0FRfOtabI6dSQ8mRDS-0bveg,7051
nldcsc_elastic_rules/rules/windows/initial_access_scripts_process_started_via_wmi.toml,sha256=KJ6FuJJD1bmBpXzQEscAfU-xJDoMc4Pd8ERo57kGdqM,8183
nldcsc_elastic_rules/rules/windows/initial_access_suspicious_execution_from_vscode_extension.toml,sha256=XY4v_ljhaXo3cApD8VaSsNoPJWHl1JJvOLwYtyyHb_w,7033
nldcsc_elastic_rules/rules/windows/initial_access_suspicious_ms_exchange_files.toml,sha256=LWIEA3YR4NC8mgoVdS18KJ0QxqMMkx4NHHVPCMiR-kc,5175
nldcsc_elastic_rules/rules/windows/initial_access_suspicious_ms_exchange_process.toml,sha256=Rh-JDZ_HeW9b1_DOK_k78jeOO78VdxFN8qtmq22L47w,9140
nldcsc_elastic_rules/rules/windows/initial_access_suspicious_ms_exchange_worker_child_process.toml,sha256=tLELviuHNSdDg5Q-akYXeOyuXWTbfU0V0K5aWrbldIQ,14799
nldcsc_elastic_rules/rules/windows/initial_access_suspicious_ms_office_child_process.toml,sha256=XNGS3w9h2IoThZPpeBiPPG0Fvil0rnUTPOmZQ0kHERo,11026
nldcsc_elastic_rules/rules/windows/initial_access_suspicious_ms_outlook_child_process.toml,sha256=XbiNmwlvBsyVNwydIlegWR98vxKcWBLyTqBz8DOt1hk,9121
nldcsc_elastic_rules/rules/windows/initial_access_suspicious_windows_server_update_svc.toml,sha256=SJ-uKtj69mqz_rQ-BLLMBPxleBTOPpANI8MBcGWF364,14449
nldcsc_elastic_rules/rules/windows/initial_access_url_cve_2025_33053.toml,sha256=S8I0EdxuMwA0fR1To0-pSZ0bZluhc5i0Bz8NyO1N6c4,16164
nldcsc_elastic_rules/rules/windows/initial_access_via_explorer_suspicious_child_parent_args.toml,sha256=IM1EmZJy1WV2mQPpu881ZyubcQdgaUl-JVMbu1rUxko,9428
nldcsc_elastic_rules/rules/windows/initial_access_webshell_screenconnect_server.toml,sha256=f-j_t82CKJbVTpKaiWKUsFzXp_YUQkCFz-s5wM3iSMg,15055
nldcsc_elastic_rules/rules/windows/initial_access_xsl_script_execution_via_com.toml,sha256=63A25La0S2O3hh3XqSGpdWmSM1jbHon2eTUAgqBFIdA,7763
nldcsc_elastic_rules/rules/windows/lateral_movement_alternate_creds_pth.toml,sha256=TTYzNLM6XetrCVgIyP_kphVxhSwl49OS8j-cdGWYlYQ,6200
nldcsc_elastic_rules/rules/windows/lateral_movement_cmd_service.toml,sha256=grysSrekC_QDpWr7Igl8IZ_TwAAAI1HCABGPXBu_V2M,7329
nldcsc_elastic_rules/rules/windows/lateral_movement_credential_access_kerberos_correlation.toml,sha256=PnPz-eLKCQ7X_Dyt8J5Njk0c9fOw10adW0Vs8co3ZqE,13531
nldcsc_elastic_rules/rules/windows/lateral_movement_dcom_hta.toml,sha256=Rzaum6F5j3uD7LJHCmQpdmQHRdgKvmNMm2Rq8Qmi0f0,14347
nldcsc_elastic_rules/rules/windows/lateral_movement_dcom_mmc20.toml,sha256=Txtbk57VSfu_GpNEbMiXzoCY6xHa7dS-ZIonUay6RvI,13248
nldcsc_elastic_rules/rules/windows/lateral_movement_dcom_shellwindow_shellbrowserwindow.toml,sha256=1WoTLKzzGYCUwt946XjywvZomk3k4Msn6X01zZleIoA,7435
nldcsc_elastic_rules/rules/windows/lateral_movement_defense_evasion_lanman_nullsessionpipe_modification.toml,sha256=lEzazRuR-tpY2WSBBDqjRQ0fSUxO4ISrbewqS7atsVM,7481
nldcsc_elastic_rules/rules/windows/lateral_movement_direct_outbound_smb_connection.toml,sha256=HCOPE5orTu50IxUALyuHbvpn-HIvBRqd3Fkqa-lQ6BM,8821
nldcsc_elastic_rules/rules/windows/lateral_movement_evasion_rdp_shadowing.toml,sha256=H_vZRFPvq8kZCU-Xs19DFn-YJVnV_74WKpC4V2C2V7k,14415
nldcsc_elastic_rules/rules/windows/lateral_movement_executable_tool_transfer_smb.toml,sha256=3NrsirzU7oD6E16kh5p8B82Ww73Zz-zSjz0l2JjVhes,5843
nldcsc_elastic_rules/rules/windows/lateral_movement_execution_from_tsclient_mup.toml,sha256=3f64W7-aheia3SDXniGneoP34EuWzHvEMFiucWF7k8g,11860
nldcsc_elastic_rules/rules/windows/lateral_movement_execution_via_file_shares_sequence.toml,sha256=JggSgnURmYoZd0W8PoM0oFm1L1dS9vTS9OUZYPmrzwA,8276
nldcsc_elastic_rules/rules/windows/lateral_movement_incoming_winrm_shell_execution.toml,sha256=8_SkiYulZPlwUinHC-VdHl8beFHz5uYqKWl4pSKA_pg,6901
nldcsc_elastic_rules/rules/windows/lateral_movement_incoming_wmi.toml,sha256=qqkDte_JWEv9CwyjudTGyDqahvOe1APxy_5uC7Lo1M8,7851
nldcsc_elastic_rules/rules/windows/lateral_movement_mount_hidden_or_webdav_share_net.toml,sha256=D0ndMu1rSOVVTTTY8sk8UyWre3xNiWF4scoTkQCh6gM,7934
nldcsc_elastic_rules/rules/windows/lateral_movement_powershell_remoting_target.toml,sha256=6_eBp_L_CN2EALgsis22bRq953wgfLaj4olpCBxGPnU,7515
nldcsc_elastic_rules/rules/windows/lateral_movement_rdp_enabled_registry.toml,sha256=HXmF2-w3eTU0Jspp9bqUWUSoC-6a-PSbvFzCOKX5fY8,6354
nldcsc_elastic_rules/rules/windows/lateral_movement_rdp_sharprdp_target.toml,sha256=R9tUXTDI_WJ23qJ4g8e2ZD9Ubv7PNP8tgA_TTTYHbvE,11348
nldcsc_elastic_rules/rules/windows/lateral_movement_remote_file_copy_hidden_share.toml,sha256=1CLT_NyY1I4mo0XM6bhRLVAkzZjYrh6sNjWVMDdHFpM,7400
nldcsc_elastic_rules/rules/windows/lateral_movement_remote_service_installed_winlog.toml,sha256=7eoe7ctopFt8_yUnIw-7Lrkfmd-tcmcB6K_pVbTw9is,8563
nldcsc_elastic_rules/rules/windows/lateral_movement_remote_services.toml,sha256=M6MKuDXsCoPipS3DUm_bWmiCWxefWUP38gdBgf8ltuw,10716
nldcsc_elastic_rules/rules/windows/lateral_movement_remote_task_creation_winlog.toml,sha256=jNWEASbAuRr21I9DeDIEhwlIqE2svf3_DrVYkdUHOBM,4345
nldcsc_elastic_rules/rules/windows/lateral_movement_scheduled_task_target.toml,sha256=q0QtsWxPWmZffZc-zGONU2SBHMieJriGGhH4M0nqtH4,5525
nldcsc_elastic_rules/rules/windows/lateral_movement_suspicious_rdp_client_imageload.toml,sha256=B9_suRsj10WBhUy5O0kaJWBcMpjsIzo76mpx_TJtH6w,6798
nldcsc_elastic_rules/rules/windows/lateral_movement_unusual_dns_service_children.toml,sha256=zRBn19ErqcB9vk3HWgf-EtkngL6hlu3ZF4ndLnvw5sQ,14075
nldcsc_elastic_rules/rules/windows/lateral_movement_unusual_dns_service_file_writes.toml,sha256=g7RJ5qL0qyaVy6YqxYVM_2IuEJUs-QRVlqhW84bdbSI,6846
nldcsc_elastic_rules/rules/windows/lateral_movement_via_startup_folder_rdp_smb.toml,sha256=MboqRLMMhDYKCf1cOVcms3caWBw7I7Xt9xnzpcFK9yA,12689
nldcsc_elastic_rules/rules/windows/lateral_movement_via_wsus_update.toml,sha256=dCjcT2zwpa13NJ44s5msBzfcJEdJbTwM5y3Z_vh6SqY,7310
nldcsc_elastic_rules/rules/windows/persistence_ad_adminsdholder.toml,sha256=4RGF4uTzvEkPJQQ-RNmFZOs3IbTIrv1l7XAoJZvC-JA,13792
nldcsc_elastic_rules/rules/windows/persistence_app_compat_shim.toml,sha256=s6nZ7-QdMtTzX3-ctSW2Ga06JDnig7H-ShtCdxRQTzs,7754
nldcsc_elastic_rules/rules/windows/persistence_appcertdlls_registry.toml,sha256=slnBrtzyLBieU06jxS9mmBRkD4T2zr-7PMt0dHcfJBc,7732
nldcsc_elastic_rules/rules/windows/persistence_appinitdlls_registry.toml,sha256=vrruZjOvdPsRo_A9bCv3XcwPcns2OQ7ZIw_crNSuX04,10257
nldcsc_elastic_rules/rules/windows/persistence_browser_extension_install.toml,sha256=WO0VgsXzdyiSkaBSB5Ly1t0yqus0s4OUs56ebJgJd_A,7498
nldcsc_elastic_rules/rules/windows/persistence_dontexpirepasswd_account.toml,sha256=-U0NXXbEt7z5IEQVo6IX_3_FMbJ4_xmN1wv2Xya3z48,5462
nldcsc_elastic_rules/rules/windows/persistence_evasion_hidden_local_account_creation.toml,sha256=a3cL5hWUZ5z3jpFc0jo72muUK5wvhylti9ssKkg1CZ0,12931
nldcsc_elastic_rules/rules/windows/persistence_evasion_registry_ifeo_injection.toml,sha256=Wy-FlVKR0YGhhuHldWBH9wDUKQ7z0N7Xh2iHejWFrRo,8470
nldcsc_elastic_rules/rules/windows/persistence_evasion_registry_startup_shell_folder_modified.toml,sha256=IJzcRFea74r7h4aeKZvWuvyd8DdTIU1x3dUT2SFriLg,14365
nldcsc_elastic_rules/rules/windows/persistence_group_modification_by_system.toml,sha256=u4UE4Vl6ncbKg_8FfRReVVeoh6r4ae-A5Zqc9kmPLfs,5934
nldcsc_elastic_rules/rules/windows/persistence_local_scheduled_job_creation.toml,sha256=XADEyee0jy_52-9Xkk8lQk0pV9Z9BMDauYD2jnx7WlM,7496
nldcsc_elastic_rules/rules/windows/persistence_local_scheduled_task_creation.toml,sha256=xReUWfFFjRHuaKjjcVhfhEXjxo8siQrNji_os-DFFvc,8631
nldcsc_elastic_rules/rules/windows/persistence_local_scheduled_task_scripting.toml,sha256=0TBEKPtgN3vu4Uq3JkxmAEzJLdgiiT8QcPFRv2KO-Xc,3627
nldcsc_elastic_rules/rules/windows/persistence_ms_office_addins_file.toml,sha256=wz5IA62DToEB7VDkeSaEPWB4GBXEdYgD9BcG7o9k0zk,13774
nldcsc_elastic_rules/rules/windows/persistence_ms_outlook_vba_template.toml,sha256=1ZA0X2_BCbl68FcmUTEoWS4PqSubY5lazIDT3MM6erQ,6948
nldcsc_elastic_rules/rules/windows/persistence_msds_alloweddelegateto_krbtgt.toml,sha256=LAMUtgTQCKyPMp4B0kde3wKkphA0LS0kfElnFKIsSfc,13639
nldcsc_elastic_rules/rules/windows/persistence_msi_installer_task_startup.toml,sha256=UiTN9RxtMbF-D-h31MxTc3NbNg0I6v1EHLrDjKu2EK8,10013
nldcsc_elastic_rules/rules/windows/persistence_msoffice_startup_registry.toml,sha256=Y4izqSNgysDXeZ6mYTwKMBgAN165MzypkiBVj-xfhXc,6836
nldcsc_elastic_rules/rules/windows/persistence_netsh_helper_dll.toml,sha256=vfNjFBsAicfqqwHNBReQVFJYW-MZ1lI6NylBRUkej9U,6660
nldcsc_elastic_rules/rules/windows/persistence_powershell_exch_mailbox_activesync_add_device.toml,sha256=m8FQzRPmBLon2u2hM2yc0PTs-5ZKB6p5aeeho7_3CHg,8148
nldcsc_elastic_rules/rules/windows/persistence_powershell_profiles.toml,sha256=WuAbTYd4s37C_PX_-mZqQx98i3jJsplLnolEpZfOIrk,9830
nldcsc_elastic_rules/rules/windows/persistence_priv_escalation_via_accessibility_features.toml,sha256=v5Eih2bs8RJuWCd5uINM90Xm4MaP-6jN_hdcRkNvOKQ,12531
nldcsc_elastic_rules/rules/windows/persistence_registry_uncommon.toml,sha256=KNLDhql39DeCjIf4bkW_IPb4a1Pn2gAfSX5DjHyh8cg,13328
nldcsc_elastic_rules/rules/windows/persistence_remote_password_reset.toml,sha256=jnv89BXHpTgGUSR9yJTqs6IKk3mdvQtKtQhjDl0XLNg,7025
nldcsc_elastic_rules/rules/windows/persistence_run_key_and_startup_broad.toml,sha256=yjh8kvoip6YQHoaq0qGX_Zp5AbEfgSatCBPb4Pk4Gok,11489
nldcsc_elastic_rules/rules/windows/persistence_runtime_run_key_startup_susp_procs.toml,sha256=kEJgB_2GqIYanhlaaKwkjlMpM2VYir0JBpJfMSKKxb8,9130
nldcsc_elastic_rules/rules/windows/persistence_scheduled_task_creation_winlog.toml,sha256=3TS56W2Li7nfLwIow3_U5-fvATNTl4IQmmLLLR2az98,6560
nldcsc_elastic_rules/rules/windows/persistence_scheduled_task_updated.toml,sha256=d0WwS6wKXSFSoASX_Gc0XPQEuUg-Xh9fhp3eTI6kBa0,5722
nldcsc_elastic_rules/rules/windows/persistence_sdprop_exclusion_dsheuristics.toml,sha256=nOzAznvvK2KmdnMz6c_h4hiNN9TwoiNwjbA95j1uidU,13776
nldcsc_elastic_rules/rules/windows/persistence_service_dll_unsigned.toml,sha256=xZSWOR_wGaumCka8UDy4EmsuaL29euQuSVf4J9k61rg,10924
nldcsc_elastic_rules/rules/windows/persistence_service_windows_service_winlog.toml,sha256=t6cBPNsjlG0ol9VENbr3S0zHaSYKfeOpiO8mWuZopnA,15074
nldcsc_elastic_rules/rules/windows/persistence_services_registry.toml,sha256=TLshabu4jyn70Ru-JKihdVeJYCl6SXglxestNVYnMRE,8865
nldcsc_elastic_rules/rules/windows/persistence_startup_folder_file_written_by_suspicious_process.toml,sha256=GyILCrE5wstfhJLvEN57GtHudp4p7BPr1UDFhdI4fhg,8804
nldcsc_elastic_rules/rules/windows/persistence_startup_folder_file_written_by_unsigned_process.toml,sha256=aptpii7aDDaVbZdOXKkY9d_4f41sgIfxuIK5gz5SUqQ,8436
nldcsc_elastic_rules/rules/windows/persistence_startup_folder_scripts.toml,sha256=4QHV7K-tmVi93FMkcavVr9wYue9NWWFikqLoIQoparA,8778
nldcsc_elastic_rules/rules/windows/persistence_suspicious_com_hijack_registry.toml,sha256=3HS97pq1IooqoQnN7ThC1tYq-TtCkjIoR88tXeK2c5c,9907
nldcsc_elastic_rules/rules/windows/persistence_suspicious_image_load_scheduled_task_ms_office.toml,sha256=W2v-uBfrtX8lzKSi6b4hu9wTAz4rJLnJnwpZe9_44F4,9387
nldcsc_elastic_rules/rules/windows/persistence_suspicious_scheduled_task_runtime.toml,sha256=0toEiZxMZww65p2fT87dQ8zzRcsYHyXe4sK2N83dvZY,8884
nldcsc_elastic_rules/rules/windows/persistence_suspicious_service_created_registry.toml,sha256=RpAFqjTBnZ9Yk1hrY9Bfx9iBlwpbJvjy20duVPJLVCQ,13090
nldcsc_elastic_rules/rules/windows/persistence_suspicious_user_mandatory_profile_file.toml,sha256=pK05uIt_o34lz9_UHwkSVKkl4zbb4rxOl4u-DauWVq0,6250
nldcsc_elastic_rules/rules/windows/persistence_sysmon_wmi_event_subscription.toml,sha256=LYAohHhtVXLLKqkSi6rvQkoUrTiz-XPueevaGfUmA-8,6817
nldcsc_elastic_rules/rules/windows/persistence_system_shells_via_services.toml,sha256=1Rwn_THLC2Bv9pBToiELE18MmLh6f0XB0fus7EFFKew,7974
nldcsc_elastic_rules/rules/windows/persistence_temp_scheduled_task.toml,sha256=bV8jMi8Rsf_luCPjkG6nzDRhYLgacI6psQcXyJwZ9g4,6409
nldcsc_elastic_rules/rules/windows/persistence_time_provider_mod.toml,sha256=4JeB1I8vBxFQogCDqkorEo4Z8CMIhk8rkir7Ajz7iIA,8825
nldcsc_elastic_rules/rules/windows/persistence_user_account_added_to_privileged_group_ad.toml,sha256=Ndf-rYZmIV45FCJqLnW9hQpQdrv4FJz-r9ifs9kUAok,4705
nldcsc_elastic_rules/rules/windows/persistence_user_account_creation.toml,sha256=r7bM16SEpjWCGQkeHEumU-ztH21EfuMwuPUjLFxCFBE,4907
nldcsc_elastic_rules/rules/windows/persistence_via_application_shimming.toml,sha256=2ciy6BZoljlyQKXejfXd9ecz6RzbS-pFtcgr-KEaLwk,8141
nldcsc_elastic_rules/rules/windows/persistence_via_bits_job_notify_command.toml,sha256=tdWRs58EcQgZHN3c8CJv-0cI65pbYAAJpzgdFc_Xu9Q,7034
nldcsc_elastic_rules/rules/windows/persistence_via_hidden_run_key_valuename.toml,sha256=EiVpLS6LuXt76XjbB-R76aPQQ0BS73H0CuaIi_Fasfo,14792
nldcsc_elastic_rules/rules/windows/persistence_via_lsa_security_support_provider_registry.toml,sha256=pQiRYg4JptXjKfT-pOcr-F66pf6sC9UGmhFAdgrECDA,7711
nldcsc_elastic_rules/rules/windows/persistence_via_telemetrycontroller_scheduledtask_hijack.toml,sha256=EwpTh2zIbsL1QqkztlWX7GBEmIXySUrMA7UhOCRnsZ4,14675
nldcsc_elastic_rules/rules/windows/persistence_via_update_orchestrator_service_hijack.toml,sha256=PaO4TvquKqd6JIbRLnAocarBGmHS9QGwpT737v67CFU,15633
nldcsc_elastic_rules/rules/windows/persistence_via_windows_management_instrumentation_event_subscription.toml,sha256=HJuQIxmtJ-2CxKKfgOwfdgV7IZjQ3WIGEEp332w7Xpc,7437
nldcsc_elastic_rules/rules/windows/persistence_via_wmi_stdregprov_run_services.toml,sha256=mZ5yoAhfZEe8FUisIambtmBWhvQPwkMUlHsyjx27DxI,17549
nldcsc_elastic_rules/rules/windows/persistence_via_xp_cmdshell_mssql_stored_procedure.toml,sha256=cUDwWDWV7Gy83KOyy-rqrMNfnFA9b0a2m66_cTSaH5E,7927
nldcsc_elastic_rules/rules/windows/persistence_web_shell_aspx_write.toml,sha256=yNGckEqoj-2ByOuboZsrK0eXXkVDwuWqaKAIR9x8odM,8111
nldcsc_elastic_rules/rules/windows/persistence_webshell_detection.toml,sha256=e9XYx-L2VRzDOg38KVI1er3HHN9aaRQunPF1YPGIyx0,18431
nldcsc_elastic_rules/rules/windows/persistence_werfault_reflectdebugger.toml,sha256=5LH9VTKA49BYbJhPtLg8MQfiPLvFkLFhOBsaNCPQsrs,7327
nldcsc_elastic_rules/rules/windows/privilege_escalation_account_takeover_mixed_logon_types.toml,sha256=59EipeUf0uKU0Fev1j0q1hdUP4ooI-oISn92UQ1cAbo,4494
nldcsc_elastic_rules/rules/windows/privilege_escalation_badsuccessor_dmsa_abuse.toml,sha256=x8QjlhmQDqls94iGsWXCau7Co0KGlsJ_nFoy8FFHpvY,13008
nldcsc_elastic_rules/rules/windows/privilege_escalation_create_process_as_different_user.toml,sha256=lLQTOS0oSbwJu6SUcV2_emNhhunm9rhgQ1PMuYMOVuA,6292
nldcsc_elastic_rules/rules/windows/privilege_escalation_create_process_with_token_unpriv.toml,sha256=vF980K_NyAm5kg6lfB7qqBkgCG3B6naI9dU_MN4idkE,8454
nldcsc_elastic_rules/rules/windows/privilege_escalation_credroaming_ldap.toml,sha256=ZxX38ChoWp72IIMeYeiFrpdeNqoQI_clOND_tcVBqUk,6422
nldcsc_elastic_rules/rules/windows/privilege_escalation_disable_uac_registry.toml,sha256=gc9n5UmF5Bt2oiKDZ5pfVSZHXC4sElzYcyAHxeHXRwk,8124
nldcsc_elastic_rules/rules/windows/privilege_escalation_dmsa_creation_by_unusual_user.toml,sha256=NF3JNi2wN_fEg4p_oWqlIw-cDYtpTQdStnz7k6-r4fU,13320
nldcsc_elastic_rules/rules/windows/privilege_escalation_dns_serverlevelplugindll.toml,sha256=BucOufocm2Z_-vGymyfKHAcYoZcT0D-NauXwhmSpENU,7066
nldcsc_elastic_rules/rules/windows/privilege_escalation_driver_newterm_imphash.toml,sha256=rFVgl8j50mk1IkaaBDckFiB_Si39hO6gAeFUmRxdEMs,9109
nldcsc_elastic_rules/rules/windows/privilege_escalation_expired_driver_loaded.toml,sha256=ZRx551lBz0CYrjPbhAQBxhygTQ0IJaeHU0VdYvl57YA,6368
nldcsc_elastic_rules/rules/windows/privilege_escalation_exploit_cve_202238028.toml,sha256=-5gWVUblXyvcw-JTqmXRLGsfrT0CAK7M6dVRb4phC4s,14543
nldcsc_elastic_rules/rules/windows/privilege_escalation_gpo_schtask_service_creation.toml,sha256=Ug313vYL_IiG8yxlQ13yvuRLlh3SLqahmyAgBDpwqPY,7978
nldcsc_elastic_rules/rules/windows/privilege_escalation_group_policy_iniscript.toml,sha256=rlv1vlTpD4JkYL4fgkSeydv7GCeLU6aQwN4bR3VV0J0,5153
nldcsc_elastic_rules/rules/windows/privilege_escalation_group_policy_privileged_groups.toml,sha256=2Tmw6tSZSXXVZE4PDbL9zT4s8ySTU7HGyEKR6tDO8Z4,13308
nldcsc_elastic_rules/rules/windows/privilege_escalation_group_policy_scheduled_task.toml,sha256=EQLdmKMWPdWFqNwyQMUttxGWzhcuLoNBw78L0b7oWdo,5250
nldcsc_elastic_rules/rules/windows/privilege_escalation_installertakeover.toml,sha256=kZNOBT-axnTUPuSfFHGCjSp1lqaDHb0bWhMIrcHX-ww,13665
nldcsc_elastic_rules/rules/windows/privilege_escalation_krbrelayup_service_creation.toml,sha256=fR6EtoTJMm0lhNIgPppZumQl_rIgSQnTcdsiaVdq9Jo,13911
nldcsc_elastic_rules/rules/windows/privilege_escalation_lsa_auth_package.toml,sha256=3VTmzr_1XrTwlFzxsYAkSFVcGeWDphU8khGGS0gq7W0,6737
nldcsc_elastic_rules/rules/windows/privilege_escalation_make_token_local.toml,sha256=K-f3WRkVEDeP5FLdetGzR7IAkrXxCI9W-C4XW0jZFYo,13334
nldcsc_elastic_rules/rules/windows/privilege_escalation_msi_repair_via_mshelp_link.toml,sha256=bmaQkdeGWqUx_0Fzfu1Y9bFr1mTd5dWu9ULHWrrfyCY,13358
nldcsc_elastic_rules/rules/windows/privilege_escalation_named_pipe_impersonation.toml,sha256=K8PK1ndUkVaEfj6k9Dz-68iMoeJj6k8Nw2kGsri3cVE,12252
nldcsc_elastic_rules/rules/windows/privilege_escalation_newcreds_logon_rare_process.toml,sha256=EWnp8mSwpSsMtZyv-qiKHmrl_7enZlLRpoXDQalftl0,5950
nldcsc_elastic_rules/rules/windows/privilege_escalation_persistence_phantom_dll.toml,sha256=QOrM5VO2QM8jprv1JmrqfuX409dXhcmTzh15dAwtV5o,10128
nldcsc_elastic_rules/rules/windows/privilege_escalation_port_monitor_print_processor_abuse.toml,sha256=8FFAuVIG_uhVxj2teXGNl4yEzG0pwppLytG2ef4sf0A,7891
nldcsc_elastic_rules/rules/windows/privilege_escalation_posh_token_impersonation.toml,sha256=tnB09ukR9ySEVG-N4MDOsC8jq39NbM85YE8akZTaPo4,12493
nldcsc_elastic_rules/rules/windows/privilege_escalation_printspooler_registry_copyfiles.toml,sha256=FYTyHW3NnRxqlvTIx3MXhgRpvYwCuXHO9ksPMk9GrHw,11577
nldcsc_elastic_rules/rules/windows/privilege_escalation_printspooler_suspicious_file_deletion.toml,sha256=qHSh5q28z7mLjPUiO_DnQ_028R20ayEAkvlSF-EdzNY,6972
nldcsc_elastic_rules/rules/windows/privilege_escalation_printspooler_suspicious_spl_file.toml,sha256=yr1xQvQXV_abNElHlIAwzsfG8EHSb23AxOl8ZQd80Ew,8570
nldcsc_elastic_rules/rules/windows/privilege_escalation_reg_service_imagepath_mod.toml,sha256=nTZwkzdPf36MhtAECMwc_Jz2T78T2yIcgvx-WUoJrcI,10213
nldcsc_elastic_rules/rules/windows/privilege_escalation_rogue_windir_environment_var.toml,sha256=x-SD7js1B_y4Ikk5cxh25kABxVQIPgQyM_gPlUUcrAA,12886
nldcsc_elastic_rules/rules/windows/privilege_escalation_samaccountname_spoofing_attack.toml,sha256=Xbyx2XPuQvT7Veu3-0KRsUzEDWpuvfbGMBa37kGtwYE,13666
nldcsc_elastic_rules/rules/windows/privilege_escalation_service_control_spawned_script_int.toml,sha256=OJ3ft5bkft3nhAeyYWMiISxl0AhYcnCIDcFIPNy6gGM,9150
nldcsc_elastic_rules/rules/windows/privilege_escalation_suspicious_dnshostname_update.toml,sha256=VzdDiZ6hy8QiYFga60Z_eLpMT5ftd7K-99Xc9iRdpjg,11574
nldcsc_elastic_rules/rules/windows/privilege_escalation_takeover_new_source_ip.toml,sha256=VPZ2NCA9-xZxO7KtSJOiZJGxvvwy7yeNuXVZABWXV9U,4401
nldcsc_elastic_rules/rules/windows/privilege_escalation_thread_cpu_priority_hijack.toml,sha256=YKvazJ76uMwW9XPQGY7Ga_NB-QUDPmj-xKfRMKHT5bE,13326
nldcsc_elastic_rules/rules/windows/privilege_escalation_tokenmanip_sedebugpriv_enabled.toml,sha256=45ALhekePRPlzfzwK1v-VN8NzYQZEx3Nk08E9Y1jgq8,7205
nldcsc_elastic_rules/rules/windows/privilege_escalation_uac_bypass_com_clipup.toml,sha256=m6bFizl_FNIbEo1ubC_ydzUkpMu-ThuBognPxMNgQ5g,12700
nldcsc_elastic_rules/rules/windows/privilege_escalation_uac_bypass_com_ieinstal.toml,sha256=IFWNPSCxY2J5IRJosxSpi4NWk3rj5JSqzrcaBQTjJxQ,8188
nldcsc_elastic_rules/rules/windows/privilege_escalation_uac_bypass_com_interface_icmluautil.toml,sha256=gkgaJ9jKFVVzFShRvwKYfuQtS1Ieqs0KGjcB1p_M0R4,13179
nldcsc_elastic_rules/rules/windows/privilege_escalation_uac_bypass_diskcleanup_hijack.toml,sha256=bV9PF-5f97uYz8kRak-SjGO10cvaF6_NzNrby8hF9AE,8286
nldcsc_elastic_rules/rules/windows/privilege_escalation_uac_bypass_dll_sideloading.toml,sha256=Hl5-McEkftxjs39w3bySZADZJh192gGkPy7p8rtY-GI,7284
nldcsc_elastic_rules/rules/windows/privilege_escalation_uac_bypass_event_viewer.toml,sha256=dfEU1ezwu7QvmMQcvr4Nk-9XYQDHq664w6yujAluGXE,14562
nldcsc_elastic_rules/rules/windows/privilege_escalation_uac_bypass_mock_windir.toml,sha256=c7TV3Jf-87N_mFmdHqr6rYVC-KaORu5iDXfkwgsvKQg,14080
nldcsc_elastic_rules/rules/windows/privilege_escalation_uac_bypass_winfw_mmc_hijack.toml,sha256=80ns87QSeaCcoakJgFopAgkPkCSJUFNLQPMsV_C1wOc,9022
nldcsc_elastic_rules/rules/windows/privilege_escalation_unquoted_service_path.toml,sha256=Ony6_ek1EWjbPZ_Zcs2YM7JVkISTb-caSvVn29Cg2Ok,7235
nldcsc_elastic_rules/rules/windows/privilege_escalation_unusual_parentchild_relationship.toml,sha256=TReKLkMYIHWF1-YhFANTiA2wMo-oKYeW-Gxp9Ejq5bA,11642
nldcsc_elastic_rules/rules/windows/privilege_escalation_unusual_printspooler_childprocess.toml,sha256=xAQG6D1UONI3hremKOQvFzlq_MQjq0KJqal-knhI8XY,9435
nldcsc_elastic_rules/rules/windows/privilege_escalation_unusual_svchost_childproc_childless.toml,sha256=4ernEW8DOSOxPMhYBl-I20oI5A9guq3T6ym4kca6vQc,8542
nldcsc_elastic_rules/rules/windows/privilege_escalation_via_ppid_spoofing.toml,sha256=26pg2-HimtUaaDkRxfHDokuT776Tzm4qP0mgRHZdvLQ,14039
nldcsc_elastic_rules/rules/windows/privilege_escalation_via_rogue_named_pipe.toml,sha256=NzdzRjoVWY_hKdOxM2ptoBSDikSORUfknI-Tw8ESeDc,10462
nldcsc_elastic_rules/rules/windows/privilege_escalation_via_token_theft.toml,sha256=pTUVYaH2mDSfMJoYio0kZLT3hnERtved4suENXLFTqs,14441
nldcsc_elastic_rules/rules/windows/privilege_escalation_windows_service_via_unusual_client.toml,sha256=1E4lE5aCh2zwugf8jvDX4jhmcB3pLpiV0Lhigo-SM74,13443
nldcsc_elastic_rules/rules_building_block/collection_archive_data_zip_imageload.toml,sha256=UNgcG17EUJdfcq5sVvrd9x4vUlofVFMSjvhEHAz2YUQ,2076
nldcsc_elastic_rules/rules_building_block/collection_common_compressed_archived_file.toml,sha256=gq1QPP37B4QDeMvFHKJfvUG2SHV6Ub7pNtxy112Tuh8,5179
nldcsc_elastic_rules/rules_building_block/collection_files_staged_in_recycle_bin_root.toml,sha256=ODooM_xYOn5HuvfcZ6ycoWc6SrrQApyywTtM7J1YdVs,2086
nldcsc_elastic_rules/rules_building_block/collection_microsoft_purview_dlp_signal.toml,sha256=eGQmrjewXQ2OG3eFLQLnFS1CWlywp7tPRd537qJMyfM,3078
nldcsc_elastic_rules/rules_building_block/collection_microsoft_purview_insider_risk_signal.toml,sha256=EXIyabZlL2UyIyJSuvDUKYZeM7xqiZ5T4FJwaNlVqn8,2561
nldcsc_elastic_rules/rules_building_block/collection_outlook_email_archive.toml,sha256=v76m1hdXoBjTYRzIkbii1d8dUajzdvv7BR-QL-YJ-xY,1903
nldcsc_elastic_rules/rules_building_block/collection_posh_compression.toml,sha256=9P7Bb9Uplr5l_q-HRKB-5RIFJ5aPrV9fVbviMOL-ZNE,14451
nldcsc_elastic_rules/rules_building_block/command_and_control_bitsadmin_activity.toml,sha256=X6o06dg6e8f1iemxx1E0m0Xdy99r8xorCi0LBqqaHRU,2469
nldcsc_elastic_rules/rules_building_block/command_and_control_certutil_network_connection.toml,sha256=UJIWF1lzN8_0BL4HJfD7-SZzFJ5d6p88BP4m0fNaTJs,8946
nldcsc_elastic_rules/rules_building_block/command_and_control_dns_to_commonly_abused_webservices.toml,sha256=FuXcPvvW6pJMx2w4uCD4KFV0o4t3lAI69aZUmhEdpeY,8885
nldcsc_elastic_rules/rules_building_block/command_and_control_ollama_model_download_untrusted_source.toml,sha256=ojNjaQmoeMLR5FhwTSI5bQAxYSzpk2Dg3zogwa9WHo4,2648
nldcsc_elastic_rules/rules_building_block/credential_access_entra_id_risk_detection_signal.toml,sha256=mQjC-YbVZm_i_DWPsxRYULAutfbKkANrM74eI9qYb2s,2835
nldcsc_elastic_rules/rules_building_block/credential_access_mdmp_file_creation.toml,sha256=PZxWYsUXb356ALm6_68mlLb9PW4XLagsPGkznTUOs2k,3186
nldcsc_elastic_rules/rules_building_block/credential_access_mdmp_file_unusual_extension.toml,sha256=Txq9Mom9BE2xwG50tIWi6VUwnXEXgB9yW6rUGQkNZjg,2243
nldcsc_elastic_rules/rules_building_block/credential_access_win_private_key_access.toml,sha256=F2e5un8SjqaKJBdXRqyDIxx8Gkp1HZYvQjh5WGYIOxM,3168
nldcsc_elastic_rules/rules_building_block/defense_evasion_aws_rds_snapshot_created.toml,sha256=e4TKmQBeQOBGLWfkRMv99vRMTnR1R_xZadMkGkLpbHw,2116
nldcsc_elastic_rules/rules_building_block/defense_evasion_cmd_copy_binary_contents.toml,sha256=Eq_e-jdfZk9aze22253p3Y0lCoWfemxcIfrbMlhw-sI,2162
nldcsc_elastic_rules/rules_building_block/defense_evasion_cmstp_execution.toml,sha256=2hoHXnRz8nkGkXrRXPXWOuL0Yyr4UK9KSeav8DLghRY,1892
nldcsc_elastic_rules/rules_building_block/defense_evasion_collection_masquerading_unusual_archive_file_extension.toml,sha256=HOq6HpyGaiNdOuixntnNjt8v_GYqQ_T0HlgD4aHI-2w,2300
nldcsc_elastic_rules/rules_building_block/defense_evasion_dll_hijack.toml,sha256=e4yYgt85FRI0nUnIHfTuWgLk6RfBaaBxOJIDuuBA0K4,4784
nldcsc_elastic_rules/rules_building_block/defense_evasion_dotnet_clickonce_dfsvc_netcon.toml,sha256=jvQN1zbLSgsvQYTqewuNwREfOBQVdEYXw3gfDmfLblY,1875
nldcsc_elastic_rules/rules_building_block/defense_evasion_download_susp_extension.toml,sha256=nbZoo7zSPSadfV01DDSk_p6bGorFzk5wf3DkSo5lHQE,3153
nldcsc_elastic_rules/rules_building_block/defense_evasion_execution_via_visualstudio_prebuildevent.toml,sha256=YZgB2WZaOAgwyy6XHR6fK-jyjSKfshyO24R8P6QY9Zk,3885
nldcsc_elastic_rules/rules_building_block/defense_evasion_file_permission_modification.toml,sha256=6OMjgIERLItQ8-pGylJ2x1LiihTtKbDtDMf34SN2fmo,2099
nldcsc_elastic_rules/rules_building_block/defense_evasion_first_seen_network_flow_exporter.toml,sha256=Drd2sS36SZt5vIYbG1QGaCEe5YcaXaFpKu9tMBdF5oo,4747
nldcsc_elastic_rules/rules_building_block/defense_evasion_generic_deletion.toml,sha256=Z1myJHDSnSIBcuec0btiNugkNaYl-JiHVIJxJXJi7ow,2668
nldcsc_elastic_rules/rules_building_block/defense_evasion_indirect_command_exec_pcalua_forfiles.toml,sha256=VHH30l9YbPgUQht8BmUiT8sSGYmNyag8OsKL4dQ6jrQ,1430
nldcsc_elastic_rules/rules_building_block/defense_evasion_injection_from_msoffice.toml,sha256=bQknsFHKPzSIDTq3PGPLSC5dX75ODNPfZLXA3HM7me4,2655
nldcsc_elastic_rules/rules_building_block/defense_evasion_installutil_command_activity.toml,sha256=J47U6-30gG6FX7HKLRyxzdvtUc3lNxsrxIXgO1CzSrY,1723
nldcsc_elastic_rules/rules_building_block/defense_evasion_invalid_codesign_imageload.toml,sha256=EKbSapo7Q57M_Bemj7KbV907QWMRKIQoFlp1XGRs2ag,1662
nldcsc_elastic_rules/rules_building_block/defense_evasion_masquerading_browsers.toml,sha256=dWmdKjrXeII2qJ5YBfEecFOspEPYAlFUgcH2cbZyrBI,8151
nldcsc_elastic_rules/rules_building_block/defense_evasion_masquerading_unusual_exe_file_extension.toml,sha256=p09uO79zRlgF35TOwKQyH7EinzUvLeYk3JDhZaD-Hdg,2123
nldcsc_elastic_rules/rules_building_block/defense_evasion_masquerading_vlc_dll.toml,sha256=fdeeT22U7oOwvJN-7wfT3LsH23gm4kPH8BG3Yrgpn54,2230
nldcsc_elastic_rules/rules_building_block/defense_evasion_masquerading_windows_system32_exe.toml,sha256=eHvk4Y9VygfIsB9RJrPDLXugKXze6424DwGDJ7UfWJM,15745
nldcsc_elastic_rules/rules_building_block/defense_evasion_microsoft_security_compliance_admin_signal.toml,sha256=t3iUe3Y0tTPRJZvXf1CuD3-y1X__E0HGrK1KZ8A5mDw,3138
nldcsc_elastic_rules/rules_building_block/defense_evasion_msdt_suspicious_diagcab.toml,sha256=pR2kBOg6nIMnTp3lstMc7nyRXhcYZVru7pWphC1AhM4,2545
nldcsc_elastic_rules/rules_building_block/defense_evasion_msiexec_installsource_archive_file.toml,sha256=WGsXypfLhDIqZE-guH-ORayflSmyKM5T7tTECK4f6iM,2162
nldcsc_elastic_rules/rules_building_block/defense_evasion_outlook_suspicious_child.toml,sha256=cVNlQgACbhxwGeJA07Hj9S9w0isVqO81hkkCGWPx-QY,3752
nldcsc_elastic_rules/rules_building_block/defense_evasion_posh_obfuscation_proportion_special_chars.toml,sha256=eXDabpJ3L1JKo_wfRdgMQxnWXsOmjbj8b7ldgHH6l08,13309
nldcsc_elastic_rules/rules_building_block/defense_evasion_powershell_clear_logs_script.toml,sha256=CXOv1XmKw43KvI4KjxfiR9B67iGNaJwUDNzzuzrd-4I,10524
nldcsc_elastic_rules/rules_building_block/defense_evasion_service_disabled_registry.toml,sha256=TY1oPFWrgFh5A3G7DVZ8aecBRAV1TyYlTFbfPeunqL8,2204
nldcsc_elastic_rules/rules_building_block/defense_evasion_service_path_registry.toml,sha256=RGIhvoT_WsHRFQVZ5wue4wUeJdLcmWTDymPuB_GvTvk,2577
nldcsc_elastic_rules/rules_building_block/defense_evasion_services_exe_path.toml,sha256=qR3_iDce9OtVimgDkdKMLjlq6AS1Lnt8F8oXPRJcpvE,2396
nldcsc_elastic_rules/rules_building_block/defense_evasion_suspicious_msiexec_execution.toml,sha256=1VPSwPnrTkcXrgQLgReYla2uDeBAy6zcLG-Qa_jHo_Y,3323
nldcsc_elastic_rules/rules_building_block/defense_evasion_unsigned_bits_client.toml,sha256=Kk0pJWuE4g_qi3hJ2QW3ybI7Jd9VYFNFu9EL5XTYAXI,1856
nldcsc_elastic_rules/rules_building_block/defense_evasion_unusual_process_extension.toml,sha256=CKSR-CVuD2hOyvqbAUlg50E73zL-BO5twa83p2qqxe8,3043
nldcsc_elastic_rules/rules_building_block/defense_evasion_unusual_process_path_wbem.toml,sha256=NsYUV9XwCobdbYFrqNTDAGJrfSJ-qXiULYQEdQzG8iw,1817
nldcsc_elastic_rules/rules_building_block/defense_evasion_write_dac_access.toml,sha256=_PDKBkKEVLO_P_i8yAafPICLoyGJg8Kx8HXFuVa66gU,2834
nldcsc_elastic_rules/rules_building_block/discovery_capnetraw_capability.toml,sha256=I1CMG8HQXFbi4gncTmQFhJYi9Rs1EEMwrna0qE2f9yU,4125
nldcsc_elastic_rules/rules_building_block/discovery_ec2_multi_region_describe_instances.toml,sha256=BA981C1VpwHV2DE-064R6LLcYwHom_GaETKkx8bR1Mg,9774
nldcsc_elastic_rules/rules_building_block/discovery_files_dir_systeminfo_via_cmd.toml,sha256=yy9wc4X4A7MaARNVojUuhBQEadXUSvlG5NIJkTF7eDc,4562
nldcsc_elastic_rules/rules_building_block/discovery_generic_account_groups.toml,sha256=h8PRG4_FtuWIofzguivTEu-G_UfaBmc2A3dH5VbJxqs,3314
nldcsc_elastic_rules/rules_building_block/discovery_generic_process_discovery.toml,sha256=1hQp90pkGdkDyIlZg6T7krn_Kh2J2oxcQu1TWh9glbY,2443
nldcsc_elastic_rules/rules_building_block/discovery_generic_registry_query.toml,sha256=2DEl2_6eNu9nlzpvgGPEbGHbs7LFpGZ4QY2X0-pwEC8,2256
nldcsc_elastic_rules/rules_building_block/discovery_getconf_execution.toml,sha256=dFwtq5fIZnfy_nGVDSibWPoyUIoPEbS2ATLZheZxkGU,2605
nldcsc_elastic_rules/rules_building_block/discovery_hosts_file_access.toml,sha256=AvIuN2Yag5jZfAZLOFvPOWwuK3SMce7XD6QoTaOp2l8,1847
nldcsc_elastic_rules/rules_building_block/discovery_internet_capabilities.toml,sha256=oZjhbz1iJo6oWtgFOLPMAXK2_SSMEoXoA3iA_jnujME,1874
nldcsc_elastic_rules/rules_building_block/discovery_kernel_module_enumeration_via_proc.toml,sha256=_MX8gkB6Wj1IOYW9VVKf30NVpymDa55Ga3niWRxx-lA,3602
nldcsc_elastic_rules/rules_building_block/discovery_kubectl_configuration_discovery.toml,sha256=SlGINZPd0v0JoYMSnmY7vzD3y8Q1hOHZ0ElDpglgJns,2273
nldcsc_elastic_rules/rules_building_block/discovery_kubectl_workload_and_cluster_discovery.toml,sha256=TiqnSWbDrHf9d-9UwPjDtiX0XKGbHP2DRu45pMzdD4A,2634
nldcsc_elastic_rules/rules_building_block/discovery_linux_modprobe_enumeration.toml,sha256=AXox62_0QXgCYcc_jrVNH6sRpbRnzmPsSa1zQmY8-j4,4127
nldcsc_elastic_rules/rules_building_block/discovery_linux_sysctl_enumeration.toml,sha256=RUyYkP8yKKH3facpr31Uywu2m2Z2aHXKHj0beikf_pY,4104
nldcsc_elastic_rules/rules_building_block/discovery_linux_system_information_discovery.toml,sha256=cxsP557V9WVB1EozJLL38f-6yVV7B0dwkRoZ6KeTkmI,2168
nldcsc_elastic_rules/rules_building_block/discovery_linux_system_owner_user_discovery.toml,sha256=Nty2nsrfu8SR_73e66eEFoQdAasRg5iO0m3HVSWHMAU,1760
nldcsc_elastic_rules/rules_building_block/discovery_net_share_discovery_winlog.toml,sha256=_kZ5YyBroKmGt-_qdQv4Ei_nbWJlg6QQ2DETnVFPYl0,2537
nldcsc_elastic_rules/rules_building_block/discovery_net_view.toml,sha256=uugxWprlzqbOOd4ZgQ7-863K-E0o5dgmjej1onBTr0k,5404
nldcsc_elastic_rules/rules_building_block/discovery_of_accounts_or_groups_via_builtin_tools.toml,sha256=t92b-vQMQM7paCEtFg1jHOBGYW_sPAXf9WYnIBvx8Ak,2898
nldcsc_elastic_rules/rules_building_block/discovery_of_domain_groups.toml,sha256=VyKYRqMNxp3hWI36ZAK6LrOv-4tnVQpCUAKkbmkefgI,1769
nldcsc_elastic_rules/rules_building_block/discovery_posh_generic.toml,sha256=26o_SfeOzqgcKVj6IfGZ8aSjSmtrbF9Xka-oBdsn2-Q,10065
nldcsc_elastic_rules/rules_building_block/discovery_posh_password_policy.toml,sha256=uYnwG81HpYT9ystjZ-_7X68E0YDx1mRhnvAcPxyYM08,10504
nldcsc_elastic_rules/rules_building_block/discovery_post_exploitation_external_ip_lookup.toml,sha256=pS-kFwt-Bw-d7dzXFSku1hyua0sPV_0f5XVa1N-wYrI,7436
nldcsc_elastic_rules/rules_building_block/discovery_potential_memory_seeking_activity.toml,sha256=xhAABQ6tMiEikpN-eihkP_o7_hTRIMO81Rewnu9b7h8,3091
nldcsc_elastic_rules/rules_building_block/discovery_process_discovery_via_builtin_tools.toml,sha256=nWzXMOTR3_kir8Nf_bl7a4QLihWkxJHCDg9MK5rxhCI,2143
nldcsc_elastic_rules/rules_building_block/discovery_remote_system_discovery_commands_windows.toml,sha256=1JIqjIgIWpaS-O8BnwK7vBSknS7nQfPIfoVlWW7Pj_o,5417
nldcsc_elastic_rules/rules_building_block/discovery_security_software_wmic.toml,sha256=HmPRw9H4bwFqUq-vCeyhLGhUcM-jWm14nKgM11PtjSQ,4348
nldcsc_elastic_rules/rules_building_block/discovery_signal_unusual_user_host.toml,sha256=nOolhwZ_FACpTo29xWZcGD3b_6Pt2lE4S6E1Oh6mUxw,1607
nldcsc_elastic_rules/rules_building_block/discovery_suspicious_proc_enumeration.toml,sha256=llne21ndqtwLheoHy9_atWlDQNclU2EMQrqdCr60spU,3293
nldcsc_elastic_rules/rules_building_block/discovery_system_network_connections.toml,sha256=2gP4GBuSzk-cvMoSS4ZClTr03MIRW6I3pTe0wO8rF84,2042
nldcsc_elastic_rules/rules_building_block/discovery_system_service_discovery.toml,sha256=TkI3-I4smfyYORsAtPfcZjUU_hOSQOQQv00VEBq1G58,3677
nldcsc_elastic_rules/rules_building_block/discovery_system_time_discovery.toml,sha256=XXhlRpl_gZLaiVg5ySDwRtpb9hEzwAkXs1di2JI-oHQ,1865
nldcsc_elastic_rules/rules_building_block/discovery_win_network_connections.toml,sha256=MbFENcPAur2vKF0ocYFv553kQRBZNTv_hdi6S8qkaNY,2166
nldcsc_elastic_rules/rules_building_block/discovery_windows_system_information_discovery.toml,sha256=F9qw-T0_Ys4LFOMfMvfsNdzowGwzFGXNhTSFm1yBrYg,2512
nldcsc_elastic_rules/rules_building_block/entra_id_identity_protection_risk_detections.toml,sha256=_9h89cRjpbOpDpwJv6y8hBpgjepct3_ZQmEC6UGIoq8,1693
nldcsc_elastic_rules/rules_building_block/execution_aws_lambda_function_updated.toml,sha256=x_DDqMxyCH2wZmvCBCLKmsWbxvQZ0VjdzdhG0xW0ZFs,2305
nldcsc_elastic_rules/rules_building_block/execution_common_debug_or_base_image_pod_creation.toml,sha256=pS-bJkZCq37GKnJTsSlf_eJRcYl7UGPZKw_RntMxGV0,2411
nldcsc_elastic_rules/rules_building_block/execution_github_new_event_action_for_pat.toml,sha256=au3LZ58aYNzKwiJyQnqUdQ6f-KXE2RwBO1sNOvXiN34,2375
nldcsc_elastic_rules/rules_building_block/execution_github_new_repo_interaction_for_pat.toml,sha256=QqweKvc_3ey8ycjghuMUJon71v04rTHe2Sn1MzZM_Yo,1949
nldcsc_elastic_rules/rules_building_block/execution_github_new_repo_interaction_for_user.toml,sha256=aGzFN0RgwO6bwH87cTEfU1Bzo0PTM-sg65c7dO60Z44,1823
nldcsc_elastic_rules/rules_building_block/execution_github_repo_created.toml,sha256=iQ1ikImtGhzay8qkLp4Gezuy2PKmIcPOc4hvvW4uuJA,1497
nldcsc_elastic_rules/rules_building_block/execution_github_repo_interaction_from_new_ip.toml,sha256=Hw_a5gZZ7nDkLMvUozloUDrv2AIg2KuUETqww-qT38U,2274
nldcsc_elastic_rules/rules_building_block/execution_linux_segfault.toml,sha256=g7IfAfdeXXne0_z5yDb4wpz_I3J0k_MxNWxLri_jUkk,3313
nldcsc_elastic_rules/rules_building_block/execution_mcp_server_child_process.toml,sha256=D2_VZgtfXm0akzhd-to4shkHPnWley66fKom0UqEhCE,8156
nldcsc_elastic_rules/rules_building_block/execution_settingcontent_ms_file_creation.toml,sha256=vFJfMDAxXn1m1um5j3ZG43SNEMLdU2EByGDymrxg-s0,2699
nldcsc_elastic_rules/rules_building_block/execution_unsigned_service_executable.toml,sha256=n9F9TQP8pZPII24cxRn6KTa21ah6sg6NoX45dVDL5CE,2675
nldcsc_elastic_rules/rules_building_block/execution_wmi_wbemtest.toml,sha256=YOeqNj5LCRSTV_8qRECfVvmQ2Y8dH-jr0LvsiNzxipU,1433
nldcsc_elastic_rules/rules_building_block/impact_azure_recovery_services_deletion.toml,sha256=n49_0Tnx6JA2Y9_X74szdNcTduQh_T_BsI1rLGJ6FT8,1782
nldcsc_elastic_rules/rules_building_block/impact_github_member_removed_from_organization.toml,sha256=jXDtkZM7PCXOQYaU4Wo4DRvRZH-YfKUT2U4sTvhrEH4,1138
nldcsc_elastic_rules/rules_building_block/impact_github_pat_access_revoked.toml,sha256=4q8-QrKUp2AnyZPO8zJQANrudyuhdp7n3CFTd_23mRs,1125
nldcsc_elastic_rules/rules_building_block/impact_github_user_blocked_from_organization.toml,sha256=V3wCF4GQFNOuSOp1PARkB_tz0b3-3ukArnyKniYFytU,1102
nldcsc_elastic_rules/rules_building_block/initial_access_anomalous_rsc_flight_data_patterns.toml,sha256=xT0dKknWl3MEBhAYZ6XIQv0lFRB0nv_vFn4nW5xclFs,4220
nldcsc_elastic_rules/rules_building_block/initial_access_aws_signin_token_created.toml,sha256=2HdyTp3DjY37ER0KjOJKS63_vW-SZ82ScD0hQGStjyE,3149
nldcsc_elastic_rules/rules_building_block/initial_access_github_new_ip_address_for_pat.toml,sha256=pc3ryakgV8_dnGyvk_s6qs8AG2tcpk0V-eA72SELkrQ,2084
nldcsc_elastic_rules/rules_building_block/initial_access_github_new_ip_address_for_user.toml,sha256=TivlZzn5s_QqRXVjPMZca70WK2iUaRWIeBz1htxcq8U,1488
nldcsc_elastic_rules/rules_building_block/initial_access_github_new_user_agent_for_pat.toml,sha256=s8DpsinyInmuBhD2jm4NWGIiuG1-a_sepKo4DIzaPEc,2090
nldcsc_elastic_rules/rules_building_block/initial_access_github_new_user_agent_for_user.toml,sha256=CKG9ylSxy7zKRnOQyLjRRJMa6J41R8ORRWWPif55OX4,1494
nldcsc_elastic_rules/rules_building_block/initial_access_google_workspace_login_flagged_suspicious_by_google.toml,sha256=wRtn9hHHQdv9Q-ps90fIxTpKef0Xh0NJJNZVxMTc9eY,6425
nldcsc_elastic_rules/rules_building_block/initial_access_microsoft_air_investigation_signal.toml,sha256=P_xYvoExCVWAm_KIBTvX2wewsXGZ49dPEkybDX4gHtY,2449
nldcsc_elastic_rules/rules_building_block/initial_access_microsoft_defender_alerts_signal.toml,sha256=ctxsTeKvkVYRve9QDOws9c9PRk8akJCppzFMOT_EPpQ,3309
nldcsc_elastic_rules/rules_building_block/initial_access_microsoft_defender_threat_intelligence_signal.toml,sha256=HqdkHQnGxpFKluAPm0Pqp3ADWaTmI0m9CrpESSAoYUI,7586
nldcsc_elastic_rules/rules_building_block/initial_access_microsoft_purview_security_compliance_signal.toml,sha256=tX_jtWUWV2vJY7V5g_ZIdjNq6Cf9nK2HhwZZ7lOOSx4,2885
nldcsc_elastic_rules/rules_building_block/initial_access_microsoft_quarantine_hygiene_signal.toml,sha256=IoY7zjC-n_Aa2YToGA8ln0Hf52B00qf_LewAE39R7Ac,2502
nldcsc_elastic_rules/rules_building_block/initial_access_new_okta_authentication_behavior.toml,sha256=5WBPhpErvGp520GNp5VpRiMi28zlC_QWRRGuSawxQUA,4268
nldcsc_elastic_rules/rules_building_block/initial_access_okta_admin_console_login_failure.toml,sha256=2WN1cAkhluD_7ngZ6BsWKRrT6L-xvlI67XHRWsbPKGM,4841
nldcsc_elastic_rules/rules_building_block/initial_access_potential_rce_via_toolshell.toml,sha256=3H8vzzRA7DoaCZ2fcHWKTbfzONonwDARtyGs1XrtmOg,2770
nldcsc_elastic_rules/rules_building_block/initial_access_potential_toolshell_exploit_attempt.toml,sha256=pft03tF-wV9lg_MejStYChukzHza1KL_mdR2vBkZAOY,2524
nldcsc_elastic_rules/rules_building_block/lateral_movement_at.toml,sha256=1tEBHrcIYA9C53sSPA_gcaTnv8dp1aPq8cafSHNCpDA,2031
nldcsc_elastic_rules/rules_building_block/lateral_movement_posh_winrm_activity.toml,sha256=dTpnwUdQbeuiTdVqZbAWLS-cU-WwGt7MSgBA0apLr0s,3652
nldcsc_elastic_rules/rules_building_block/lateral_movement_rdp_conn_unusual_process.toml,sha256=bQJi-vON7HvLfCDm6uu6QpwBEvNnLXIYZQJR88Ymdls,2315
nldcsc_elastic_rules/rules_building_block/lateral_movement_unusual_process_sql_accounts.toml,sha256=nJkoeM8EX23sX428DFv0S06ma9AX8oyNUD9XMyDrMXU,3951
nldcsc_elastic_rules/rules_building_block/lateral_movement_wmic_remote.toml,sha256=4pDAEJHSK2bF7EWXjReCBs0xNlctkTJ8XRM0UanYKtI,2278
nldcsc_elastic_rules/rules_building_block/persistence_aws_iam_login_profile_added_to_user.toml,sha256=oq1vWh39t0NIARpu4J_Z8blhtl43eFeIrdxz8qvLe0Y,2215
nldcsc_elastic_rules/rules_building_block/persistence_azure_vm_configuration_modified.toml,sha256=u6VG5xVJ9JEDLWA6A7MFqSqhplpug9fp5KE_omw0TL8,2903
nldcsc_elastic_rules/rules_building_block/persistence_github_new_pat_for_user.toml,sha256=6lDtGhBMBZLrzjIxVqPuMPU6x-OxD5n5GigNQpf6dqU,2043
nldcsc_elastic_rules/rules_building_block/persistence_github_new_user_added_to_organization.toml,sha256=oSBzxSMBsk5pKcBtNYZw4XHmKCzn9VW4bTHHlBbCb8s,1404
nldcsc_elastic_rules/rules_building_block/persistence_iam_instance_request_to_iam_service.toml,sha256=M7U65LJSx0r1gK99H_y__f6djCtNkidtbrOvM_ule40,3955
nldcsc_elastic_rules/rules_building_block/persistence_startup_folder_lnk.toml,sha256=bomGIg6zvCRbloGkCnJptrM-EhViQv5DscwtDDZsgtA,2241
nldcsc_elastic_rules/rules_building_block/persistence_transport_agent_exchange.toml,sha256=W_QTxTncx5EWucpSm1LAYPgTiZ2HjF41_ztsG_zPlcg,3460
nldcsc_elastic_rules/rules_building_block/persistence_web_server_sus_file_creation.toml,sha256=guICnUKzpoMRJj80bEaA-HEgYTGXSG9bEyvi4nkVAI8,6190
nldcsc_elastic_rules/rules_building_block/privilege_escalation_sts_getsessiontoken_abuse.toml,sha256=kue8K7tHfmq9qqGYS_FVvCpDQOiFlLCAVfQF3olc6O8,6140
nldcsc_elastic_rules-0.0.180.dist-info/METADATA,sha256=2XvPM-mgNeOIgv-InDZ8wqPonBRkFGFsRrfqWGnyUyA,66
nldcsc_elastic_rules-0.0.180.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
nldcsc_elastic_rules-0.0.180.dist-info/top_level.txt,sha256=2ua0gPWflzV4D32kz6ZXXok1H-0wJVI2Scdm_qmNsrM,21
nldcsc_elastic_rules-0.0.180.dist-info/RECORD,,
