MANIFEST.in
pyproject.toml
nldcsc_elastic_rules/__init__.py
nldcsc_elastic_rules/utils.py
nldcsc_elastic_rules.egg-info/PKG-INFO
nldcsc_elastic_rules.egg-info/SOURCES.txt
nldcsc_elastic_rules.egg-info/dependency_links.txt
nldcsc_elastic_rules.egg-info/top_level.txt
nldcsc_elastic_rules/rules/README.md
nldcsc_elastic_rules/rules/_deprecated/apm_null_user_agent.toml
nldcsc_elastic_rules/rules/_deprecated/command_and_control_connection_attempt_by_non_ssh_root_session.toml
nldcsc_elastic_rules/rules/_deprecated/command_and_control_dns_directly_to_the_internet.toml
nldcsc_elastic_rules/rules/_deprecated/command_and_control_ftp_file_transfer_protocol_activity_to_the_internet.toml
nldcsc_elastic_rules/rules/_deprecated/command_and_control_irc_internet_relay_chat_protocol_activity_to_the_internet.toml
nldcsc_elastic_rules/rules/_deprecated/command_and_control_linux_chisel_server_activity.toml
nldcsc_elastic_rules/rules/_deprecated/command_and_control_linux_iodine_activity.toml
nldcsc_elastic_rules/rules/_deprecated/command_and_control_linux_port_knocking_reverse_connection.toml
nldcsc_elastic_rules/rules/_deprecated/command_and_control_non_standard_http_port.toml
nldcsc_elastic_rules/rules/_deprecated/command_and_control_non_standard_ssh_port.toml
nldcsc_elastic_rules/rules/_deprecated/command_and_control_port_8000_activity_to_the_internet.toml
nldcsc_elastic_rules/rules/_deprecated/command_and_control_pptp_point_to_point_tunneling_protocol_activity.toml
nldcsc_elastic_rules/rules/_deprecated/command_and_control_proxy_port_activity_to_the_internet.toml
nldcsc_elastic_rules/rules/_deprecated/command_and_control_smtp_to_the_internet.toml
nldcsc_elastic_rules/rules/_deprecated/command_and_control_sql_server_port_activity_to_the_internet.toml
nldcsc_elastic_rules/rules/_deprecated/command_and_control_ssh_secure_shell_from_the_internet.toml
nldcsc_elastic_rules/rules/_deprecated/command_and_control_ssh_secure_shell_to_the_internet.toml
nldcsc_elastic_rules/rules/_deprecated/command_and_control_tor_activity_to_the_internet.toml
nldcsc_elastic_rules/rules/_deprecated/credential_access_entra_signin_brute_force_microsoft_365_repeat_source.toml
nldcsc_elastic_rules/rules/_deprecated/credential_access_microsoft_365_potential_password_spraying_attack.toml
nldcsc_elastic_rules/rules/_deprecated/credential_access_potential_linux_ssh_bruteforce_root.toml
nldcsc_elastic_rules/rules/_deprecated/credential_access_potential_successful_linux_ftp_bruteforce.toml
nldcsc_elastic_rules/rules/_deprecated/credential_access_potential_successful_linux_rdp_bruteforce.toml
nldcsc_elastic_rules/rules/_deprecated/credential_access_tcpdump_activity.toml
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_agent_spoofing_mismatched_id.toml
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_attempt_to_disable_iptables_or_firewall.toml
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_base64_encoding_or_decoding_activity.toml
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_code_injection_conhost.toml
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_elasticache_security_group_creation.toml
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_elasticache_security_group_modified_or_deleted.toml
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_execution_via_trusted_developer_utilities.toml
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_hex_encoding_or_decoding_activity.toml
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_ld_preload_env_variable_process_injection.toml
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_mshta_making_network_connections.toml
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_potential_processherpaderping.toml
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_process_termination_followed_by_deletion.toml
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_rename_esxi_index_file.toml
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_whitespace_padding_in_command_line.toml
nldcsc_elastic_rules/rules/_deprecated/discovery_file_dir_discovery.toml
nldcsc_elastic_rules/rules/_deprecated/discovery_process_discovery_via_tasklist_command.toml
nldcsc_elastic_rules/rules/_deprecated/discovery_pspy_process_monitoring_detected.toml
nldcsc_elastic_rules/rules/_deprecated/discovery_query_registry_via_reg.toml
nldcsc_elastic_rules/rules/_deprecated/discovery_whoami_commmand.toml
nldcsc_elastic_rules/rules/_deprecated/execution_apt_binary.toml
nldcsc_elastic_rules/rules/_deprecated/execution_awk_binary_shell.toml
nldcsc_elastic_rules/rules/_deprecated/execution_busybox_binary.toml
nldcsc_elastic_rules/rules/_deprecated/execution_c89_c99_binary.toml
nldcsc_elastic_rules/rules/_deprecated/execution_command_shell_started_by_powershell.toml
nldcsc_elastic_rules/rules/_deprecated/execution_cpulimit_binary.toml
nldcsc_elastic_rules/rules/_deprecated/execution_crash_binary.toml
nldcsc_elastic_rules/rules/_deprecated/execution_curl_cve_2023_38545_heap_overflow.toml
nldcsc_elastic_rules/rules/_deprecated/execution_env_binary.toml
nldcsc_elastic_rules/rules/_deprecated/execution_expect_binary.toml
nldcsc_elastic_rules/rules/_deprecated/execution_find_binary.toml
nldcsc_elastic_rules/rules/_deprecated/execution_flock_binary.toml
nldcsc_elastic_rules/rules/_deprecated/execution_gcc_binary.toml
nldcsc_elastic_rules/rules/_deprecated/execution_linux_process_started_in_temp_directory.toml
nldcsc_elastic_rules/rules/_deprecated/execution_mysql_binary.toml
nldcsc_elastic_rules/rules/_deprecated/execution_pdf_written_file.toml
nldcsc_elastic_rules/rules/_deprecated/execution_reverse_shell_via_named_pipe.toml
nldcsc_elastic_rules/rules/_deprecated/execution_shell_suspicious_parent_child_revshell_linux.toml
nldcsc_elastic_rules/rules/_deprecated/execution_ssh_binary.toml
nldcsc_elastic_rules/rules/_deprecated/execution_suspicious_jar_child_process.toml
nldcsc_elastic_rules/rules/_deprecated/execution_vi_binary.toml
nldcsc_elastic_rules/rules/_deprecated/execution_via_net_com_assemblies.toml
nldcsc_elastic_rules/rules/_deprecated/exfiltration_ec2_snapshot_change_activity.toml
nldcsc_elastic_rules/rules/_deprecated/exfiltration_ec2_vm_export_failure.toml
nldcsc_elastic_rules/rules/_deprecated/exfiltration_rds_snapshot_export.toml
nldcsc_elastic_rules/rules/_deprecated/impact_potential_linux_ransomware_file_encryption.toml
nldcsc_elastic_rules/rules/_deprecated/impact_rds_group_deletion.toml
nldcsc_elastic_rules/rules/_deprecated/impact_rds_instance_cluster_stoppage.toml
nldcsc_elastic_rules/rules/_deprecated/impact_virtual_network_device_modified.toml
nldcsc_elastic_rules/rules/_deprecated/initial_access_cross_site_scripting.toml
nldcsc_elastic_rules/rules/_deprecated/initial_access_login_failures.toml
nldcsc_elastic_rules/rules/_deprecated/initial_access_login_location.toml
nldcsc_elastic_rules/rules/_deprecated/initial_access_login_sessions.toml
nldcsc_elastic_rules/rules/_deprecated/initial_access_login_time.toml
nldcsc_elastic_rules/rules/_deprecated/initial_access_rdp_remote_desktop_protocol_to_the_internet.toml
nldcsc_elastic_rules/rules/_deprecated/initial_access_ssh_connection_established_inside_a_container.toml
nldcsc_elastic_rules/rules/_deprecated/lateral_movement_malicious_remote_file_creation.toml
nldcsc_elastic_rules/rules/_deprecated/lateral_movement_remote_file_creation_in_sensitive_directory.toml
nldcsc_elastic_rules/rules/_deprecated/lateral_movement_ssh_process_launched_inside_a_container.toml
nldcsc_elastic_rules/rules/_deprecated/lateral_movement_ssh_process_launched_inside_container.toml
nldcsc_elastic_rules/rules/_deprecated/linux_mknod_activity.toml
nldcsc_elastic_rules/rules/_deprecated/linux_nmap_activity.toml
nldcsc_elastic_rules/rules/_deprecated/linux_socat_activity.toml
nldcsc_elastic_rules/rules/_deprecated/persistence_cap_sys_admin_added_to_new_binary.toml
nldcsc_elastic_rules/rules/_deprecated/persistence_creation_modif_launch_deamon_sequence.toml
nldcsc_elastic_rules/rules/_deprecated/persistence_creation_of_kernel_module.toml
nldcsc_elastic_rules/rules/_deprecated/persistence_credential_access_modify_auth_module_or_config.toml
nldcsc_elastic_rules/rules/_deprecated/persistence_cron_jobs_creation_and_runtime.toml
nldcsc_elastic_rules/rules/_deprecated/persistence_etc_file_creation.toml
nldcsc_elastic_rules/rules/_deprecated/persistence_google_workspace_user_group_access_modified_to_allow_external_access.toml
nldcsc_elastic_rules/rules/_deprecated/persistence_kernel_module_activity.toml
nldcsc_elastic_rules/rules/_deprecated/persistence_rds_cluster_creation.toml
nldcsc_elastic_rules/rules/_deprecated/persistence_rds_group_creation.toml
nldcsc_elastic_rules/rules/_deprecated/persistence_rds_instance_creation.toml
nldcsc_elastic_rules/rules/_deprecated/persistence_redshift_instance_creation.toml
nldcsc_elastic_rules/rules/_deprecated/persistence_shell_activity_by_web_server.toml
nldcsc_elastic_rules/rules/_deprecated/privilege_escalation_gcp_kubernetes_rolebindings_created_or_patched.toml
nldcsc_elastic_rules/rules/_deprecated/privilege_escalation_krbrelayup_suspicious_logon.toml
nldcsc_elastic_rules/rules/_deprecated/privilege_escalation_linux_strace_activity.toml
nldcsc_elastic_rules/rules/_deprecated/privilege_escalation_linux_uid_int_max_bug.toml
nldcsc_elastic_rules/rules/_deprecated/privilege_escalation_netcon_via_sudo_binary.toml
nldcsc_elastic_rules/rules/_deprecated/privilege_escalation_printspooler_malicious_driver_file_changes.toml
nldcsc_elastic_rules/rules/_deprecated/privilege_escalation_printspooler_malicious_registry_modification.toml
nldcsc_elastic_rules/rules/_deprecated/privilege_escalation_root_login_without_mfa.toml
nldcsc_elastic_rules/rules/_deprecated/privilege_escalation_setgid_bit_set_via_chmod.toml
nldcsc_elastic_rules/rules/_deprecated/threat_intel_filebeat7x.toml
nldcsc_elastic_rules/rules/_deprecated/threat_intel_filebeat8x.toml
nldcsc_elastic_rules/rules/_deprecated/threat_intel_fleet_integrations.toml
nldcsc_elastic_rules/rules/apm/apm_403_response_to_a_post.toml
nldcsc_elastic_rules/rules/apm/apm_405_response_method_not_allowed.toml
nldcsc_elastic_rules/rules/apm/apm_sqlmap_user_agent.toml
nldcsc_elastic_rules/rules/cross-platform/command_and_control_common_llm_endpoint.toml
nldcsc_elastic_rules/rules/cross-platform/command_and_control_curl_wget_spawn_via_nodejs_parent.toml
nldcsc_elastic_rules/rules/cross-platform/command_and_control_genai_process_suspicious_tld_connection.toml
nldcsc_elastic_rules/rules/cross-platform/command_and_control_genai_process_unusual_domain.toml
nldcsc_elastic_rules/rules/cross-platform/command_and_control_google_drive_malicious_file_download.toml
nldcsc_elastic_rules/rules/cross-platform/command_and_control_kubectl_networking_modification.toml
nldcsc_elastic_rules/rules/cross-platform/command_and_control_pan_elastic_defend_c2.toml
nldcsc_elastic_rules/rules/cross-platform/command_and_control_socks_fortigate_endpoint.toml
nldcsc_elastic_rules/rules/cross-platform/command_and_control_suricata_elastic_defend_c2.toml
nldcsc_elastic_rules/rules/cross-platform/command_and_control_tunnel_qemu.toml
nldcsc_elastic_rules/rules/cross-platform/credential_access_cookies_chromium_browsers_debugging.toml
nldcsc_elastic_rules/rules/cross-platform/credential_access_forced_authentication_pipes.toml
nldcsc_elastic_rules/rules/cross-platform/credential_access_genai_process_sensitive_file_access.toml
nldcsc_elastic_rules/rules/cross-platform/credential_access_gitleaks_execution.toml
nldcsc_elastic_rules/rules/cross-platform/credential_access_grep_recursive_credential_discovery.toml
nldcsc_elastic_rules/rules/cross-platform/credential_access_multi_could_secrets_via_api.toml
nldcsc_elastic_rules/rules/cross-platform/credential_access_trufflehog_execution.toml
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_agent_spoofing_multiple_hosts.toml
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_data_encrypted_via_openssl.toml
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_deleting_websvr_access_logs.toml
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_deletion_of_bash_command_line_history.toml
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_elastic_agent_service_terminated.toml
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_encoding_rot13_python_script.toml
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_genai_config_modification.toml
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_genai_process_compiling_executables.toml
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_genai_process_encoding_prior_to_network_activity.toml
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_masquerading_space_after_filename.toml
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_missing_events_after_alert.toml
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_potential_http_downgrade_attack.toml
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_potential_kubectl_impersonation.toml
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_potential_kubectl_masquerading.toml
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_processes_with_trailing_spaces.toml
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_timestomp_touch.toml
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_whitespace_padding_command_line.toml
nldcsc_elastic_rules/rules/cross-platform/discovery_kubectl_permission_discovery.toml
nldcsc_elastic_rules/rules/cross-platform/discovery_kubectl_secrets_all_namespaces.toml
nldcsc_elastic_rules/rules/cross-platform/discovery_security_software_grep.toml
nldcsc_elastic_rules/rules/cross-platform/discovery_virtual_machine_fingerprinting_grep.toml
nldcsc_elastic_rules/rules/cross-platform/discovery_web_server_local_file_inclusion_activity.toml
nldcsc_elastic_rules/rules/cross-platform/discovery_web_server_remote_file_inclusion_activity.toml
nldcsc_elastic_rules/rules/cross-platform/execution_aws_ec2_lolbin_via_ssm.toml
nldcsc_elastic_rules/rules/cross-platform/execution_aws_ssm_sendcommand_with_command_parameters.toml
nldcsc_elastic_rules/rules/cross-platform/execution_d4c_k8s_mda_direct_interactive_kubernetes_api_request_by_usual_utilities.toml
nldcsc_elastic_rules/rules/cross-platform/execution_d4c_k8s_mda_forbidden_direct_interactive_kubernetes_api_request.toml
nldcsc_elastic_rules/rules/cross-platform/execution_d4c_k8s_mda_kubernetes_api_activity_by_unusual_utilities.toml
nldcsc_elastic_rules/rules/cross-platform/execution_d4c_k8s_mda_service_account_token_access_followed_by_kubernetes_api_request.toml
nldcsc_elastic_rules/rules/cross-platform/execution_git_exploit_cve_2025_48384.toml
nldcsc_elastic_rules/rules/cross-platform/execution_kubernetes_direct_api_request_via_curl_or_wget.toml
nldcsc_elastic_rules/rules/cross-platform/execution_nodejs_pre_or_post_install_script_execution.toml
nldcsc_elastic_rules/rules/cross-platform/execution_openclaw_agent_child_process.toml
nldcsc_elastic_rules/rules/cross-platform/execution_pentest_eggshell_remote_admin_tool.toml
nldcsc_elastic_rules/rules/cross-platform/execution_potential_widespread_malware_infection.toml
nldcsc_elastic_rules/rules/cross-platform/execution_privileged_container_creation_with_host_reference.toml
nldcsc_elastic_rules/rules/cross-platform/execution_register_github_actions_runner.toml
nldcsc_elastic_rules/rules/cross-platform/execution_revershell_via_shell_cmd.toml
nldcsc_elastic_rules/rules/cross-platform/execution_sap_netweaver_jsp_webshell.toml
nldcsc_elastic_rules/rules/cross-platform/execution_sap_netweaver_webshell_exec.toml
nldcsc_elastic_rules/rules/cross-platform/execution_suspicious_java_netcon_childproc.toml
nldcsc_elastic_rules/rules/cross-platform/execution_suspicious_python_command_execution.toml
nldcsc_elastic_rules/rules/cross-platform/execution_via_github_actions_runner.toml
nldcsc_elastic_rules/rules/cross-platform/execution_via_github_runner_with_runner_tracking_id_tampering_via_env_vars.toml
nldcsc_elastic_rules/rules/cross-platform/exfiltration_potential_curl_data_exfiltration.toml
nldcsc_elastic_rules/rules/cross-platform/guided_onboarding_sample_rule.toml
nldcsc_elastic_rules/rules/cross-platform/impact_alert_from_a_process_with_cpu_spike.toml
nldcsc_elastic_rules/rules/cross-platform/impact_alerts_on_host_with_cpu_spike.toml
nldcsc_elastic_rules/rules/cross-platform/impact_hosts_file_modified.toml
nldcsc_elastic_rules/rules/cross-platform/impact_newly_observed_process_with_high_cpu.toml
nldcsc_elastic_rules/rules/cross-platform/initial_access_azure_o365_with_network_alert.toml
nldcsc_elastic_rules/rules/cross-platform/initial_access_elastic_defend_alert_genai_utility_descendant.toml
nldcsc_elastic_rules/rules/cross-platform/initial_access_execution_susp_react_serv_child.toml
nldcsc_elastic_rules/rules/cross-platform/initial_access_exfiltration_new_usb_device_mounted.toml
nldcsc_elastic_rules/rules/cross-platform/initial_access_file_upload_followed_by_get_request.toml
nldcsc_elastic_rules/rules/cross-platform/initial_access_fortigate_ssl_vpn_login_followed_by_siem_alert.toml
nldcsc_elastic_rules/rules/cross-platform/initial_access_ollama_api_external_access.toml
nldcsc_elastic_rules/rules/cross-platform/initial_access_zoom_meeting_with_no_passcode.toml
nldcsc_elastic_rules/rules/cross-platform/lateral_movement_multi_alerts_new_srcip.toml
nldcsc_elastic_rules/rules/cross-platform/lateral_movement_multi_alerts_new_userid.toml
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_by_host_ip_and_source_ip.toml
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_different_tactics_host.toml
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_edr_elastic_defend_by_host.toml
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_edr_elastic_same_process_tree.toml
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_elastic_defend_netsecurity_by_host.toml
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_email_elastic_defend_correlation.toml
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_from_different_modules_by_dstip.toml
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_from_different_modules_by_srcip.toml
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_from_different_modules_by_user.toml
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_involving_user.toml
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_llm_attack_chain_triage_by_host.toml
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_llm_by_user_entity.toml
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_llm_compromised_user_triage.toml
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_risky_host_esql.toml
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_same_tactic_by_host.toml
nldcsc_elastic_rules/rules/cross-platform/multiple_elastic_defend_behavior_rules_same_host_prevalence.toml
nldcsc_elastic_rules/rules/cross-platform/multiple_external_edr_alerts_by_host.toml
nldcsc_elastic_rules/rules/cross-platform/multiple_machine_learning_jobs_by_entity.toml
nldcsc_elastic_rules/rules/cross-platform/multiple_vulnerabilities_wiz_by_container.toml
nldcsc_elastic_rules/rules/cross-platform/newly_observed_elastic_defend_alert.toml
nldcsc_elastic_rules/rules/cross-platform/newly_observed_elastic_detection_rule.toml
nldcsc_elastic_rules/rules/cross-platform/newly_observed_fortigate_alert.toml
nldcsc_elastic_rules/rules/cross-platform/newly_observed_panos_alert.toml
nldcsc_elastic_rules/rules/cross-platform/newly_observed_suricata_alert.toml
nldcsc_elastic_rules/rules/cross-platform/persistence_shell_profile_modification.toml
nldcsc_elastic_rules/rules/cross-platform/persistence_ssh_authorized_keys_modification.toml
nldcsc_elastic_rules/rules/cross-platform/persistence_web_server_potential_command_injection.toml
nldcsc_elastic_rules/rules/cross-platform/privilege_escalation_echo_nopasswd_sudoers.toml
nldcsc_elastic_rules/rules/cross-platform/privilege_escalation_setuid_setgid_bit_set_via_chmod.toml
nldcsc_elastic_rules/rules/cross-platform/privilege_escalation_sudo_buffer_overflow.toml
nldcsc_elastic_rules/rules/cross-platform/privilege_escalation_sudoers_file_mod.toml
nldcsc_elastic_rules/rules/cross-platform/privilege_escalation_trap_execution.toml
nldcsc_elastic_rules/rules/cross-platform/reconnaissance_web_server_discovery_or_fuzzing_activity.toml
nldcsc_elastic_rules/rules/cross-platform/reconnaissance_web_server_unusual_spike_in_error_logs.toml
nldcsc_elastic_rules/rules/cross-platform/reconnaissance_web_server_unusual_spike_in_error_response_codes.toml
nldcsc_elastic_rules/rules/cross-platform/reconnaissance_web_server_unusual_user_agents.toml
nldcsc_elastic_rules/rules/integrations/aws/NOTICE.txt
nldcsc_elastic_rules/rules/integrations/aws/collection_cloudtrail_logging_created.toml
nldcsc_elastic_rules/rules/integrations/aws/collection_s3_unauthenticated_bucket_access_by_rare_source.toml
nldcsc_elastic_rules/rules/integrations/aws/credential_access_aws_getpassword_for_ec2_instance.toml
nldcsc_elastic_rules/rules/integrations/aws/credential_access_iam_compromisedkeyquarantine_policy_attached_to_user.toml
nldcsc_elastic_rules/rules/integrations/aws/credential_access_iam_user_addition_to_group.toml
nldcsc_elastic_rules/rules/integrations/aws/credential_access_new_terms_secretsmanager_getsecretvalue.toml
nldcsc_elastic_rules/rules/integrations/aws/credential_access_rapid_secret_retrieval_attempts_from_secretsmanager.toml
nldcsc_elastic_rules/rules/integrations/aws/credential_access_retrieve_secure_string_parameters_via_ssm.toml
nldcsc_elastic_rules/rules/integrations/aws/credential_access_root_console_failure_brute_force.toml
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_cloudtrail_logging_deleted.toml
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_cloudtrail_logging_evasion.toml
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_cloudtrail_logging_suspended.toml
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_cloudwatch_alarm_deletion.toml
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_config_service_rule_deletion.toml
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_configuration_recorder_stopped.toml
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_ec2_flow_log_deletion.toml
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_ec2_network_acl_deletion.toml
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_ec2_serial_console_access_enabled.toml
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_guardduty_detector_deletion.toml
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_guardduty_member_manipulation.toml
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_rds_instance_restored.toml
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_route53_dns_query_resolver_config_deletion.toml
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_s3_bucket_configuration_deletion.toml
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_s3_bucket_lifecycle_expiration_added.toml
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_s3_bucket_server_access_logging_disabled.toml
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_sqs_purge_queue.toml
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_sts_get_federation_token.toml
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_vpc_security_group_ingress_rule_added_for_remote_connections.toml
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_waf_acl_deletion.toml
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_waf_rule_or_rule_group_deletion.toml
nldcsc_elastic_rules/rules/integrations/aws/discovery_ec2_deprecated_ami_discovery.toml
nldcsc_elastic_rules/rules/integrations/aws/discovery_ec2_userdata_request_for_ec2_instance.toml
nldcsc_elastic_rules/rules/integrations/aws/discovery_iam_principal_enumeration_via_update_assume_role_policy.toml
nldcsc_elastic_rules/rules/integrations/aws/discovery_multiple_discovery_api_calls_via_cli.toml
nldcsc_elastic_rules/rules/integrations/aws/discovery_new_terms_sts_getcalleridentity.toml
nldcsc_elastic_rules/rules/integrations/aws/discovery_servicequotas_multi_region_service_quota_requests.toml
nldcsc_elastic_rules/rules/integrations/aws/discovery_ssm_inventory_reconnaissance.toml
nldcsc_elastic_rules/rules/integrations/aws/execution_cloudshell_environment_created.toml
nldcsc_elastic_rules/rules/integrations/aws/execution_lambda_external_layer_added_to_function.toml
nldcsc_elastic_rules/rules/integrations/aws/execution_new_terms_cloudformation_createstack.toml
nldcsc_elastic_rules/rules/integrations/aws/execution_ssm_command_document_created_by_rare_user.toml
nldcsc_elastic_rules/rules/integrations/aws/execution_ssm_sendcommand_by_rare_user.toml
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_dynamodb_scan_by_unusual_user.toml
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_dynamodb_table_exported_to_s3.toml
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_ec2_ami_shared_with_separate_account.toml
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_ec2_ebs_snapshot_shared_with_another_account.toml
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_ec2_export_task.toml
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_ec2_full_network_packet_capture_detected.toml
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_rds_snapshot_export.toml
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_rds_snapshot_shared_with_another_account.toml
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_s3_bucket_policy_added_for_external_account_access.toml
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_s3_bucket_policy_added_for_public_access.toml
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_s3_bucket_replicated_to_external_account.toml
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_s3_uncommon_client_user_agent.toml
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_sns_rare_protocol_subscription_by_user.toml
nldcsc_elastic_rules/rules/integrations/aws/impact_aws_eventbridge_rule_disabled_or_deleted.toml
nldcsc_elastic_rules/rules/integrations/aws/impact_aws_s3_bucket_enumeration_or_brute_force.toml
nldcsc_elastic_rules/rules/integrations/aws/impact_cloudtrail_logging_updated.toml
nldcsc_elastic_rules/rules/integrations/aws/impact_cloudwatch_log_group_deletion.toml
nldcsc_elastic_rules/rules/integrations/aws/impact_cloudwatch_log_stream_deletion.toml
nldcsc_elastic_rules/rules/integrations/aws/impact_ec2_disable_ebs_encryption.toml
nldcsc_elastic_rules/rules/integrations/aws/impact_ec2_ebs_snapshot_access_removed.toml
nldcsc_elastic_rules/rules/integrations/aws/impact_efs_filesystem_deleted.toml
nldcsc_elastic_rules/rules/integrations/aws/impact_iam_deactivate_mfa_device.toml
nldcsc_elastic_rules/rules/integrations/aws/impact_iam_group_deletion.toml
nldcsc_elastic_rules/rules/integrations/aws/impact_kms_cmk_disabled_or_scheduled_for_deletion.toml
nldcsc_elastic_rules/rules/integrations/aws/impact_rds_instance_cluster_deletion.toml
nldcsc_elastic_rules/rules/integrations/aws/impact_rds_instance_cluster_deletion_protection_disabled.toml
nldcsc_elastic_rules/rules/integrations/aws/impact_rds_snapshot_deleted.toml
nldcsc_elastic_rules/rules/integrations/aws/impact_s3_bucket_object_uploaded_with_ransom_keyword.toml
nldcsc_elastic_rules/rules/integrations/aws/impact_s3_excessive_object_encryption_with_sse_c.toml
nldcsc_elastic_rules/rules/integrations/aws/impact_s3_object_encryption_with_external_key.toml
nldcsc_elastic_rules/rules/integrations/aws/impact_s3_object_versioning_disabled.toml
nldcsc_elastic_rules/rules/integrations/aws/impact_s3_static_site_js_file_uploaded.toml
nldcsc_elastic_rules/rules/integrations/aws/impact_s3_unusual_object_encryption_with_sse_c.toml
nldcsc_elastic_rules/rules/integrations/aws/initial_access_console_login_root.toml
nldcsc_elastic_rules/rules/integrations/aws/initial_access_iam_session_token_used_from_multiple_addresses.toml
nldcsc_elastic_rules/rules/integrations/aws/initial_access_kali_user_agent_detected_with_aws_cli.toml
nldcsc_elastic_rules/rules/integrations/aws/initial_access_password_recovery.toml
nldcsc_elastic_rules/rules/integrations/aws/initial_access_signin_console_login_federated_user.toml
nldcsc_elastic_rules/rules/integrations/aws/lateral_movement_aws_ssm_start_session_to_ec2_instance.toml
nldcsc_elastic_rules/rules/integrations/aws/lateral_movement_ec2_instance_connect_ssh_public_key_uploaded.toml
nldcsc_elastic_rules/rules/integrations/aws/lateral_movement_ec2_instance_console_login.toml
nldcsc_elastic_rules/rules/integrations/aws/lateral_movement_sns_topic_message_publish_by_rare_user.toml
nldcsc_elastic_rules/rules/integrations/aws/ml_cloudtrail_error_message_spike.toml
nldcsc_elastic_rules/rules/integrations/aws/ml_cloudtrail_rare_error_code.toml
nldcsc_elastic_rules/rules/integrations/aws/ml_cloudtrail_rare_method_by_city.toml
nldcsc_elastic_rules/rules/integrations/aws/ml_cloudtrail_rare_method_by_country.toml
nldcsc_elastic_rules/rules/integrations/aws/ml_cloudtrail_rare_method_by_user.toml
nldcsc_elastic_rules/rules/integrations/aws/persistence_aws_attempt_to_register_virtual_mfa_device.toml
nldcsc_elastic_rules/rules/integrations/aws/persistence_ec2_network_acl_creation.toml
nldcsc_elastic_rules/rules/integrations/aws/persistence_ec2_route_table_modified_or_deleted.toml
nldcsc_elastic_rules/rules/integrations/aws/persistence_ec2_security_group_configuration_change_detection.toml
nldcsc_elastic_rules/rules/integrations/aws/persistence_iam_api_calls_via_user_session_token.toml
nldcsc_elastic_rules/rules/integrations/aws/persistence_iam_create_login_profile_for_root.toml
nldcsc_elastic_rules/rules/integrations/aws/persistence_iam_create_user_via_assumed_role_on_ec2_instance.toml
nldcsc_elastic_rules/rules/integrations/aws/persistence_iam_group_creation.toml
nldcsc_elastic_rules/rules/integrations/aws/persistence_iam_oidc_provider_created.toml
nldcsc_elastic_rules/rules/integrations/aws/persistence_iam_roles_anywhere_profile_created.toml
nldcsc_elastic_rules/rules/integrations/aws/persistence_iam_roles_anywhere_trusted_anchor_created_with_external_ca.toml
nldcsc_elastic_rules/rules/integrations/aws/persistence_iam_saml_provider_created.toml
nldcsc_elastic_rules/rules/integrations/aws/persistence_iam_user_created_access_keys_for_another_user.toml
nldcsc_elastic_rules/rules/integrations/aws/persistence_lambda_backdoor_invoke_function_for_any_principal.toml
nldcsc_elastic_rules/rules/integrations/aws/persistence_rds_db_instance_password_modified.toml
nldcsc_elastic_rules/rules/integrations/aws/persistence_rds_instance_made_public.toml
nldcsc_elastic_rules/rules/integrations/aws/persistence_route_53_domain_transfer_lock_disabled.toml
nldcsc_elastic_rules/rules/integrations/aws/persistence_route_53_domain_transferred_to_another_account.toml
nldcsc_elastic_rules/rules/integrations/aws/persistence_route_53_hosted_zone_associated_with_a_vpc.toml
nldcsc_elastic_rules/rules/integrations/aws/persistence_route_table_created.toml
nldcsc_elastic_rules/rules/integrations/aws/persistence_sensitive_operations_via_cloudshell.toml
nldcsc_elastic_rules/rules/integrations/aws/persistence_sts_assume_role_with_new_mfa.toml
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_iam_administratoraccess_policy_attached_to_group.toml
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_iam_administratoraccess_policy_attached_to_role.toml
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_iam_administratoraccess_policy_attached_to_user.toml
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_iam_customer_managed_policy_attached_to_role.toml
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_iam_saml_provider_updated.toml
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_iam_update_assume_role_policy.toml
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_role_assumption_by_service.toml
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_role_assumption_by_user.toml
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_sts_assume_root_from_rare_user_and_member_account.toml
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_sts_role_chaining.toml
nldcsc_elastic_rules/rules/integrations/aws/resource_development_sns_topic_created_by_rare_user.toml
nldcsc_elastic_rules/rules/integrations/aws_bedrock/aws_bedrock_execution_without_guardrails.toml
nldcsc_elastic_rules/rules/integrations/aws_bedrock/aws_bedrock_guardrails_multiple_violations_by_single_user.toml
nldcsc_elastic_rules/rules/integrations/aws_bedrock/aws_bedrock_guardrails_multiple_violations_in_single_request.toml
nldcsc_elastic_rules/rules/integrations/aws_bedrock/aws_bedrock_high_confidence_misconduct_blocks_detected.toml
nldcsc_elastic_rules/rules/integrations/aws_bedrock/aws_bedrock_high_resource_consumption_detection.toml
nldcsc_elastic_rules/rules/integrations/aws_bedrock/aws_bedrock_multiple_attempts_to_use_denied_models_by_user.toml
nldcsc_elastic_rules/rules/integrations/aws_bedrock/aws_bedrock_multiple_sensitive_information_policy_blocks_detected.toml
nldcsc_elastic_rules/rules/integrations/aws_bedrock/aws_bedrock_multiple_topic_policy_blocks_detected.toml
nldcsc_elastic_rules/rules/integrations/aws_bedrock/aws_bedrock_multiple_validation_exception_errors_by_single_user.toml
nldcsc_elastic_rules/rules/integrations/aws_bedrock/aws_bedrock_multiple_word_policy_blocks_detected.toml
nldcsc_elastic_rules/rules/integrations/azure/collection_azure_storage_account_blob_public_access_enabled.toml
nldcsc_elastic_rules/rules/integrations/azure/collection_entra_id_sharepoint_access_from_unusual_application.toml
nldcsc_elastic_rules/rules/integrations/azure/collection_graph_email_access_by_unusual_public_client_via_graph.toml
nldcsc_elastic_rules/rules/integrations/azure/credential_access_azure_entra_susp_device_code_signin.toml
nldcsc_elastic_rules/rules/integrations/azure/credential_access_azure_service_principal_signin_then_arc_credential_listing.toml
nldcsc_elastic_rules/rules/integrations/azure/credential_access_azure_storage_account_keys_accessed.toml
nldcsc_elastic_rules/rules/integrations/azure/credential_access_entra_id_brute_force_activity.toml
nldcsc_elastic_rules/rules/integrations/azure/credential_access_entra_id_excessive_account_lockouts.toml
nldcsc_elastic_rules/rules/integrations/azure/credential_access_entra_id_signin_brute_force_microsoft_365.toml
nldcsc_elastic_rules/rules/integrations/azure/credential_access_entra_id_suspicious_signin.toml
nldcsc_elastic_rules/rules/integrations/azure/credential_access_entra_id_totp_brute_force_attempts.toml
nldcsc_elastic_rules/rules/integrations/azure/credential_access_key_vault_excessive_retrieval.toml
nldcsc_elastic_rules/rules/integrations/azure/credential_access_key_vault_retrieval_from_rare_identity.toml
nldcsc_elastic_rules/rules/integrations/azure/credential_access_network_full_network_packet_capture_detected.toml
nldcsc_elastic_rules/rules/integrations/azure/credential_access_storage_account_key_regenerated.toml
nldcsc_elastic_rules/rules/integrations/azure/defense_evasion_automation_runbook_deleted.toml
nldcsc_elastic_rules/rules/integrations/azure/defense_evasion_event_hub_deletion.toml
nldcsc_elastic_rules/rules/integrations/azure/defense_evasion_insights_diagnostic_settings_deletion.toml
nldcsc_elastic_rules/rules/integrations/azure/defense_evasion_kubernetes_events_deleted.toml
nldcsc_elastic_rules/rules/integrations/azure/defense_evasion_network_firewall_policy_deletion.toml
nldcsc_elastic_rules/rules/integrations/azure/defense_evasion_network_frontdoor_firewall_policy_deletion.toml
nldcsc_elastic_rules/rules/integrations/azure/defense_evasion_network_watcher_deletion.toml
nldcsc_elastic_rules/rules/integrations/azure/defense_evasion_security_alert_suppression_rule_created.toml
nldcsc_elastic_rules/rules/integrations/azure/defense_evasion_storage_blob_permissions_modified.toml
nldcsc_elastic_rules/rules/integrations/azure/discovery_bloodhound_user_agents_detected.toml
nldcsc_elastic_rules/rules/integrations/azure/discovery_entra_id_teamfiltration_user_agents_detected.toml
nldcsc_elastic_rules/rules/integrations/azure/discovery_storage_blob_container_access_modification.toml
nldcsc_elastic_rules/rules/integrations/azure/execution_automation_runbook_created_or_modified.toml
nldcsc_elastic_rules/rules/integrations/azure/execution_compute_vm_command_executed.toml
nldcsc_elastic_rules/rules/integrations/azure/exfiltration_azure_storage_blob_download_azcopy_sas_token.toml
nldcsc_elastic_rules/rules/integrations/azure/impact_azure_compute_restore_point_collection_deleted.toml
nldcsc_elastic_rules/rules/integrations/azure/impact_azure_compute_restore_point_collections_deleted.toml
nldcsc_elastic_rules/rules/integrations/azure/impact_azure_compute_vm_snapshot_deletion.toml
nldcsc_elastic_rules/rules/integrations/azure/impact_azure_compute_vm_snapshot_deletions.toml
nldcsc_elastic_rules/rules/integrations/azure/impact_azure_storage_account_deletion.toml
nldcsc_elastic_rules/rules/integrations/azure/impact_azure_storage_account_deletion_multiple.toml
nldcsc_elastic_rules/rules/integrations/azure/impact_key_vault_modified_by_unusual_user.toml
nldcsc_elastic_rules/rules/integrations/azure/impact_kubernetes_pod_deleted.toml
nldcsc_elastic_rules/rules/integrations/azure/impact_resources_resource_group_deletion.toml
nldcsc_elastic_rules/rules/integrations/azure/initial_access_azure_arc_cluster_credential_access_unusual_source.toml
nldcsc_elastic_rules/rules/integrations/azure/initial_access_azure_service_principal_signin_multiple_countries.toml
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_actor_token_user_impersonation_abuse.toml
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_device_code_auth_with_broker_client.toml
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_external_guest_user_invite.toml
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_federated_login_by_unusual_client.toml
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_first_time_seen_device_code_auth.toml
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_graph_single_session_from_multiple_addresses.toml
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_high_risk_signin.toml
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_illicit_consent_grant_via_registered_application.toml
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_oauth_auth_code_grant_unusual_app_resource_user.toml
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_oauth_phishing_via_first_party_microsoft_application.toml
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_oauth_user_impersonation_scope.toml
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_powershell_signin.toml
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_protection_alerts_for_user.toml
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_protection_confirmed_compromise.toml
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_protection_sign_in_risk_detected.toml
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_protection_user_risk_detected.toml
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_rare_app_id_for_principal_auth.toml
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_rare_authentication_requirement_for_principal_user.toml
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_risky_user_or_compromised_sign_in.toml
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_suspicious_oauth_flow_via_auth_broker_to_drs.toml
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_unusual_ropc_login_attempt.toml
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_user_reported_risk.toml
nldcsc_elastic_rules/rules/integrations/azure/initial_access_graph_first_occurrence_of_client_request.toml
nldcsc_elastic_rules/rules/integrations/azure/ml_azure_event_failures.toml
nldcsc_elastic_rules/rules/integrations/azure/ml_azure_rare_event_failures.toml
nldcsc_elastic_rules/rules/integrations/azure/ml_azure_rare_method_by_city.toml
nldcsc_elastic_rules/rules/integrations/azure/ml_azure_rare_method_by_country.toml
nldcsc_elastic_rules/rules/integrations/azure/ml_azure_rare_method_by_user.toml
nldcsc_elastic_rules/rules/integrations/azure/persistence_automation_account_created.toml
nldcsc_elastic_rules/rules/integrations/azure/persistence_automation_webhook_created.toml
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_application_credential_modification.toml
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_conditional_access_policy_modified.toml
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_global_administrator_role_assigned.toml
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_mfa_disabled_for_user.toml
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_pim_user_added_global_admin.toml
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_privileged_identity_management_role_modified.toml
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_rt_to_prt_transition_from_user_device.toml
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_service_principal_created.toml
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_service_principal_credentials_added.toml
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_service_principal_federated_issuer_modified.toml
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_suspicious_adrs_token_request.toml
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_suspicious_cloud_device_registration.toml
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_user_added_as_owner_for_azure_application.toml
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_user_added_as_owner_for_azure_service_principal.toml
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_user_signed_in_from_unusual_device.toml
nldcsc_elastic_rules/rules/integrations/azure/persistence_event_hub_created_or_updated.toml
nldcsc_elastic_rules/rules/integrations/azure/persistence_graph_eam_addition_or_modification.toml
nldcsc_elastic_rules/rules/integrations/azure/persistence_identity_protect_alert_followed_by_device_reg.toml
nldcsc_elastic_rules/rules/integrations/azure/privilege_escalation_azure_rbac_administrator_roles_assigned.toml
nldcsc_elastic_rules/rules/integrations/azure/privilege_escalation_entra_id_elevate_to_user_administrator_access.toml
nldcsc_elastic_rules/rules/integrations/azure/privilege_escalation_entra_id_tenant_domain_federation_via_audit_logs.toml
nldcsc_elastic_rules/rules/integrations/azure/privilege_escalation_kubernetes_aks_rolebinding_created.toml
nldcsc_elastic_rules/rules/integrations/azure/resource_development_entra_id_custom_domain_added_and_verified.toml
nldcsc_elastic_rules/rules/integrations/azure_openai/azure_openai_denial_of_ml_service_detection.toml
nldcsc_elastic_rules/rules/integrations/azure_openai/azure_openai_insecure_output_handling_detection.toml
nldcsc_elastic_rules/rules/integrations/azure_openai/azure_openai_model_theft_detection.toml
nldcsc_elastic_rules/rules/integrations/beaconing/command_and_control_beaconing.toml
nldcsc_elastic_rules/rules/integrations/beaconing/command_and_control_beaconing_high_confidence.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/command_and_control_curl_socks_proxy_detected_inside_container.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/command_and_control_interactive_file_download_from_internet.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/command_and_control_tunneling_and_port_forwarding.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/container_workload_protection.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/credential_access_cloud_creds_search_inside_a_container.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/credential_access_collection_sensitive_files_compression_inside_a_container.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/credential_access_sensitive_keys_or_passwords_search_inside_a_container.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/credential_access_service_account_token_or_cert_read.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/defense_evasion_decoded_payload_piped_to_interpreter.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/defense_evasion_deletion_of_shell_cmdline_history.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/defense_evasion_file_creation_execution_deletion_cradle.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/defense_evasion_interactive_process_execution_from_suspicious_directory.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/defense_evasion_ld_preload_shared_object_modified_inside_a_container.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/defense_evasion_potential_evasion_via_encoded_payload.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/discovery_dns_enumeration.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/discovery_environment_enumeration.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/discovery_kubelet_certificate_file_access.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/discovery_kubelet_pod_discovery_via_builtin_utilities.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/discovery_potential_cluster_enumeration_via_jq.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/discovery_privilege_boundary_enumeration_from_interactive_process.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/discovery_service_account_namespace_read.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/discovery_suspicious_network_tool_launched_inside_a_container.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/discovery_tool_enumeration.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_container_management_binary_launched_inside_a_container.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_direct_interactive_kubernetes_api_request.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_interactive_exec_to_container.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_interactive_file_creation_followed_by_execution.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_interactive_file_creation_in_system_binary_locations.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_interactive_shell_spawned_from_inside_a_container.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_kubeletctl_execution.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_netcat_listener_established_inside_a_container.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_payload_downloaded_and_piped_to_shell.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_potential_direct_kubelet_access_via_process_args.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_suspicious_file_made_executable_via_chmod_inside_a_container.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_suspicious_interactive_interpreter_command_execution.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_tool_installation.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/impact_process_killing.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/persistence_modification_of_persistence_relevant_files.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/persistence_ssh_authorized_keys_modification_inside_a_container.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/persistence_suspicious_echo_or_printf_execution.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/persistence_suspicious_webserver_child_process_execution.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/privilege_escalation_chroot_execution_detected_inside_container.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/privilege_escalation_debugfs_launched_inside_a_privileged_container.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/privilege_escalation_mount_launched_inside_a_privileged_container.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/privilege_escalation_potential_container_escape_via_modified_notify_on_release_file.toml
nldcsc_elastic_rules/rules/integrations/cloud_defend/privilege_escalation_potential_container_escape_via_modified_release_agent_file.toml
nldcsc_elastic_rules/rules/integrations/cyberarkpas/privilege_escalation_cyberarkpas_error_audit_event_promotion.toml
nldcsc_elastic_rules/rules/integrations/cyberarkpas/privilege_escalation_cyberarkpas_recommended_events_to_monitor_promotion.toml
nldcsc_elastic_rules/rules/integrations/ded/exfiltration_ml_high_bytes_destination_geo_country_iso_code.toml
nldcsc_elastic_rules/rules/integrations/ded/exfiltration_ml_high_bytes_destination_ip.toml
nldcsc_elastic_rules/rules/integrations/ded/exfiltration_ml_high_bytes_destination_port.toml
nldcsc_elastic_rules/rules/integrations/ded/exfiltration_ml_high_bytes_destination_region_name.toml
nldcsc_elastic_rules/rules/integrations/ded/exfiltration_ml_high_bytes_written_to_external_device.toml
nldcsc_elastic_rules/rules/integrations/ded/exfiltration_ml_high_bytes_written_to_external_device_airdrop.toml
nldcsc_elastic_rules/rules/integrations/ded/exfiltration_ml_rare_process_writing_to_external_device.toml
nldcsc_elastic_rules/rules/integrations/dga/command_and_control_ml_dga_activity_using_sunburst_domain.toml
nldcsc_elastic_rules/rules/integrations/dga/command_and_control_ml_dga_high_sum_probability.toml
nldcsc_elastic_rules/rules/integrations/dga/command_and_control_ml_dns_request_high_dga_probability.toml
nldcsc_elastic_rules/rules/integrations/dga/command_and_control_ml_dns_request_predicted_to_be_a_dga_domain.toml
nldcsc_elastic_rules/rules/integrations/endpoint/defense_evasion_elastic_memory_threat_detected.toml
nldcsc_elastic_rules/rules/integrations/endpoint/defense_evasion_elastic_memory_threat_prevented.toml
nldcsc_elastic_rules/rules/integrations/endpoint/elastic_endpoint_security.toml
nldcsc_elastic_rules/rules/integrations/endpoint/elastic_endpoint_security_behavior_detected.toml
nldcsc_elastic_rules/rules/integrations/endpoint/elastic_endpoint_security_behavior_prevented.toml
nldcsc_elastic_rules/rules/integrations/endpoint/execution_elastic_malicious_file_detected.toml
nldcsc_elastic_rules/rules/integrations/endpoint/execution_elastic_malicious_file_prevented.toml
nldcsc_elastic_rules/rules/integrations/endpoint/impact_elastic_ransomware_detected.toml
nldcsc_elastic_rules/rules/integrations/endpoint/impact_elastic_ransomware_prevented.toml
nldcsc_elastic_rules/rules/integrations/fim/persistence_suspicious_file_modifications.toml
nldcsc_elastic_rules/rules/integrations/gcp/collection_gcp_pub_sub_subscription_creation.toml
nldcsc_elastic_rules/rules/integrations/gcp/collection_gcp_pub_sub_topic_creation.toml
nldcsc_elastic_rules/rules/integrations/gcp/defense_evasion_gcp_firewall_rule_created.toml
nldcsc_elastic_rules/rules/integrations/gcp/defense_evasion_gcp_firewall_rule_deleted.toml
nldcsc_elastic_rules/rules/integrations/gcp/defense_evasion_gcp_firewall_rule_modified.toml
nldcsc_elastic_rules/rules/integrations/gcp/defense_evasion_gcp_logging_bucket_deletion.toml
nldcsc_elastic_rules/rules/integrations/gcp/defense_evasion_gcp_logging_sink_deletion.toml
nldcsc_elastic_rules/rules/integrations/gcp/defense_evasion_gcp_pub_sub_subscription_deletion.toml
nldcsc_elastic_rules/rules/integrations/gcp/defense_evasion_gcp_pub_sub_topic_deletion.toml
nldcsc_elastic_rules/rules/integrations/gcp/defense_evasion_gcp_storage_bucket_configuration_modified.toml
nldcsc_elastic_rules/rules/integrations/gcp/defense_evasion_gcp_storage_bucket_permissions_modified.toml
nldcsc_elastic_rules/rules/integrations/gcp/defense_evasion_gcp_virtual_private_cloud_network_deleted.toml
nldcsc_elastic_rules/rules/integrations/gcp/defense_evasion_gcp_virtual_private_cloud_route_created.toml
nldcsc_elastic_rules/rules/integrations/gcp/defense_evasion_gcp_virtual_private_cloud_route_deleted.toml
nldcsc_elastic_rules/rules/integrations/gcp/exfiltration_gcp_logging_sink_modification.toml
nldcsc_elastic_rules/rules/integrations/gcp/impact_gcp_iam_role_deletion.toml
nldcsc_elastic_rules/rules/integrations/gcp/impact_gcp_service_account_deleted.toml
nldcsc_elastic_rules/rules/integrations/gcp/impact_gcp_service_account_disabled.toml
nldcsc_elastic_rules/rules/integrations/gcp/impact_gcp_storage_bucket_deleted.toml
nldcsc_elastic_rules/rules/integrations/gcp/initial_access_gcp_iam_custom_role_creation.toml
nldcsc_elastic_rules/rules/integrations/gcp/ml_gcp_error_message_spike.toml
nldcsc_elastic_rules/rules/integrations/gcp/ml_gcp_rare_error_code.toml
nldcsc_elastic_rules/rules/integrations/gcp/ml_gcp_rare_method_by_city.toml
nldcsc_elastic_rules/rules/integrations/gcp/ml_gcp_rare_method_by_country.toml
nldcsc_elastic_rules/rules/integrations/gcp/ml_gcp_rare_method_by_user.toml
nldcsc_elastic_rules/rules/integrations/gcp/persistence_gcp_iam_service_account_key_deletion.toml
nldcsc_elastic_rules/rules/integrations/gcp/persistence_gcp_key_created_for_service_account.toml
nldcsc_elastic_rules/rules/integrations/gcp/persistence_gcp_service_account_created.toml
nldcsc_elastic_rules/rules/integrations/github/defense_evasion_github_protected_branch_settings_changed.toml
nldcsc_elastic_rules/rules/integrations/github/defense_evasion_secret_scanning_disabled.toml
nldcsc_elastic_rules/rules/integrations/github/execution_github_app_deleted.toml
nldcsc_elastic_rules/rules/integrations/github/execution_github_high_number_of_cloned_repos_from_pat.toml
nldcsc_elastic_rules/rules/integrations/github/execution_github_ueba_multiple_behavior_alerts_from_account.toml
nldcsc_elastic_rules/rules/integrations/github/execution_new_github_app_installed.toml
nldcsc_elastic_rules/rules/integrations/github/exfiltration_github_private_repository_turned_public.toml
nldcsc_elastic_rules/rules/integrations/github/exfiltration_high_number_of_cloning_by_user.toml
nldcsc_elastic_rules/rules/integrations/github/impact_github_repository_activity_from_unusual_ip.toml
nldcsc_elastic_rules/rules/integrations/github/impact_github_repository_deleted.toml
nldcsc_elastic_rules/rules/integrations/github/impact_high_number_of_closed_pull_requests_by_user.toml
nldcsc_elastic_rules/rules/integrations/github/impact_high_number_of_failed_protected_branch_force_pushes_by_user.toml
nldcsc_elastic_rules/rules/integrations/github/impact_high_number_of_protected_branch_force_pushes_by_user.toml
nldcsc_elastic_rules/rules/integrations/github/initial_access_github_actions_bot_first_push_to_repo.toml
nldcsc_elastic_rules/rules/integrations/github/initial_access_github_actions_workflow_injection_blocked.toml
nldcsc_elastic_rules/rules/integrations/github/initial_access_github_register_self_hosted_runner.toml
nldcsc_elastic_rules/rules/integrations/github/persistence_github_org_owner_added.toml
nldcsc_elastic_rules/rules/integrations/github/persistence_new_pat_created.toml
nldcsc_elastic_rules/rules/integrations/github/persistence_organization_owner_role_granted.toml
nldcsc_elastic_rules/rules/integrations/google_workspace/collection_google_drive_ownership_transferred_via_google_workspace.toml
nldcsc_elastic_rules/rules/integrations/google_workspace/collection_google_workspace_custom_gmail_route_created_or_modified.toml
nldcsc_elastic_rules/rules/integrations/google_workspace/credential_access_google_workspace_drive_encryption_key_accessed_by_anonymous_user.toml
nldcsc_elastic_rules/rules/integrations/google_workspace/defense_evasion_application_removed_from_blocklist_in_google_workspace.toml
nldcsc_elastic_rules/rules/integrations/google_workspace/defense_evasion_domain_added_to_google_workspace_trusted_domains.toml
nldcsc_elastic_rules/rules/integrations/google_workspace/defense_evasion_google_workspace_bitlocker_setting_disabled.toml
nldcsc_elastic_rules/rules/integrations/google_workspace/defense_evasion_google_workspace_new_oauth_login_from_third_party_application.toml
nldcsc_elastic_rules/rules/integrations/google_workspace/defense_evasion_restrictions_for_marketplace_modified_to_allow_any_app.toml
nldcsc_elastic_rules/rules/integrations/google_workspace/google_workspace_alert_center_promotion.toml
nldcsc_elastic_rules/rules/integrations/google_workspace/impact_google_workspace_admin_role_deletion.toml
nldcsc_elastic_rules/rules/integrations/google_workspace/impact_google_workspace_mfa_enforcement_disabled.toml
nldcsc_elastic_rules/rules/integrations/google_workspace/initial_access_external_user_added_to_google_workspace_group.toml
nldcsc_elastic_rules/rules/integrations/google_workspace/initial_access_google_workspace_suspended_user_renewed.toml
nldcsc_elastic_rules/rules/integrations/google_workspace/initial_access_object_copied_to_external_drive_with_app_consent.toml
nldcsc_elastic_rules/rules/integrations/google_workspace/persistence_application_added_to_google_workspace_domain.toml
nldcsc_elastic_rules/rules/integrations/google_workspace/persistence_google_workspace_2sv_policy_disabled.toml
nldcsc_elastic_rules/rules/integrations/google_workspace/persistence_google_workspace_admin_role_assigned_to_user.toml
nldcsc_elastic_rules/rules/integrations/google_workspace/persistence_google_workspace_api_access_granted_via_dwd.toml
nldcsc_elastic_rules/rules/integrations/google_workspace/persistence_google_workspace_custom_admin_role_created.toml
nldcsc_elastic_rules/rules/integrations/google_workspace/persistence_google_workspace_password_policy_modified.toml
nldcsc_elastic_rules/rules/integrations/google_workspace/persistence_google_workspace_role_modified.toml
nldcsc_elastic_rules/rules/integrations/google_workspace/persistence_google_workspace_user_organizational_unit_changed.toml
nldcsc_elastic_rules/rules/integrations/google_workspace/persistence_mfa_disabled_for_google_workspace_organization.toml
nldcsc_elastic_rules/rules/integrations/kubernetes/credential_access_azure_arc_proxy_secret_configmap_access.toml
nldcsc_elastic_rules/rules/integrations/kubernetes/credential_access_get_secrets_access.toml
nldcsc_elastic_rules/rules/integrations/kubernetes/defense_evasion_events_deleted.toml
nldcsc_elastic_rules/rules/integrations/kubernetes/discovery_denied_service_account_request.toml
nldcsc_elastic_rules/rules/integrations/kubernetes/discovery_endpoint_permission_enumeration_by_anonymous_user.toml
nldcsc_elastic_rules/rules/integrations/kubernetes/discovery_endpoint_permission_enumeration_by_user_and_srcip.toml
nldcsc_elastic_rules/rules/integrations/kubernetes/discovery_suspicious_self_subject_review.toml
nldcsc_elastic_rules/rules/integrations/kubernetes/execution_anonymous_create_update_patch_pod_request.toml
nldcsc_elastic_rules/rules/integrations/kubernetes/execution_forbidden_creation_request.toml
nldcsc_elastic_rules/rules/integrations/kubernetes/execution_forbidden_request_from_unsual_user_agent.toml
nldcsc_elastic_rules/rules/integrations/kubernetes/execution_unusual_request_response_by_user_agent.toml
nldcsc_elastic_rules/rules/integrations/kubernetes/execution_user_exec_to_pod.toml
nldcsc_elastic_rules/rules/integrations/kubernetes/initial_access_anonymous_request_authorized.toml
nldcsc_elastic_rules/rules/integrations/kubernetes/persistence_cluster_admin_rolebinding_created.toml
nldcsc_elastic_rules/rules/integrations/kubernetes/persistence_exposed_service_created_with_type_nodeport.toml
nldcsc_elastic_rules/rules/integrations/kubernetes/persistence_sensitive_role_creation_or_modification.toml
nldcsc_elastic_rules/rules/integrations/kubernetes/persistence_service_account_bound_to_clusterrole.toml
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_container_created_with_excessive_linux_capabilities.toml
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_pod_created_with_hostipc.toml
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_pod_created_with_hostnetwork.toml
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_pod_created_with_hostpid.toml
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_pod_created_with_sensitive_hostpath_volume.toml
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_privileged_pod_created.toml
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_sensitive_rbac_change_followed_by_workload_modification.toml
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_sensitive_workload_modification_by_user_agent.toml
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_service_account_rbac_write_operation.toml
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_suspicious_assignment_of_controller_service_account.toml
nldcsc_elastic_rules/rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_process_args.toml
nldcsc_elastic_rules/rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_session_duration.toml
nldcsc_elastic_rules/rules/integrations/lmd/lateral_movement_ml_high_remote_file_size.toml
nldcsc_elastic_rules/rules/integrations/lmd/lateral_movement_ml_high_variance_rdp_session_duration.toml
nldcsc_elastic_rules/rules/integrations/lmd/lateral_movement_ml_rare_remote_file_directory.toml
nldcsc_elastic_rules/rules/integrations/lmd/lateral_movement_ml_rare_remote_file_extension.toml
nldcsc_elastic_rules/rules/integrations/lmd/lateral_movement_ml_spike_in_connections_from_a_source_ip.toml
nldcsc_elastic_rules/rules/integrations/lmd/lateral_movement_ml_spike_in_connections_to_a_destination_ip.toml
nldcsc_elastic_rules/rules/integrations/lmd/lateral_movement_ml_spike_in_rdp_processes.toml
nldcsc_elastic_rules/rules/integrations/lmd/lateral_movement_ml_spike_in_remote_file_transfers.toml
nldcsc_elastic_rules/rules/integrations/lmd/lateral_movement_ml_unusual_time_for_an_rdp_session.toml
nldcsc_elastic_rules/rules/integrations/microsoft_exchange_online_message_trace/initial_access_azure_monitor_callback_phishing_email.toml
nldcsc_elastic_rules/rules/integrations/o365/collection_exchange_excessive_mail_items_accessed.toml
nldcsc_elastic_rules/rules/integrations/o365/collection_exchange_mailbox_access_by_unusual_client_app_id.toml
nldcsc_elastic_rules/rules/integrations/o365/collection_exchange_new_inbox_rule.toml
nldcsc_elastic_rules/rules/integrations/o365/collection_onedrive_excessive_file_downloads.toml
nldcsc_elastic_rules/rules/integrations/o365/collection_sharepoint_file_download_via_powershell.toml
nldcsc_elastic_rules/rules/integrations/o365/credential_access_entra_id_device_reg_via_oauth_redirection.toml
nldcsc_elastic_rules/rules/integrations/o365/credential_access_entra_id_potential_user_account_brute_force.toml
nldcsc_elastic_rules/rules/integrations/o365/credential_access_identity_user_account_lockouts.toml
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_entra_id_susp_oauth2_authorization.toml
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_exchange_anti_phish_policy_deletion.toml
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_exchange_anti_phish_rule_modification.toml
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_exchange_dkim_signing_config_disabled.toml
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_exchange_dlp_policy_removed.toml
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_exchange_exchange_safelinks_disabled.toml
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_exchange_mailbox_audit_bypass_association.toml
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_exchange_malware_filter_policy_deletion.toml
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_exchange_malware_filter_rule_mod.toml
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_exchange_new_inbox_rule_delete_or_move.toml
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_exchange_safe_attach_rule_disabled.toml
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_mfa_notification_email_deleted.toml
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_sharepoint_sharing_policy_weakened.toml
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_teams_custom_app_interaction_allowed.toml
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_teams_external_access_enabled.toml
nldcsc_elastic_rules/rules/integrations/o365/discovery_sharepoint_sensitive_term_search.toml
nldcsc_elastic_rules/rules/integrations/o365/exfiltration_exchange_transport_rule_creation.toml
nldcsc_elastic_rules/rules/integrations/o365/exfiltration_exchange_transport_rule_modification.toml
nldcsc_elastic_rules/rules/integrations/o365/impact_security_compliance_potential_ransomware_activity.toml
nldcsc_elastic_rules/rules/integrations/o365/impact_security_compliance_unusual_volume_of_file_deletion.toml
nldcsc_elastic_rules/rules/integrations/o365/initial_access_entra_id_portal_login_atypical_travel.toml
nldcsc_elastic_rules/rules/integrations/o365/initial_access_entra_id_portal_login_impossible_travel.toml
nldcsc_elastic_rules/rules/integrations/o365/initial_access_identity_illicit_consent_grant_via_registered_application.toml
nldcsc_elastic_rules/rules/integrations/o365/initial_access_identity_oauth_phishing_via_first_party_microsoft_application.toml
nldcsc_elastic_rules/rules/integrations/o365/initial_access_identity_unusual_sso_errors_for_user.toml
nldcsc_elastic_rules/rules/integrations/o365/initial_access_security_compliance_user_reported_phish_malware.toml
nldcsc_elastic_rules/rules/integrations/o365/initial_access_security_compliance_user_restricted_from_sending_email.toml
nldcsc_elastic_rules/rules/integrations/o365/lateral_movement_onedrive_malware_uploaded.toml
nldcsc_elastic_rules/rules/integrations/o365/lateral_movement_sharepoint_malware_uploaded.toml
nldcsc_elastic_rules/rules/integrations/o365/persistence_entra_id_global_administrator_role_assign.toml
nldcsc_elastic_rules/rules/integrations/o365/persistence_exchange_management_role_assignment.toml
nldcsc_elastic_rules/rules/integrations/o365/persistence_exchange_suspicious_mailbox_permission_delegation.toml
nldcsc_elastic_rules/rules/integrations/o365/persistence_teams_guest_access_enabled.toml
nldcsc_elastic_rules/rules/integrations/o365/privilege_escalation_exchange_new_or_modified_federation_domain.toml
nldcsc_elastic_rules/rules/integrations/o365/privilege_escalation_sharepoint_site_collection_admin_added.toml
nldcsc_elastic_rules/rules/integrations/okta/credential_access_attempted_bypass_of_okta_mfa.toml
nldcsc_elastic_rules/rules/integrations/okta/credential_access_attempts_to_brute_force_okta_user_account.toml
nldcsc_elastic_rules/rules/integrations/okta/credential_access_multiple_auth_events_from_single_device_behind_proxy.toml
nldcsc_elastic_rules/rules/integrations/okta/credential_access_multiple_device_token_hashes_for_single_okta_session.toml
nldcsc_elastic_rules/rules/integrations/okta/credential_access_multiple_user_agent_os_authentication.toml
nldcsc_elastic_rules/rules/integrations/okta/credential_access_okta_aitm_session_cookie_replay.toml
nldcsc_elastic_rules/rules/integrations/okta/credential_access_okta_authentication_for_multiple_users_with_the_same_device_token_hash.toml
nldcsc_elastic_rules/rules/integrations/okta/credential_access_okta_brute_force_device_token_rotation.toml
nldcsc_elastic_rules/rules/integrations/okta/credential_access_okta_brute_force_multi_source.toml
nldcsc_elastic_rules/rules/integrations/okta/credential_access_okta_credential_stuffing_single_source.toml
nldcsc_elastic_rules/rules/integrations/okta/credential_access_okta_mfa_bombing_via_push_notifications.toml
nldcsc_elastic_rules/rules/integrations/okta/credential_access_okta_password_spray_multi_source.toml
nldcsc_elastic_rules/rules/integrations/okta/credential_access_okta_password_spray_single_source.toml
nldcsc_elastic_rules/rules/integrations/okta/credential_access_okta_potentially_successful_okta_bombing_via_push_notifications.toml
nldcsc_elastic_rules/rules/integrations/okta/credential_access_okta_successful_login_after_credential_attack.toml
nldcsc_elastic_rules/rules/integrations/okta/credential_access_user_impersonation_access.toml
nldcsc_elastic_rules/rules/integrations/okta/defense_evasion_attempt_to_deactivate_okta_network_zone.toml
nldcsc_elastic_rules/rules/integrations/okta/defense_evasion_attempt_to_delete_okta_network_zone.toml
nldcsc_elastic_rules/rules/integrations/okta/defense_evasion_first_occurence_public_app_client_credential_token_exchange.toml
nldcsc_elastic_rules/rules/integrations/okta/defense_evasion_okta_attempt_to_deactivate_okta_policy.toml
nldcsc_elastic_rules/rules/integrations/okta/defense_evasion_okta_attempt_to_deactivate_okta_policy_rule.toml
nldcsc_elastic_rules/rules/integrations/okta/defense_evasion_okta_attempt_to_delete_okta_policy.toml
nldcsc_elastic_rules/rules/integrations/okta/defense_evasion_okta_attempt_to_delete_okta_policy_rule.toml
nldcsc_elastic_rules/rules/integrations/okta/defense_evasion_okta_attempt_to_modify_okta_network_zone.toml
nldcsc_elastic_rules/rules/integrations/okta/defense_evasion_okta_attempt_to_modify_okta_policy.toml
nldcsc_elastic_rules/rules/integrations/okta/defense_evasion_okta_attempt_to_modify_okta_policy_rule.toml
nldcsc_elastic_rules/rules/integrations/okta/defense_evasion_suspicious_okta_user_password_reset_or_unlock_attempts.toml
nldcsc_elastic_rules/rules/integrations/okta/impact_attempt_to_revoke_okta_api_token.toml
nldcsc_elastic_rules/rules/integrations/okta/impact_okta_attempt_to_deactivate_okta_application.toml
nldcsc_elastic_rules/rules/integrations/okta/impact_okta_attempt_to_delete_okta_application.toml
nldcsc_elastic_rules/rules/integrations/okta/impact_okta_attempt_to_modify_okta_application.toml
nldcsc_elastic_rules/rules/integrations/okta/impact_possible_okta_dos_attack.toml
nldcsc_elastic_rules/rules/integrations/okta/initial_access_first_occurrence_user_session_started_via_proxy.toml
nldcsc_elastic_rules/rules/integrations/okta/initial_access_okta_fastpass_phishing.toml
nldcsc_elastic_rules/rules/integrations/okta/initial_access_okta_suspicious_activity_after_proxy_authentication.toml
nldcsc_elastic_rules/rules/integrations/okta/initial_access_okta_user_attempted_unauthorized_access.toml
nldcsc_elastic_rules/rules/integrations/okta/initial_access_okta_user_sessions_started_from_different_geolocations.toml
nldcsc_elastic_rules/rules/integrations/okta/initial_access_sign_in_events_via_third_party_idp.toml
nldcsc_elastic_rules/rules/integrations/okta/initial_access_successful_application_sso_from_unknown_client_device.toml
nldcsc_elastic_rules/rules/integrations/okta/initial_access_suspicious_activity_reported_by_okta_user.toml
nldcsc_elastic_rules/rules/integrations/okta/lateral_movement_multiple_sessions_for_single_user.toml
nldcsc_elastic_rules/rules/integrations/okta/okta_threatinsight_threat_suspected_promotion.toml
nldcsc_elastic_rules/rules/integrations/okta/persistence_administrator_privileges_assigned_to_okta_group.toml
nldcsc_elastic_rules/rules/integrations/okta/persistence_administrator_role_assigned_to_okta_user.toml
nldcsc_elastic_rules/rules/integrations/okta/persistence_attempt_to_create_okta_api_token.toml
nldcsc_elastic_rules/rules/integrations/okta/persistence_attempt_to_reset_mfa_factors_for_okta_user_account.toml
nldcsc_elastic_rules/rules/integrations/okta/persistence_mfa_deactivation_with_no_reactivation.toml
nldcsc_elastic_rules/rules/integrations/okta/persistence_new_idp_successfully_added_by_admin.toml
nldcsc_elastic_rules/rules/integrations/okta/persistence_okta_attempt_to_modify_or_delete_application_sign_on_policy.toml
nldcsc_elastic_rules/rules/integrations/okta/persistence_stolen_credentials_used_to_login_to_okta_account_after_mfa_reset.toml
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_linux_high_count_privileged_process_events_by_user.toml
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_linux_high_median_process_command_line_entropy_by_user.toml
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_linux_rare_process_executed_by_user.toml
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_okta_high_sum_concurrent_sessions_by_user.toml
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_okta_rare_host_name_by_user.toml
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_okta_rare_region_name_by_user.toml
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_okta_rare_source_ip_by_user.toml
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_okta_spike_in_group_application_assignment_changes.toml
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_okta_spike_in_group_lifecycle_changes.toml
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_okta_spike_in_group_membership_changes.toml
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_okta_spike_in_group_privilege_changes.toml
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_okta_spike_in_user_lifecycle_management_changes.toml
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_windows_high_count_group_management_events.toml
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_windows_high_count_special_logon_events.toml
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_windows_high_count_special_privilege_use_events.toml
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_windows_high_count_user_account_management_events.toml
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_windows_rare_device_by_user.toml
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_windows_rare_group_name_by_user.toml
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_windows_rare_privilege_assigned_to_user.toml
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_windows_rare_region_name_by_user.toml
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_windows_rare_source_ip_by_user.toml
nldcsc_elastic_rules/rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml
nldcsc_elastic_rules/rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_parent_process.toml
nldcsc_elastic_rules/rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_user.toml
nldcsc_elastic_rules/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_event_high_probability.toml
nldcsc_elastic_rules/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_event_low_probability.toml
nldcsc_elastic_rules/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_host.toml
nldcsc_elastic_rules/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_parent_process.toml
nldcsc_elastic_rules/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_user.toml
nldcsc_elastic_rules/rules/linux/collection_linux_clipboard_activity.toml
nldcsc_elastic_rules/rules/linux/collection_potential_audio_recording_activity.toml
nldcsc_elastic_rules/rules/linux/collection_potential_video_recording_or_screenshot_activity.toml
nldcsc_elastic_rules/rules/linux/command_and_control_aws_cli_endpoint_url_used.toml
nldcsc_elastic_rules/rules/linux/command_and_control_cat_network_activity.toml
nldcsc_elastic_rules/rules/linux/command_and_control_cupsd_foomatic_rip_netcon.toml
nldcsc_elastic_rules/rules/linux/command_and_control_curl_socks_proxy_detected.toml
nldcsc_elastic_rules/rules/linux/command_and_control_frequent_egress_netcon_from_sus_executable.toml
nldcsc_elastic_rules/rules/linux/command_and_control_git_repo_or_file_download_to_sus_dir.toml
nldcsc_elastic_rules/rules/linux/command_and_control_ip_forwarding_activity.toml
nldcsc_elastic_rules/rules/linux/command_and_control_linux_chisel_client_activity.toml
nldcsc_elastic_rules/rules/linux/command_and_control_linux_kworker_netcon.toml
nldcsc_elastic_rules/rules/linux/command_and_control_linux_proxychains_activity.toml
nldcsc_elastic_rules/rules/linux/command_and_control_linux_ssh_x11_forwarding.toml
nldcsc_elastic_rules/rules/linux/command_and_control_linux_suspicious_proxychains_activity.toml
nldcsc_elastic_rules/rules/linux/command_and_control_linux_tunneling_and_port_forwarding.toml
nldcsc_elastic_rules/rules/linux/command_and_control_linux_tunneling_via_ssh_option.toml
nldcsc_elastic_rules/rules/linux/command_and_control_potential_tunneling_command_line.toml
nldcsc_elastic_rules/rules/linux/command_and_control_suspicious_network_activity_from_unknown_executable.toml
nldcsc_elastic_rules/rules/linux/command_and_control_telegram_api_request.toml
nldcsc_elastic_rules/rules/linux/command_and_control_tunneling_via_earthworm.toml
nldcsc_elastic_rules/rules/linux/credential_access_aws_creds_search_inside_container.toml
nldcsc_elastic_rules/rules/linux/credential_access_collection_sensitive_files.toml
nldcsc_elastic_rules/rules/linux/credential_access_collection_sensitive_files_compression_inside_container.toml
nldcsc_elastic_rules/rules/linux/credential_access_credential_dumping.toml
nldcsc_elastic_rules/rules/linux/credential_access_gdb_init_process_hooking.toml
nldcsc_elastic_rules/rules/linux/credential_access_gdb_process_hooking.toml
nldcsc_elastic_rules/rules/linux/credential_access_gh_auth_via_nodejs.toml
nldcsc_elastic_rules/rules/linux/credential_access_kubernetes_service_account_secret_access.toml
nldcsc_elastic_rules/rules/linux/credential_access_manual_memory_dumping.toml
nldcsc_elastic_rules/rules/linux/credential_access_potential_linux_local_account_bruteforce.toml
nldcsc_elastic_rules/rules/linux/credential_access_potential_linux_ssh_bruteforce_external.toml
nldcsc_elastic_rules/rules/linux/credential_access_potential_linux_ssh_bruteforce_internal.toml
nldcsc_elastic_rules/rules/linux/credential_access_potential_password_spraying_attack.toml
nldcsc_elastic_rules/rules/linux/credential_access_potential_successful_linux_ssh_bruteforce.toml
nldcsc_elastic_rules/rules/linux/credential_access_proc_credential_dumping.toml
nldcsc_elastic_rules/rules/linux/credential_access_sensitive_keys_or_passwords_search_inside_container.toml
nldcsc_elastic_rules/rules/linux/credential_access_ssh_backdoor_log.toml
nldcsc_elastic_rules/rules/linux/credential_access_ssh_password_grabbing_via_strace.toml
nldcsc_elastic_rules/rules/linux/credential_access_unusual_instance_metadata_service_api_request.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_acl_modification_via_setfacl.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_apparmor_exploitation_via_sys_fs.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_apparmor_policy_access.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_apparmor_policy_violation.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_apparmor_profile_compilation.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_attempt_to_disable_auditd_service.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_attempt_to_disable_iptables_or_firewall.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_attempt_to_disable_syslog_service.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_authorized_keys_file_deletion.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_base16_or_base32_encoding_or_decoding_activity.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_base64_decoding_activity.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_binary_copied_to_suspicious_directory.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_bpf_program_tampering.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_busybox_indirect_shell_spawn.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_chattr_immutable_file.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_clear_kernel_ring_buffer.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_creation_of_hidden_files_directories.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_curl_or_wget_executed_via_lolbin.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_directory_creation_in_bin.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_disable_apparmor_attempt.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_disable_selinux_attempt.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_doas_configuration_creation_or_rename.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_dynamic_linker_file_creation.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_esxi_suspicious_timestomp_touch.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_file_deletion_via_shred.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_file_mod_writable_dir.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_hex_payload_execution_via_commandline.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_hex_payload_execution_via_utility.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_hidden_directory_creation.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_hidden_file_dir_tmp.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_hidden_shared_object.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_interactive_shell_from_system_user.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_interpreter_launched_from_decoded_payload.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_journalctl_clear_logs.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_kernel_module_removal.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_kill_command_executed.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_kthreadd_masquerading.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_ld_preload_cmdline.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_ld_so_creation.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_log_files_deleted.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_mount_execution.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_multi_base64_decoding_attempt.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_potential_proot_exploits.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_prctl_process_name_tampering.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_rename_esxi_files.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_root_certificate_installation.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_selinux_configuration_creation_or_renaming.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_ssl_certificate_deletion.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_sus_utility_executed_via_tmux_or_screen.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_suspicious_path_mounted.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_symlink_binary_to_writable_dir.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_sysctl_kernel_feature_activity.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_unsual_kill_signal.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_unusual_preload_env_vars.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_user_or_group_deletion.toml
nldcsc_elastic_rules/rules/linux/defense_evasion_var_log_file_creation_by_unsual_process.toml
nldcsc_elastic_rules/rules/linux/discovery_dmidecode_system_discovery.toml
nldcsc_elastic_rules/rules/linux/discovery_docker_socket_discovery.toml
nldcsc_elastic_rules/rules/linux/discovery_dynamic_linker_via_od.toml
nldcsc_elastic_rules/rules/linux/discovery_esxi_software_via_find.toml
nldcsc_elastic_rules/rules/linux/discovery_esxi_software_via_grep.toml
nldcsc_elastic_rules/rules/linux/discovery_kernel_instrumentation_discovery_via_kprobes_and_tracefs.toml
nldcsc_elastic_rules/rules/linux/discovery_kernel_module_enumeration.toml
nldcsc_elastic_rules/rules/linux/discovery_kernel_seeking.toml
nldcsc_elastic_rules/rules/linux/discovery_kernel_unpacking.toml
nldcsc_elastic_rules/rules/linux/discovery_kubeconfig_file_discovery.toml
nldcsc_elastic_rules/rules/linux/discovery_linux_hping_activity.toml
nldcsc_elastic_rules/rules/linux/discovery_linux_nping_activity.toml
nldcsc_elastic_rules/rules/linux/discovery_manual_mount_discovery_via_exports_or_fstab.toml
nldcsc_elastic_rules/rules/linux/discovery_pam_version_discovery.toml
nldcsc_elastic_rules/rules/linux/discovery_ping_sweep_detected.toml
nldcsc_elastic_rules/rules/linux/discovery_polkit_version_discovery.toml
nldcsc_elastic_rules/rules/linux/discovery_port_scanning_activity_from_compromised_host.toml
nldcsc_elastic_rules/rules/linux/discovery_private_key_password_searching_activity.toml
nldcsc_elastic_rules/rules/linux/discovery_proc_maps_read.toml
nldcsc_elastic_rules/rules/linux/discovery_process_capabilities.toml
nldcsc_elastic_rules/rules/linux/discovery_security_file_access_via_common_utility.toml
nldcsc_elastic_rules/rules/linux/discovery_subnet_scanning_activity_from_compromised_host.toml
nldcsc_elastic_rules/rules/linux/discovery_sudo_allowed_command_enumeration.toml
nldcsc_elastic_rules/rules/linux/discovery_suid_sguid_enumeration.toml
nldcsc_elastic_rules/rules/linux/discovery_suspicious_memory_grep_activity.toml
nldcsc_elastic_rules/rules/linux/discovery_suspicious_network_tool_launched_inside_container.toml
nldcsc_elastic_rules/rules/linux/discovery_suspicious_which_command_execution.toml
nldcsc_elastic_rules/rules/linux/discovery_unusual_user_enumeration_via_id.toml
nldcsc_elastic_rules/rules/linux/discovery_virtual_machine_fingerprinting.toml
nldcsc_elastic_rules/rules/linux/discovery_yum_dnf_plugin_detection.toml
nldcsc_elastic_rules/rules/linux/execution_abnormal_process_id_file_created.toml
nldcsc_elastic_rules/rules/linux/execution_container_management_binary_launched_inside_container.toml
nldcsc_elastic_rules/rules/linux/execution_cupsd_foomatic_rip_file_creation.toml
nldcsc_elastic_rules/rules/linux/execution_cupsd_foomatic_rip_lp_user_execution.toml
nldcsc_elastic_rules/rules/linux/execution_cupsd_foomatic_rip_shell_execution.toml
nldcsc_elastic_rules/rules/linux/execution_cupsd_foomatic_rip_suspicious_child_execution.toml
nldcsc_elastic_rules/rules/linux/execution_egress_connection_from_entrypoint_in_container.toml
nldcsc_elastic_rules/rules/linux/execution_executable_stack_execution.toml
nldcsc_elastic_rules/rules/linux/execution_file_execution_followed_by_deletion.toml
nldcsc_elastic_rules/rules/linux/execution_file_made_executable_via_chmod_inside_container.toml
nldcsc_elastic_rules/rules/linux/execution_file_transfer_or_listener_established_via_netcat.toml
nldcsc_elastic_rules/rules/linux/execution_interpreter_tty_upgrade.toml
nldcsc_elastic_rules/rules/linux/execution_kubectl_apply_pod_from_url.toml
nldcsc_elastic_rules/rules/linux/execution_nc_listener_via_rlwrap.toml
nldcsc_elastic_rules/rules/linux/execution_netcon_from_rwx_mem_region_binary.toml
nldcsc_elastic_rules/rules/linux/execution_network_event_post_compilation.toml
nldcsc_elastic_rules/rules/linux/execution_perl_tty_shell.toml
nldcsc_elastic_rules/rules/linux/execution_potential_hack_tool_executed.toml
nldcsc_elastic_rules/rules/linux/execution_potentially_overly_permissive_container_creation.toml
nldcsc_elastic_rules/rules/linux/execution_process_backgrounded_by_unusual_parent.toml
nldcsc_elastic_rules/rules/linux/execution_process_started_from_process_id_file.toml
nldcsc_elastic_rules/rules/linux/execution_process_started_in_shared_memory_directory.toml
nldcsc_elastic_rules/rules/linux/execution_python_tty_shell.toml
nldcsc_elastic_rules/rules/linux/execution_python_webserver_spawned.toml
nldcsc_elastic_rules/rules/linux/execution_remote_code_execution_via_postgresql.toml
nldcsc_elastic_rules/rules/linux/execution_shell_evasion_linux_binary.toml
nldcsc_elastic_rules/rules/linux/execution_shell_openssl_client_or_server.toml
nldcsc_elastic_rules/rules/linux/execution_shell_via_background_process.toml
nldcsc_elastic_rules/rules/linux/execution_shell_via_child_tcp_utility_linux.toml
nldcsc_elastic_rules/rules/linux/execution_shell_via_java_revshell_linux.toml
nldcsc_elastic_rules/rules/linux/execution_shell_via_lolbin_interpreter_linux.toml
nldcsc_elastic_rules/rules/linux/execution_shell_via_meterpreter_linux.toml
nldcsc_elastic_rules/rules/linux/execution_shell_via_suspicious_binary.toml
nldcsc_elastic_rules/rules/linux/execution_shell_via_tcp_cli_utility_linux.toml
nldcsc_elastic_rules/rules/linux/execution_shell_via_udp_cli_utility_linux.toml
nldcsc_elastic_rules/rules/linux/execution_sus_extraction_or_decrompression_via_funzip.toml
nldcsc_elastic_rules/rules/linux/execution_suspicious_executable_running_system_commands.toml
nldcsc_elastic_rules/rules/linux/execution_suspicious_mining_process_creation_events.toml
nldcsc_elastic_rules/rules/linux/execution_suspicious_mkfifo_execution.toml
nldcsc_elastic_rules/rules/linux/execution_suspicious_pod_or_container_creation_command_execution.toml
nldcsc_elastic_rules/rules/linux/execution_system_binary_file_permission_change.toml
nldcsc_elastic_rules/rules/linux/execution_tc_bpf_filter.toml
nldcsc_elastic_rules/rules/linux/execution_unix_socket_communication.toml
nldcsc_elastic_rules/rules/linux/execution_unknown_rwx_mem_region_binary_executed.toml
nldcsc_elastic_rules/rules/linux/execution_unusual_interactive_process_inside_container.toml
nldcsc_elastic_rules/rules/linux/execution_unusual_kthreadd_execution.toml
nldcsc_elastic_rules/rules/linux/execution_unusual_path_invocation_from_command_line.toml
nldcsc_elastic_rules/rules/linux/execution_unusual_pkexec_execution.toml
nldcsc_elastic_rules/rules/linux/exfiltration_potential_data_splitting_for_exfiltration.toml
nldcsc_elastic_rules/rules/linux/exfiltration_potential_database_dumping.toml
nldcsc_elastic_rules/rules/linux/exfiltration_potential_wget_data_exfiltration.toml
nldcsc_elastic_rules/rules/linux/exfiltration_unusual_file_transfer_utility_launched.toml
nldcsc_elastic_rules/rules/linux/impact_data_encrypted_via_openssl.toml
nldcsc_elastic_rules/rules/linux/impact_esxi_process_kill.toml
nldcsc_elastic_rules/rules/linux/impact_memory_swap_modification.toml
nldcsc_elastic_rules/rules/linux/impact_potential_bruteforce_malware_infection.toml
nldcsc_elastic_rules/rules/linux/impact_potential_linux_ransomware_note_detected.toml
nldcsc_elastic_rules/rules/linux/impact_process_kill_threshold.toml
nldcsc_elastic_rules/rules/linux/initial_access_apache_struts_cve_2023_50164_exploitation_to_webshell.toml
nldcsc_elastic_rules/rules/linux/initial_access_first_time_public_key_authentication.toml
nldcsc_elastic_rules/rules/linux/initial_access_successful_ssh_authentication_by_unusual_ip.toml
nldcsc_elastic_rules/rules/linux/initial_access_successful_ssh_authentication_by_unusual_user.toml
nldcsc_elastic_rules/rules/linux/initial_access_telnet_auth_bypass_envar_auditd.toml
nldcsc_elastic_rules/rules/linux/initial_access_telnet_auth_bypass_via_user_envar.toml
nldcsc_elastic_rules/rules/linux/lateral_movement_kubeconfig_file_activity.toml
nldcsc_elastic_rules/rules/linux/lateral_movement_remote_file_creation_world_writeable_dir.toml
nldcsc_elastic_rules/rules/linux/lateral_movement_ssh_it_worm_download.toml
nldcsc_elastic_rules/rules/linux/lateral_movement_telnet_network_activity_external.toml
nldcsc_elastic_rules/rules/linux/lateral_movement_telnet_network_activity_internal.toml
nldcsc_elastic_rules/rules/linux/lateral_movement_unusual_remote_file_creation.toml
nldcsc_elastic_rules/rules/linux/persistence_apt_package_manager_execution.toml
nldcsc_elastic_rules/rules/linux/persistence_apt_package_manager_file_creation.toml
nldcsc_elastic_rules/rules/linux/persistence_apt_package_manager_netcon.toml
nldcsc_elastic_rules/rules/linux/persistence_at_job_creation.toml
nldcsc_elastic_rules/rules/linux/persistence_boot_file_copy.toml
nldcsc_elastic_rules/rules/linux/persistence_bpf_probe_write_user.toml
nldcsc_elastic_rules/rules/linux/persistence_bpf_program_or_map_load.toml
nldcsc_elastic_rules/rules/linux/persistence_chkconfig_service_add.toml
nldcsc_elastic_rules/rules/linux/persistence_credential_access_modify_ssh_binaries.toml
nldcsc_elastic_rules/rules/linux/persistence_cron_job_creation.toml
nldcsc_elastic_rules/rules/linux/persistence_dbus_service_creation.toml
nldcsc_elastic_rules/rules/linux/persistence_dbus_unsual_daemon_parent_execution.toml
nldcsc_elastic_rules/rules/linux/persistence_dnf_package_manager_plugin_file_creation.toml
nldcsc_elastic_rules/rules/linux/persistence_dpkg_package_installation_from_unusual_parent.toml
nldcsc_elastic_rules/rules/linux/persistence_dpkg_unusual_execution.toml
nldcsc_elastic_rules/rules/linux/persistence_dracut_module_creation.toml
nldcsc_elastic_rules/rules/linux/persistence_dynamic_linker_backup.toml
nldcsc_elastic_rules/rules/linux/persistence_extract_initramfs_via_cpio.toml
nldcsc_elastic_rules/rules/linux/persistence_git_hook_execution.toml
nldcsc_elastic_rules/rules/linux/persistence_git_hook_file_creation.toml
nldcsc_elastic_rules/rules/linux/persistence_git_hook_netcon.toml
nldcsc_elastic_rules/rules/linux/persistence_git_hook_process_execution.toml
nldcsc_elastic_rules/rules/linux/persistence_grub_configuration_creation.toml
nldcsc_elastic_rules/rules/linux/persistence_grub_makeconfig.toml
nldcsc_elastic_rules/rules/linux/persistence_init_d_file_creation.toml
nldcsc_elastic_rules/rules/linux/persistence_insmod_kernel_module_load.toml
nldcsc_elastic_rules/rules/linux/persistence_kde_autostart_modification.toml
nldcsc_elastic_rules/rules/linux/persistence_kernel_driver_load.toml
nldcsc_elastic_rules/rules/linux/persistence_kernel_driver_load_by_non_root.toml
nldcsc_elastic_rules/rules/linux/persistence_kernel_module_load_from_unusual_location.toml
nldcsc_elastic_rules/rules/linux/persistence_kernel_object_file_creation.toml
nldcsc_elastic_rules/rules/linux/persistence_kubernetes_sensitive_file_activity.toml
nldcsc_elastic_rules/rules/linux/persistence_kworker_file_creation.toml
nldcsc_elastic_rules/rules/linux/persistence_linux_backdoor_user_creation.toml
nldcsc_elastic_rules/rules/linux/persistence_linux_group_creation.toml
nldcsc_elastic_rules/rules/linux/persistence_linux_shell_activity_via_web_server.toml
nldcsc_elastic_rules/rules/linux/persistence_linux_user_account_creation.toml
nldcsc_elastic_rules/rules/linux/persistence_linux_user_added_to_privileged_group.toml
nldcsc_elastic_rules/rules/linux/persistence_lkm_configuration_file_creation.toml
nldcsc_elastic_rules/rules/linux/persistence_manual_dracut_execution.toml
nldcsc_elastic_rules/rules/linux/persistence_message_of_the_day_creation.toml
nldcsc_elastic_rules/rules/linux/persistence_message_of_the_day_execution.toml
nldcsc_elastic_rules/rules/linux/persistence_network_manager_dispatcher_persistence.toml
nldcsc_elastic_rules/rules/linux/persistence_openssl_passwd_hash_generation.toml
nldcsc_elastic_rules/rules/linux/persistence_pluggable_authentication_module_creation.toml
nldcsc_elastic_rules/rules/linux/persistence_pluggable_authentication_module_creation_in_unusual_dir.toml
nldcsc_elastic_rules/rules/linux/persistence_pluggable_authentication_module_pam_exec_backdoor_exec.toml
nldcsc_elastic_rules/rules/linux/persistence_pluggable_authentication_module_source_download.toml
nldcsc_elastic_rules/rules/linux/persistence_polkit_policy_creation.toml
nldcsc_elastic_rules/rules/linux/persistence_potential_persistence_script_executable_bit_set.toml
nldcsc_elastic_rules/rules/linux/persistence_process_capability_set_via_setcap.toml
nldcsc_elastic_rules/rules/linux/persistence_pth_file_creation.toml
nldcsc_elastic_rules/rules/linux/persistence_rc_local_error_via_syslog.toml
nldcsc_elastic_rules/rules/linux/persistence_rc_local_service_already_running.toml
nldcsc_elastic_rules/rules/linux/persistence_rc_script_creation.toml
nldcsc_elastic_rules/rules/linux/persistence_rpm_package_installation_from_unusual_parent.toml
nldcsc_elastic_rules/rules/linux/persistence_setuid_setgid_capability_set.toml
nldcsc_elastic_rules/rules/linux/persistence_shadow_file_modification.toml
nldcsc_elastic_rules/rules/linux/persistence_shared_object_creation.toml
nldcsc_elastic_rules/rules/linux/persistence_shell_configuration_modification.toml
nldcsc_elastic_rules/rules/linux/persistence_simple_web_server_connection_accepted.toml
nldcsc_elastic_rules/rules/linux/persistence_simple_web_server_creation.toml
nldcsc_elastic_rules/rules/linux/persistence_site_and_user_customize_file_creation.toml
nldcsc_elastic_rules/rules/linux/persistence_ssh_key_generation.toml
nldcsc_elastic_rules/rules/linux/persistence_ssh_netcon.toml
nldcsc_elastic_rules/rules/linux/persistence_ssh_via_backdoored_system_user.toml
nldcsc_elastic_rules/rules/linux/persistence_suspicious_file_opened_through_editor.toml
nldcsc_elastic_rules/rules/linux/persistence_suspicious_ssh_execution_xzbackdoor.toml
nldcsc_elastic_rules/rules/linux/persistence_systemd_generator_creation.toml
nldcsc_elastic_rules/rules/linux/persistence_systemd_netcon.toml
nldcsc_elastic_rules/rules/linux/persistence_systemd_scheduled_timer_created.toml
nldcsc_elastic_rules/rules/linux/persistence_systemd_service_creation.toml
nldcsc_elastic_rules/rules/linux/persistence_systemd_service_started.toml
nldcsc_elastic_rules/rules/linux/persistence_systemd_shell_execution.toml
nldcsc_elastic_rules/rules/linux/persistence_tainted_kernel_module_load.toml
nldcsc_elastic_rules/rules/linux/persistence_tainted_kernel_module_out_of_tree_load.toml
nldcsc_elastic_rules/rules/linux/persistence_udev_rule_creation.toml
nldcsc_elastic_rules/rules/linux/persistence_unpack_initramfs_via_unmkinitramfs.toml
nldcsc_elastic_rules/rules/linux/persistence_unusual_exim4_child_process.toml
nldcsc_elastic_rules/rules/linux/persistence_unusual_pam_grantor.toml
nldcsc_elastic_rules/rules/linux/persistence_unusual_sshd_child_process.toml
nldcsc_elastic_rules/rules/linux/persistence_user_credential_modification_via_echo.toml
nldcsc_elastic_rules/rules/linux/persistence_user_or_group_creation_or_modification.toml
nldcsc_elastic_rules/rules/linux/persistence_web_server_sus_child_spawned.toml
nldcsc_elastic_rules/rules/linux/persistence_web_server_sus_command_execution.toml
nldcsc_elastic_rules/rules/linux/persistence_web_server_sus_destination_port.toml
nldcsc_elastic_rules/rules/linux/persistence_web_server_unusual_command_execution.toml
nldcsc_elastic_rules/rules/linux/persistence_xdg_autostart_netcon.toml
nldcsc_elastic_rules/rules/linux/persistence_yum_package_manager_plugin_file_creation.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_chown_chmod_unauthorized_file_read.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_container_util_misconfiguration.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_cve_2025_32463_nsswitch_file_creation.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_cve_2025_32463_sudo_chroot_execution.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_cve_2025_41244_vmtoolsd_lpe.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_dac_permissions.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_debugfs_launched_inside_container.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_docker_escape_via_nsenter.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_docker_mount_chroot_container_escape.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_docker_release_file_creation.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_enlightenment_window_manager.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_gdb_sys_ptrace_elevation.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_gdb_sys_ptrace_netcon.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_kworker_uid_elevation.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_ld_preload_shared_object_modif.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_linux_suspicious_symbolic_link.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_load_and_unload_of_kernel_via_kexec.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_looney_tunables_cve_2023_4911.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_mount_launched_inside_container.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_overlayfs_local_privesc.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_pkexec_envar_hijack.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_potential_bufferoverflow_attack.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_potential_suid_sgid_exploitation.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_potential_suid_sgid_proxy_execution.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_potential_wildcard_shell_spawn.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_sda_disk_mount_non_root.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_shadow_file_read.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_snap_confine_lpe_via_cve_2026_3888.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_sudo_cve_2019_14287.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_sudo_hijacking.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_sudo_token_via_process_injection.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_suspicious_cap_setuid_python_execution.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_suspicious_chown_fowner_elevation.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_suspicious_passwd_file_write.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_suspicious_uid_guid_elevation.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_uid_change_post_compilation.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_uid_elevation_from_unknown_executable.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_unshare_namespace_manipulation.toml
nldcsc_elastic_rules/rules/linux/privilege_escalation_writable_docker_socket.toml
nldcsc_elastic_rules/rules/macos/collection_discovery_output_written_to_suspicious_file.toml
nldcsc_elastic_rules/rules/macos/collection_pbpaste_execution_via_unusual_parent.toml
nldcsc_elastic_rules/rules/macos/collection_sensitive_file_access_followed_by_compression.toml
nldcsc_elastic_rules/rules/macos/command_and_control_aws_s3_connection_via_script.toml
nldcsc_elastic_rules/rules/macos/command_and_control_executable_download_via_wget.toml
nldcsc_elastic_rules/rules/macos/command_and_control_google_calendar_c2_via_script.toml
nldcsc_elastic_rules/rules/macos/command_and_control_network_connection_to_oast_domain.toml
nldcsc_elastic_rules/rules/macos/command_and_control_perl_outbound_network_connection.toml
nldcsc_elastic_rules/rules/macos/command_and_control_potential_etherhiding_c2.toml
nldcsc_elastic_rules/rules/macos/command_and_control_script_interpreter_connection_to_non_standard_port.toml
nldcsc_elastic_rules/rules/macos/command_and_control_suspicious_curl_from_macos_application.toml
nldcsc_elastic_rules/rules/macos/command_and_control_suspicious_curl_to_google_app_script.toml
nldcsc_elastic_rules/rules/macos/command_and_control_suspicious_outbound_network_via_unsigned_binary.toml
nldcsc_elastic_rules/rules/macos/command_and_control_unusual_connection_to_suspicious_top_level_domain.toml
nldcsc_elastic_rules/rules/macos/command_and_control_unusual_network_connection_to_suspicious_web_service.toml
nldcsc_elastic_rules/rules/macos/credential_access_credentials_keychains.toml
nldcsc_elastic_rules/rules/macos/credential_access_dumping_hashes_bi_cmds.toml
nldcsc_elastic_rules/rules/macos/credential_access_dumping_keychain_security.toml
nldcsc_elastic_rules/rules/macos/credential_access_high_volume_of_pbpaste.toml
nldcsc_elastic_rules/rules/macos/credential_access_kerberosdump_kcc.toml
nldcsc_elastic_rules/rules/macos/credential_access_keychain_pwd_retrieval_security_cmd.toml
nldcsc_elastic_rules/rules/macos/credential_access_mitm_localhost_webproxy.toml
nldcsc_elastic_rules/rules/macos/credential_access_potential_macos_ssh_bruteforce.toml
nldcsc_elastic_rules/rules/macos/credential_access_promt_for_pwd_via_osascript.toml
nldcsc_elastic_rules/rules/macos/credential_access_python_sensitive_file_access_first_occurrence.toml
nldcsc_elastic_rules/rules/macos/credential_access_suspicious_web_browser_sensitive_file_access.toml
nldcsc_elastic_rules/rules/macos/credential_access_systemkey_dumping.toml
nldcsc_elastic_rules/rules/macos/defense_evasion_apple_softupdates_modification.toml
nldcsc_elastic_rules/rules/macos/defense_evasion_attempt_del_quarantine_attrib.toml
nldcsc_elastic_rules/rules/macos/defense_evasion_attempt_to_disable_gatekeeper.toml
nldcsc_elastic_rules/rules/macos/defense_evasion_dylib_injection_via_env_vars.toml
nldcsc_elastic_rules/rules/macos/defense_evasion_gatekeeper_override_and_execution.toml
nldcsc_elastic_rules/rules/macos/defense_evasion_install_root_certificate.toml
nldcsc_elastic_rules/rules/macos/defense_evasion_modify_environment_launchctl.toml
nldcsc_elastic_rules/rules/macos/defense_evasion_privacy_controls_tcc_database_modification.toml
nldcsc_elastic_rules/rules/macos/defense_evasion_privilege_escalation_privacy_pref_sshd_fulldiskaccess.toml
nldcsc_elastic_rules/rules/macos/defense_evasion_safari_config_change.toml
nldcsc_elastic_rules/rules/macos/defense_evasion_sandboxed_office_app_suspicious_zip_file.toml
nldcsc_elastic_rules/rules/macos/defense_evasion_suspicious_tcc_access_granted.toml
nldcsc_elastic_rules/rules/macos/defense_evasion_tcc_bypass_mounted_apfs_access.toml
nldcsc_elastic_rules/rules/macos/defense_evasion_unload_endpointsecurity_kext.toml
nldcsc_elastic_rules/rules/macos/discovery_dns_request_for_ip_lookup_service.toml
nldcsc_elastic_rules/rules/macos/discovery_external_ip_address_discovery_via_curl.toml
nldcsc_elastic_rules/rules/macos/discovery_full_disk_access_check.toml
nldcsc_elastic_rules/rules/macos/discovery_suspicious_sip_check.toml
nldcsc_elastic_rules/rules/macos/discovery_system_and_network_configuration_check.toml
nldcsc_elastic_rules/rules/macos/discovery_users_domain_built_in_commands.toml
nldcsc_elastic_rules/rules/macos/execution_defense_evasion_electron_app_childproc_node_js.toml
nldcsc_elastic_rules/rules/macos/execution_initial_access_suspicious_browser_childproc.toml
nldcsc_elastic_rules/rules/macos/execution_installer_package_spawned_network_event.toml
nldcsc_elastic_rules/rules/macos/execution_python_shell_spawn_first_occurrence.toml
nldcsc_elastic_rules/rules/macos/execution_script_via_automator_workflows.toml
nldcsc_elastic_rules/rules/macos/execution_scripting_osascript_exec_followed_by_netcon.toml
nldcsc_elastic_rules/rules/macos/execution_shell_execution_via_apple_scripting.toml
nldcsc_elastic_rules/rules/macos/execution_unusual_library_load_via_python.toml
nldcsc_elastic_rules/rules/macos/initial_access_suspicious_mac_ms_office_child_process.toml
nldcsc_elastic_rules/rules/macos/lateral_movement_credential_access_kerberos_bifrostconsole.toml
nldcsc_elastic_rules/rules/macos/lateral_movement_mounting_smb_share.toml
nldcsc_elastic_rules/rules/macos/lateral_movement_remote_ssh_login_enabled.toml
nldcsc_elastic_rules/rules/macos/lateral_movement_suspicious_curl_to_jamf_endpoint.toml
nldcsc_elastic_rules/rules/macos/lateral_movement_vpn_connection_attempt.toml
nldcsc_elastic_rules/rules/macos/persistence_account_creation_hide_at_logon.toml
nldcsc_elastic_rules/rules/macos/persistence_apple_mail_rule_modification.toml
nldcsc_elastic_rules/rules/macos/persistence_creation_change_launch_agents_file.toml
nldcsc_elastic_rules/rules/macos/persistence_creation_hidden_login_item_osascript.toml
nldcsc_elastic_rules/rules/macos/persistence_credential_access_authorization_plugin_creation.toml
nldcsc_elastic_rules/rules/macos/persistence_crontab_creation.toml
nldcsc_elastic_rules/rules/macos/persistence_curl_execution_via_shell_profile.toml
nldcsc_elastic_rules/rules/macos/persistence_defense_evasion_hidden_launch_agent_deamon_logonitem_process.toml
nldcsc_elastic_rules/rules/macos/persistence_directory_services_plugins_modification.toml
nldcsc_elastic_rules/rules/macos/persistence_docker_shortcuts_plist_modification.toml
nldcsc_elastic_rules/rules/macos/persistence_emond_rules_file_creation.toml
nldcsc_elastic_rules/rules/macos/persistence_emond_rules_process_execution.toml
nldcsc_elastic_rules/rules/macos/persistence_enable_root_account.toml
nldcsc_elastic_rules/rules/macos/persistence_evasion_hidden_launch_agent_deamon_creation.toml
nldcsc_elastic_rules/rules/macos/persistence_finder_sync_plugin_pluginkit.toml
nldcsc_elastic_rules/rules/macos/persistence_folder_action_scripts_runtime.toml
nldcsc_elastic_rules/rules/macos/persistence_hidden_plist_filename.toml
nldcsc_elastic_rules/rules/macos/persistence_login_logout_hooks_defaults.toml
nldcsc_elastic_rules/rules/macos/persistence_loginwindow_plist_modification.toml
nldcsc_elastic_rules/rules/macos/persistence_manual_chromium_extension_loading.toml
nldcsc_elastic_rules/rules/macos/persistence_modification_sublime_app_plugin_or_script.toml
nldcsc_elastic_rules/rules/macos/persistence_periodic_tasks_file_mdofiy.toml
nldcsc_elastic_rules/rules/macos/persistence_python_launch_agent_or_daemon_creation_first_occurrence.toml
nldcsc_elastic_rules/rules/macos/persistence_screensaver_engine_unexpected_child_process.toml
nldcsc_elastic_rules/rules/macos/persistence_screensaver_plist_file_modification.toml
nldcsc_elastic_rules/rules/macos/persistence_startup_item_plist_creation.toml
nldcsc_elastic_rules/rules/macos/persistence_suspicious_calendar_modification.toml
nldcsc_elastic_rules/rules/macos/persistence_suspicious_file_creation_via_pkg_install_script.toml
nldcsc_elastic_rules/rules/macos/persistence_suspicious_launch_agent_or_launch_daemon.toml
nldcsc_elastic_rules/rules/macos/persistence_via_atom_init_file_modification.toml
nldcsc_elastic_rules/rules/macos/privilege_escalation_applescript_with_admin_privs.toml
nldcsc_elastic_rules/rules/macos/privilege_escalation_explicit_creds_via_scripting.toml
nldcsc_elastic_rules/rules/macos/privilege_escalation_exploit_adobe_acrobat_updater.toml
nldcsc_elastic_rules/rules/macos/privilege_escalation_local_user_added_to_admin.toml
nldcsc_elastic_rules/rules/macos/privilege_escalation_root_crontab_filemod.toml
nldcsc_elastic_rules/rules/macos/privilege_escalation_user_added_to_admin_group.toml
nldcsc_elastic_rules/rules/ml/command_and_control_ml_packetbeat_dns_tunneling.toml
nldcsc_elastic_rules/rules/ml/command_and_control_ml_packetbeat_rare_dns_question.toml
nldcsc_elastic_rules/rules/ml/command_and_control_ml_packetbeat_rare_urls.toml
nldcsc_elastic_rules/rules/ml/command_and_control_ml_packetbeat_rare_user_agent.toml
nldcsc_elastic_rules/rules/ml/credential_access_ml_auth_spike_in_failed_logon_events.toml
nldcsc_elastic_rules/rules/ml/credential_access_ml_auth_spike_in_logon_events.toml
nldcsc_elastic_rules/rules/ml/credential_access_ml_auth_spike_in_logon_events_from_a_source_ip.toml
nldcsc_elastic_rules/rules/ml/credential_access_ml_linux_anomalous_metadata_process.toml
nldcsc_elastic_rules/rules/ml/credential_access_ml_linux_anomalous_metadata_user.toml
nldcsc_elastic_rules/rules/ml/credential_access_ml_suspicious_login_activity.toml
nldcsc_elastic_rules/rules/ml/credential_access_ml_windows_anomalous_metadata_process.toml
nldcsc_elastic_rules/rules/ml/credential_access_ml_windows_anomalous_metadata_user.toml
nldcsc_elastic_rules/rules/ml/discovery_ml_linux_system_information_discovery.toml
nldcsc_elastic_rules/rules/ml/discovery_ml_linux_system_network_configuration_discovery.toml
nldcsc_elastic_rules/rules/ml/discovery_ml_linux_system_network_connection_discovery.toml
nldcsc_elastic_rules/rules/ml/discovery_ml_linux_system_process_discovery.toml
nldcsc_elastic_rules/rules/ml/discovery_ml_linux_system_user_discovery.toml
nldcsc_elastic_rules/rules/ml/execution_ml_windows_anomalous_script.toml
nldcsc_elastic_rules/rules/ml/initial_access_ml_auth_rare_hour_for_a_user_to_logon.toml
nldcsc_elastic_rules/rules/ml/initial_access_ml_auth_rare_source_ip_for_a_user.toml
nldcsc_elastic_rules/rules/ml/initial_access_ml_auth_rare_user_logon.toml
nldcsc_elastic_rules/rules/ml/initial_access_ml_linux_anomalous_user_name.toml
nldcsc_elastic_rules/rules/ml/initial_access_ml_windows_anomalous_user_name.toml
nldcsc_elastic_rules/rules/ml/initial_access_ml_windows_rare_user_type10_remote_login.toml
nldcsc_elastic_rules/rules/ml/ml_high_count_events_for_a_host_name.toml
nldcsc_elastic_rules/rules/ml/ml_high_count_network_denies.toml
nldcsc_elastic_rules/rules/ml/ml_high_count_network_events.toml
nldcsc_elastic_rules/rules/ml/ml_linux_anomalous_network_activity.toml
nldcsc_elastic_rules/rules/ml/ml_linux_anomalous_network_port_activity.toml
nldcsc_elastic_rules/rules/ml/ml_low_count_events_for_a_host_name.toml
nldcsc_elastic_rules/rules/ml/ml_packetbeat_rare_server_domain.toml
nldcsc_elastic_rules/rules/ml/ml_rare_destination_country.toml
nldcsc_elastic_rules/rules/ml/ml_spike_in_traffic_to_a_country.toml
nldcsc_elastic_rules/rules/ml/ml_windows_anomalous_network_activity.toml
nldcsc_elastic_rules/rules/ml/persistence_ml_linux_anomalous_process_all_hosts.toml
nldcsc_elastic_rules/rules/ml/persistence_ml_rare_process_by_host_linux.toml
nldcsc_elastic_rules/rules/ml/persistence_ml_rare_process_by_host_windows.toml
nldcsc_elastic_rules/rules/ml/persistence_ml_windows_anomalous_path_activity.toml
nldcsc_elastic_rules/rules/ml/persistence_ml_windows_anomalous_process_all_hosts.toml
nldcsc_elastic_rules/rules/ml/persistence_ml_windows_anomalous_process_creation.toml
nldcsc_elastic_rules/rules/ml/persistence_ml_windows_anomalous_service.toml
nldcsc_elastic_rules/rules/ml/privilege_escalation_ml_linux_anomalous_sudo_activity.toml
nldcsc_elastic_rules/rules/ml/privilege_escalation_ml_windows_rare_user_runas_event.toml
nldcsc_elastic_rules/rules/ml/resource_development_ml_linux_anomalous_compiler_activity.toml
nldcsc_elastic_rules/rules/network/collection_fortigate_config_download.toml
nldcsc_elastic_rules/rules/network/command_and_control_accepted_default_telnet_port_connection.toml
nldcsc_elastic_rules/rules/network/command_and_control_cobalt_strike_beacon.toml
nldcsc_elastic_rules/rules/network/command_and_control_cobalt_strike_default_teamserver_cert.toml
nldcsc_elastic_rules/rules/network/command_and_control_download_rar_powershell_from_internet.toml
nldcsc_elastic_rules/rules/network/command_and_control_fin7_c2_behavior.toml
nldcsc_elastic_rules/rules/network/command_and_control_halfbaked_beacon.toml
nldcsc_elastic_rules/rules/network/command_and_control_nat_traversal_port_activity.toml
nldcsc_elastic_rules/rules/network/command_and_control_port_26_activity.toml
nldcsc_elastic_rules/rules/network/command_and_control_rdp_remote_desktop_protocol_from_the_internet.toml
nldcsc_elastic_rules/rules/network/command_and_control_vnc_virtual_network_computing_from_the_internet.toml
nldcsc_elastic_rules/rules/network/command_and_control_vnc_virtual_network_computing_to_the_internet.toml
nldcsc_elastic_rules/rules/network/defense_evasion_fortigate_overly_permissive_firewall_policy.toml
nldcsc_elastic_rules/rules/network/discovery_potential_network_sweep_detected.toml
nldcsc_elastic_rules/rules/network/discovery_potential_port_scan_detected.toml
nldcsc_elastic_rules/rules/network/discovery_potential_syn_port_scan_detected.toml
nldcsc_elastic_rules/rules/network/initial_access_fortigate_admin_login_multi_srcip.toml
nldcsc_elastic_rules/rules/network/initial_access_fortigate_sso_login_from_unusual_source.toml
nldcsc_elastic_rules/rules/network/initial_access_newly_observed_fortigate_admin_logon.toml
nldcsc_elastic_rules/rules/network/initial_access_react_server_components_rce_attempt.toml
nldcsc_elastic_rules/rules/network/initial_access_react_server_rce_network_alerts.toml
nldcsc_elastic_rules/rules/network/initial_access_rpc_remote_procedure_call_from_the_internet.toml
nldcsc_elastic_rules/rules/network/initial_access_rpc_remote_procedure_call_to_the_internet.toml
nldcsc_elastic_rules/rules/network/initial_access_smb_windows_file_sharing_activity_to_the_internet.toml
nldcsc_elastic_rules/rules/network/initial_access_unsecure_elasticsearch_node.toml
nldcsc_elastic_rules/rules/network/lateral_movement_dns_server_overflow.toml
nldcsc_elastic_rules/rules/network/persistence_fortigate_admin_creation_unusual_source.toml
nldcsc_elastic_rules/rules/network/persistence_fortigate_sso_login_followed_by_admin_creation.toml
nldcsc_elastic_rules/rules/network/persistence_fortigate_super_admin_account_creation.toml
nldcsc_elastic_rules/rules/promotions/credential_access_endgame_cred_dumping_detected.toml
nldcsc_elastic_rules/rules/promotions/credential_access_endgame_cred_dumping_prevented.toml
nldcsc_elastic_rules/rules/promotions/crowdstrike_external_alerts.toml
nldcsc_elastic_rules/rules/promotions/elastic_security_external_alerts.toml
nldcsc_elastic_rules/rules/promotions/endgame_adversary_behavior_detected.toml
nldcsc_elastic_rules/rules/promotions/endgame_malware_detected.toml
nldcsc_elastic_rules/rules/promotions/endgame_malware_prevented.toml
nldcsc_elastic_rules/rules/promotions/endgame_ransomware_detected.toml
nldcsc_elastic_rules/rules/promotions/endgame_ransomware_prevented.toml
nldcsc_elastic_rules/rules/promotions/execution_endgame_exploit_detected.toml
nldcsc_elastic_rules/rules/promotions/execution_endgame_exploit_prevented.toml
nldcsc_elastic_rules/rules/promotions/external_alerts.toml
nldcsc_elastic_rules/rules/promotions/google_secops_external_alerts.toml
nldcsc_elastic_rules/rules/promotions/ibm_qradar_external_alerts.toml
nldcsc_elastic_rules/rules/promotions/microsoft_sentinel_external_alerts.toml
nldcsc_elastic_rules/rules/promotions/privilege_escalation_endgame_cred_manipulation_detected.toml
nldcsc_elastic_rules/rules/promotions/privilege_escalation_endgame_cred_manipulation_prevented.toml
nldcsc_elastic_rules/rules/promotions/privilege_escalation_endgame_permission_theft_detected.toml
nldcsc_elastic_rules/rules/promotions/privilege_escalation_endgame_permission_theft_prevented.toml
nldcsc_elastic_rules/rules/promotions/privilege_escalation_endgame_process_injection_detected.toml
nldcsc_elastic_rules/rules/promotions/privilege_escalation_endgame_process_injection_prevented.toml
nldcsc_elastic_rules/rules/promotions/sentinelone_alert_external_alerts.toml
nldcsc_elastic_rules/rules/promotions/sentinelone_threat_external_alerts.toml
nldcsc_elastic_rules/rules/promotions/splunk_external_alerts.toml
nldcsc_elastic_rules/rules/threat_intel/threat_intel_indicator_match_address.toml
nldcsc_elastic_rules/rules/threat_intel/threat_intel_indicator_match_email.toml
nldcsc_elastic_rules/rules/threat_intel/threat_intel_indicator_match_hash.toml
nldcsc_elastic_rules/rules/threat_intel/threat_intel_indicator_match_registry.toml
nldcsc_elastic_rules/rules/threat_intel/threat_intel_indicator_match_url.toml
nldcsc_elastic_rules/rules/threat_intel/threat_intel_rapid7_threat_command.toml
nldcsc_elastic_rules/rules/windows/collection_email_outlook_mailbox_via_com.toml
nldcsc_elastic_rules/rules/windows/collection_email_powershell_exchange_mailbox.toml
nldcsc_elastic_rules/rules/windows/collection_mailbox_export_winlog.toml
nldcsc_elastic_rules/rules/windows/collection_posh_audio_capture.toml
nldcsc_elastic_rules/rules/windows/collection_posh_clipboard_capture.toml
nldcsc_elastic_rules/rules/windows/collection_posh_keylogger.toml
nldcsc_elastic_rules/rules/windows/collection_posh_mailbox.toml
nldcsc_elastic_rules/rules/windows/collection_posh_screen_grabber.toml
nldcsc_elastic_rules/rules/windows/collection_posh_webcam_video_capture.toml
nldcsc_elastic_rules/rules/windows/collection_winrar_encryption.toml
nldcsc_elastic_rules/rules/windows/command_and_control_certreq_postdata.toml
nldcsc_elastic_rules/rules/windows/command_and_control_common_webservices.toml
nldcsc_elastic_rules/rules/windows/command_and_control_dns_rmm_domains_non_browser.toml
nldcsc_elastic_rules/rules/windows/command_and_control_dns_susp_tld.toml
nldcsc_elastic_rules/rules/windows/command_and_control_dns_tunneling_nslookup.toml
nldcsc_elastic_rules/rules/windows/command_and_control_encrypted_channel_freesslcert.toml
nldcsc_elastic_rules/rules/windows/command_and_control_headless_browser.toml
nldcsc_elastic_rules/rules/windows/command_and_control_iexplore_via_com.toml
nldcsc_elastic_rules/rules/windows/command_and_control_ingress_transfer_bits.toml
nldcsc_elastic_rules/rules/windows/command_and_control_multiple_rmm_vendors_same_host.toml
nldcsc_elastic_rules/rules/windows/command_and_control_new_terms_commonly_abused_rmm.toml
nldcsc_elastic_rules/rules/windows/command_and_control_newly_observed_screenconnect_host_server.toml
nldcsc_elastic_rules/rules/windows/command_and_control_outlook_home_page.toml
nldcsc_elastic_rules/rules/windows/command_and_control_port_forwarding_added_registry.toml
nldcsc_elastic_rules/rules/windows/command_and_control_rdp_tunnel_plink.toml
nldcsc_elastic_rules/rules/windows/command_and_control_remcos_rat_iocs.toml
nldcsc_elastic_rules/rules/windows/command_and_control_remote_file_copy_desktopimgdownldr.toml
nldcsc_elastic_rules/rules/windows/command_and_control_remote_file_copy_mpcmdrun.toml
nldcsc_elastic_rules/rules/windows/command_and_control_remote_file_copy_powershell.toml
nldcsc_elastic_rules/rules/windows/command_and_control_remote_file_copy_scripts.toml
nldcsc_elastic_rules/rules/windows/command_and_control_rmm_after_msi_install.toml
nldcsc_elastic_rules/rules/windows/command_and_control_rmm_netsupport_susp_path.toml
nldcsc_elastic_rules/rules/windows/command_and_control_screenconnect_childproc.toml
nldcsc_elastic_rules/rules/windows/command_and_control_sunburst_c2_activity_detected.toml
nldcsc_elastic_rules/rules/windows/command_and_control_teamviewer_remote_file_copy.toml
nldcsc_elastic_rules/rules/windows/command_and_control_tool_transfer_via_curl.toml
nldcsc_elastic_rules/rules/windows/command_and_control_tunnel_cloudflared.toml
nldcsc_elastic_rules/rules/windows/command_and_control_tunnel_vscode.toml
nldcsc_elastic_rules/rules/windows/command_and_control_tunnel_yuze.toml
nldcsc_elastic_rules/rules/windows/command_and_control_velociraptor_shell_execution.toml
nldcsc_elastic_rules/rules/windows/credential_access_adidns_wildcard.toml
nldcsc_elastic_rules/rules/windows/credential_access_adidns_wpad_record.toml
nldcsc_elastic_rules/rules/windows/credential_access_browsers_unusual_parent.toml
nldcsc_elastic_rules/rules/windows/credential_access_bruteforce_admin_account.toml
nldcsc_elastic_rules/rules/windows/credential_access_bruteforce_multiple_logon_failure_followed_by_success.toml
nldcsc_elastic_rules/rules/windows/credential_access_bruteforce_multiple_logon_failure_same_srcip.toml
nldcsc_elastic_rules/rules/windows/credential_access_cmdline_dump_tool.toml
nldcsc_elastic_rules/rules/windows/credential_access_copy_ntds_sam_volshadowcp_cmdline.toml
nldcsc_elastic_rules/rules/windows/credential_access_credential_dumping_msbuild.toml
nldcsc_elastic_rules/rules/windows/credential_access_dcsync_newterm_subjectuser.toml
nldcsc_elastic_rules/rules/windows/credential_access_dcsync_replication_rights.toml
nldcsc_elastic_rules/rules/windows/credential_access_dcsync_user_backdoor.toml
nldcsc_elastic_rules/rules/windows/credential_access_disable_kerberos_preauth.toml
nldcsc_elastic_rules/rules/windows/credential_access_dnsnode_creation.toml
nldcsc_elastic_rules/rules/windows/credential_access_dollar_account_relay.toml
nldcsc_elastic_rules/rules/windows/credential_access_dollar_account_relay_kerberos.toml
nldcsc_elastic_rules/rules/windows/credential_access_dollar_account_relay_ntlm.toml
nldcsc_elastic_rules/rules/windows/credential_access_domain_backup_dpapi_private_keys.toml
nldcsc_elastic_rules/rules/windows/credential_access_dump_registry_hives.toml
nldcsc_elastic_rules/rules/windows/credential_access_generic_localdumps.toml
nldcsc_elastic_rules/rules/windows/credential_access_iis_connectionstrings_dumping.toml
nldcsc_elastic_rules/rules/windows/credential_access_imageload_azureadconnectauthsvc.toml
nldcsc_elastic_rules/rules/windows/credential_access_kerberoasting_unusual_process.toml
nldcsc_elastic_rules/rules/windows/credential_access_kerberos_coerce.toml
nldcsc_elastic_rules/rules/windows/credential_access_kerberos_coerce_dns.toml
nldcsc_elastic_rules/rules/windows/credential_access_kirbi_file.toml
nldcsc_elastic_rules/rules/windows/credential_access_ldap_attributes.toml
nldcsc_elastic_rules/rules/windows/credential_access_lsass_handle_via_malseclogon.toml
nldcsc_elastic_rules/rules/windows/credential_access_lsass_loaded_susp_dll.toml
nldcsc_elastic_rules/rules/windows/credential_access_lsass_memdump_file_created.toml
nldcsc_elastic_rules/rules/windows/credential_access_lsass_memdump_handle_access.toml
nldcsc_elastic_rules/rules/windows/credential_access_lsass_openprocess_api.toml
nldcsc_elastic_rules/rules/windows/credential_access_machine_account_smb_relay.toml
nldcsc_elastic_rules/rules/windows/credential_access_mimikatz_memssp_default_logs.toml
nldcsc_elastic_rules/rules/windows/credential_access_mimikatz_powershell_module.toml
nldcsc_elastic_rules/rules/windows/credential_access_mod_wdigest_security_provider.toml
nldcsc_elastic_rules/rules/windows/credential_access_moving_registry_hive_via_smb.toml
nldcsc_elastic_rules/rules/windows/credential_access_persistence_network_logon_provider_modification.toml
nldcsc_elastic_rules/rules/windows/credential_access_posh_invoke_ninjacopy.toml
nldcsc_elastic_rules/rules/windows/credential_access_posh_kerb_ticket_dump.toml
nldcsc_elastic_rules/rules/windows/credential_access_posh_minidump.toml
nldcsc_elastic_rules/rules/windows/credential_access_posh_relay_tools.toml
nldcsc_elastic_rules/rules/windows/credential_access_posh_request_ticket.toml
nldcsc_elastic_rules/rules/windows/credential_access_posh_veeam_sql.toml
nldcsc_elastic_rules/rules/windows/credential_access_potential_lsa_memdump_via_mirrordump.toml
nldcsc_elastic_rules/rules/windows/credential_access_rare_webdav_destination.toml
nldcsc_elastic_rules/rules/windows/credential_access_regback_sam_security_hives.toml
nldcsc_elastic_rules/rules/windows/credential_access_relay_ntlm_auth_via_http_spoolss.toml
nldcsc_elastic_rules/rules/windows/credential_access_remote_sam_secretsdump.toml
nldcsc_elastic_rules/rules/windows/credential_access_saved_creds_vault_winlog.toml
nldcsc_elastic_rules/rules/windows/credential_access_saved_creds_vaultcmd.toml
nldcsc_elastic_rules/rules/windows/credential_access_seenabledelegationprivilege_assigned_to_user.toml
nldcsc_elastic_rules/rules/windows/credential_access_shadow_credentials.toml
nldcsc_elastic_rules/rules/windows/credential_access_spn_attribute_modified.toml
nldcsc_elastic_rules/rules/windows/credential_access_suspicious_comsvcs_imageload.toml
nldcsc_elastic_rules/rules/windows/credential_access_suspicious_lsass_access_generic.toml
nldcsc_elastic_rules/rules/windows/credential_access_suspicious_lsass_access_memdump.toml
nldcsc_elastic_rules/rules/windows/credential_access_suspicious_lsass_access_via_snapshot.toml
nldcsc_elastic_rules/rules/windows/credential_access_suspicious_winreg_access_via_sebackup_priv.toml
nldcsc_elastic_rules/rules/windows/credential_access_symbolic_link_to_shadow_copy_created.toml
nldcsc_elastic_rules/rules/windows/credential_access_veeam_backup_dll_imageload.toml
nldcsc_elastic_rules/rules/windows/credential_access_veeam_commands.toml
nldcsc_elastic_rules/rules/windows/credential_access_via_snapshot_lsass_clone_creation.toml
nldcsc_elastic_rules/rules/windows/credential_access_wbadmin_ntds.toml
nldcsc_elastic_rules/rules/windows/credential_access_web_config_file_access.toml
nldcsc_elastic_rules/rules/windows/credential_access_wireless_creds_dumping.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_adding_the_hidden_file_attribute_with_via_attribexe.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_amsi_bypass_dllhijack.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_amsi_bypass_powershell.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_amsienable_key_mod.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_audit_policy_disabled_winlog.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_clearing_windows_console_history.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_clearing_windows_event_logs.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_clearing_windows_security_logs.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_code_signing_policy_modification_builtin_tools.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_code_signing_policy_modification_registry.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_communication_apps_suspicious_child_process.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_create_mod_root_certificate.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_cve_2020_0601.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_defender_disabled_via_registry.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_defender_exclusion_via_powershell.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_delete_volume_usn_journal_with_fsutil.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_disable_nla.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_disable_posh_scriptblocklogging.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_disable_windows_firewall_rules_with_netsh.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_disabling_windows_defender_powershell.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_disabling_windows_logs.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_dns_over_https_enabled.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_dotnet_compiler_parent_process.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_enable_inbound_rdp_with_netsh.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_enable_network_discovery_with_netsh.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_execution_control_panel_suspicious_args.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_execution_lolbas_wuauclt.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_execution_msbuild_started_by_script.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_execution_msbuild_started_by_system_process.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_execution_msbuild_started_renamed.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_execution_msbuild_started_unusal_process.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_execution_suspicious_explorer_winword.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_execution_windefend_unusual_path.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_file_creation_mult_extension.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_from_unusual_directory.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_hide_encoded_executable_registry.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_iis_httplogging_disabled.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_indirect_exec_conhost.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_indirect_exec_forfiles.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_indirect_exec_openssh.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_injection_msbuild.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_installutil_beacon.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_lolbas_win_cdb_utility.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_lsass_ppl_disabled_registry.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_masquerading_as_elastic_endpoint_process.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_masquerading_as_svchost.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_masquerading_business_apps_installer.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_masquerading_communication_apps.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_masquerading_renamed_autoit.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_masquerading_suspicious_werfault_childproc.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_masquerading_trusted_directory.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_masquerading_werfault.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_microsoft_defender_tampering.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_modify_ownership_os_files.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_ms_office_suspicious_regmod.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_msbuild_making_network_connections.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_mshta_beacon.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_mshta_susp_child.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_msiexec_child_proc_netcon.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_msiexec_remote_payload.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_msxsl_network.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_network_connection_from_windows_binary.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_ntlm_downgrade.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_obf_args_unicode_modified_letters.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_parent_process_pid_spoofing.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_persistence_account_tokenfilterpolicy.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_assembly_load.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_compressed.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_defender_tampering.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_encryption.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_high_entropy.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_backtick.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_backtick_var.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_char_arrays.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_concat_dynamic.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_high_number_proportion.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_iex_env_vars_reconstruction.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_iex_string_reconstruction.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_index_reversal.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_reverse_keyword.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_string_concat.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_string_format.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_whitespace_special_proportion.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_process_injection.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_powershell_windows_firewall_disabled.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_proxy_execution_via_msdt.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_reg_disable_enableglobalqueryblocklist.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_regmod_remotemonologue.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_right_to_left_override.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_root_dir_ads_creation.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_run_virt_windowssandbox.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_rundll32_no_arguments.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_sc_sdset.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_sccm_scnotification_dll.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_scheduledjobs_at_protocol_enabled.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_script_via_html_app.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_sdelete_like_filename_rename.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_sip_provider_mod.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_solarwinds_backdoor_service_disabled_via_registry.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_suspicious_certutil_commands.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_suspicious_execution_from_mounted_device.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_suspicious_managedcode_host_process.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_suspicious_process_access_direct_syscall.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_suspicious_process_creation_calltrace.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_suspicious_scrobj_load.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_suspicious_short_program_name.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_suspicious_wmi_script.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_suspicious_zoom_child_process.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_system_critical_proc_abnormal_file_activity.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_timestomp_sysmon.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_unsigned_dll_loaded_from_suspdir.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_untrusted_driver_loaded.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_unusual_ads_file_creation.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_unusual_dir_ads.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_unusual_network_connection_via_dllhost.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_unusual_network_connection_via_rundll32.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_unusual_process_network_connection.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_unusual_system_vp_child_program.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_via_filter_manager.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_wdac_policy_by_unusual_process.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_windows_filtering_platform.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_workfolders_control_execution.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_wsl_bash_exec.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_wsl_child_process.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_wsl_enabled_via_dism.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_wsl_filesystem.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_wsl_kalilinux.toml
nldcsc_elastic_rules/rules/windows/defense_evasion_wsl_registry_modification.toml
nldcsc_elastic_rules/rules/windows/discovery_active_directory_webservice.toml
nldcsc_elastic_rules/rules/windows/discovery_ad_explorer_execution.toml
nldcsc_elastic_rules/rules/windows/discovery_adfind_command_activity.toml
nldcsc_elastic_rules/rules/windows/discovery_admin_recon.toml
nldcsc_elastic_rules/rules/windows/discovery_command_system_account.toml
nldcsc_elastic_rules/rules/windows/discovery_enumerating_domain_trusts_via_dsquery.toml
nldcsc_elastic_rules/rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml
nldcsc_elastic_rules/rules/windows/discovery_group_policy_object_discovery.toml
nldcsc_elastic_rules/rules/windows/discovery_high_number_ad_properties.toml
nldcsc_elastic_rules/rules/windows/discovery_host_public_ip_address_lookup.toml
nldcsc_elastic_rules/rules/windows/discovery_peripheral_device.toml
nldcsc_elastic_rules/rules/windows/discovery_posh_invoke_sharefinder.toml
nldcsc_elastic_rules/rules/windows/discovery_posh_suspicious_api_functions.toml
nldcsc_elastic_rules/rules/windows/discovery_privileged_localgroup_membership.toml
nldcsc_elastic_rules/rules/windows/discovery_signal_unusual_discovery_signal_proc_cmdline.toml
nldcsc_elastic_rules/rules/windows/discovery_signal_unusual_discovery_signal_proc_executable.toml
nldcsc_elastic_rules/rules/windows/discovery_whoami_command_activity.toml
nldcsc_elastic_rules/rules/windows/execution_apt_solarwinds_backdoor_child_cmd_powershell.toml
nldcsc_elastic_rules/rules/windows/execution_apt_solarwinds_backdoor_unusual_child_processes.toml
nldcsc_elastic_rules/rules/windows/execution_com_object_xwizard.toml
nldcsc_elastic_rules/rules/windows/execution_command_prompt_connecting_to_the_internet.toml
nldcsc_elastic_rules/rules/windows/execution_command_shell_started_by_svchost.toml
nldcsc_elastic_rules/rules/windows/execution_command_shell_started_by_unusual_process.toml
nldcsc_elastic_rules/rules/windows/execution_command_shell_via_rundll32.toml
nldcsc_elastic_rules/rules/windows/execution_delayed_via_ping_lolbas_unsigned.toml
nldcsc_elastic_rules/rules/windows/execution_downloaded_shortcut_files.toml
nldcsc_elastic_rules/rules/windows/execution_downloaded_url_file.toml
nldcsc_elastic_rules/rules/windows/execution_enumeration_via_wmiprvse.toml
nldcsc_elastic_rules/rules/windows/execution_from_unusual_path_cmdline.toml
nldcsc_elastic_rules/rules/windows/execution_html_help_executable_program_connecting_to_the_internet.toml
nldcsc_elastic_rules/rules/windows/execution_initial_access_foxmail_exploit.toml
nldcsc_elastic_rules/rules/windows/execution_initial_access_via_msc_file.toml
nldcsc_elastic_rules/rules/windows/execution_initial_access_wps_dll_exploit.toml
nldcsc_elastic_rules/rules/windows/execution_mofcomp.toml
nldcsc_elastic_rules/rules/windows/execution_ms_office_written_file.toml
nldcsc_elastic_rules/rules/windows/execution_nodejs_susp_patterns.toml
nldcsc_elastic_rules/rules/windows/execution_notepad_markdown_child_process.toml
nldcsc_elastic_rules/rules/windows/execution_posh_hacktool_authors.toml
nldcsc_elastic_rules/rules/windows/execution_posh_hacktool_functions.toml
nldcsc_elastic_rules/rules/windows/execution_posh_malicious_script_agg.toml
nldcsc_elastic_rules/rules/windows/execution_posh_portable_executable.toml
nldcsc_elastic_rules/rules/windows/execution_posh_psreflect.toml
nldcsc_elastic_rules/rules/windows/execution_powershell_susp_args_via_winscript.toml
nldcsc_elastic_rules/rules/windows/execution_psexec_lateral_movement_command.toml
nldcsc_elastic_rules/rules/windows/execution_register_server_program_connecting_to_the_internet.toml
nldcsc_elastic_rules/rules/windows/execution_revshell_cmd_via_netcat.toml
nldcsc_elastic_rules/rules/windows/execution_scheduled_task_powershell_source.toml
nldcsc_elastic_rules/rules/windows/execution_scripting_remote_webdav.toml
nldcsc_elastic_rules/rules/windows/execution_scripts_archive_file.toml
nldcsc_elastic_rules/rules/windows/execution_shared_modules_local_sxs_dll.toml
nldcsc_elastic_rules/rules/windows/execution_susp_javascript_via_deno.toml
nldcsc_elastic_rules/rules/windows/execution_suspicious_cmd_wmi.toml
nldcsc_elastic_rules/rules/windows/execution_suspicious_image_load_wmi_ms_office.toml
nldcsc_elastic_rules/rules/windows/execution_suspicious_pdf_reader.toml
nldcsc_elastic_rules/rules/windows/execution_suspicious_powershell_imgload.toml
nldcsc_elastic_rules/rules/windows/execution_suspicious_psexesvc.toml
nldcsc_elastic_rules/rules/windows/execution_via_compiled_html_file.toml
nldcsc_elastic_rules/rules/windows/execution_via_hidden_shell_conhost.toml
nldcsc_elastic_rules/rules/windows/execution_via_mmc_console_file_unusual_path.toml
nldcsc_elastic_rules/rules/windows/execution_windows_cmd_shell_susp_args.toml
nldcsc_elastic_rules/rules/windows/execution_windows_fakecaptcha_cmd_ps.toml
nldcsc_elastic_rules/rules/windows/execution_windows_phish_clickfix.toml
nldcsc_elastic_rules/rules/windows/execution_windows_powershell_susp_args.toml
nldcsc_elastic_rules/rules/windows/execution_windows_script_from_internet.toml
nldcsc_elastic_rules/rules/windows/exfiltration_rclone_cloud_upload.toml
nldcsc_elastic_rules/rules/windows/exfiltration_smb_rare_destination.toml
nldcsc_elastic_rules/rules/windows/impact_backup_file_deletion.toml
nldcsc_elastic_rules/rules/windows/impact_deleting_backup_catalogs_with_wbadmin.toml
nldcsc_elastic_rules/rules/windows/impact_high_freq_file_renames_by_kernel.toml
nldcsc_elastic_rules/rules/windows/impact_mod_critical_os_files.toml
nldcsc_elastic_rules/rules/windows/impact_modification_of_boot_config.toml
nldcsc_elastic_rules/rules/windows/impact_ransomware_file_rename_smb.toml
nldcsc_elastic_rules/rules/windows/impact_ransomware_note_file_over_smb.toml
nldcsc_elastic_rules/rules/windows/impact_stop_process_service_threshold.toml
nldcsc_elastic_rules/rules/windows/impact_volume_shadow_copy_deletion_or_resized_via_vssadmin.toml
nldcsc_elastic_rules/rules/windows/impact_volume_shadow_copy_deletion_via_powershell.toml
nldcsc_elastic_rules/rules/windows/impact_volume_shadow_copy_deletion_via_wmic.toml
nldcsc_elastic_rules/rules/windows/initial_access_evasion_suspicious_htm_file_creation.toml
nldcsc_elastic_rules/rules/windows/initial_access_execution_from_inetcache.toml
nldcsc_elastic_rules/rules/windows/initial_access_execution_from_removable_media.toml
nldcsc_elastic_rules/rules/windows/initial_access_execution_remote_via_msiexec.toml
nldcsc_elastic_rules/rules/windows/initial_access_execution_via_office_addins.toml
nldcsc_elastic_rules/rules/windows/initial_access_exfiltration_first_time_seen_usb.toml
nldcsc_elastic_rules/rules/windows/initial_access_exploit_jetbrains_teamcity.toml
nldcsc_elastic_rules/rules/windows/initial_access_potential_webhelpdesk_exploit.toml
nldcsc_elastic_rules/rules/windows/initial_access_rdp_file_mail_attachment.toml
nldcsc_elastic_rules/rules/windows/initial_access_script_executing_powershell.toml
nldcsc_elastic_rules/rules/windows/initial_access_scripts_process_started_via_wmi.toml
nldcsc_elastic_rules/rules/windows/initial_access_suspicious_execution_from_vscode_extension.toml
nldcsc_elastic_rules/rules/windows/initial_access_suspicious_ms_exchange_files.toml
nldcsc_elastic_rules/rules/windows/initial_access_suspicious_ms_exchange_process.toml
nldcsc_elastic_rules/rules/windows/initial_access_suspicious_ms_exchange_worker_child_process.toml
nldcsc_elastic_rules/rules/windows/initial_access_suspicious_ms_office_child_process.toml
nldcsc_elastic_rules/rules/windows/initial_access_suspicious_ms_outlook_child_process.toml
nldcsc_elastic_rules/rules/windows/initial_access_suspicious_windows_server_update_svc.toml
nldcsc_elastic_rules/rules/windows/initial_access_url_cve_2025_33053.toml
nldcsc_elastic_rules/rules/windows/initial_access_via_explorer_suspicious_child_parent_args.toml
nldcsc_elastic_rules/rules/windows/initial_access_webshell_screenconnect_server.toml
nldcsc_elastic_rules/rules/windows/initial_access_xsl_script_execution_via_com.toml
nldcsc_elastic_rules/rules/windows/lateral_movement_alternate_creds_pth.toml
nldcsc_elastic_rules/rules/windows/lateral_movement_cmd_service.toml
nldcsc_elastic_rules/rules/windows/lateral_movement_credential_access_kerberos_correlation.toml
nldcsc_elastic_rules/rules/windows/lateral_movement_dcom_hta.toml
nldcsc_elastic_rules/rules/windows/lateral_movement_dcom_mmc20.toml
nldcsc_elastic_rules/rules/windows/lateral_movement_dcom_shellwindow_shellbrowserwindow.toml
nldcsc_elastic_rules/rules/windows/lateral_movement_defense_evasion_lanman_nullsessionpipe_modification.toml
nldcsc_elastic_rules/rules/windows/lateral_movement_direct_outbound_smb_connection.toml
nldcsc_elastic_rules/rules/windows/lateral_movement_evasion_rdp_shadowing.toml
nldcsc_elastic_rules/rules/windows/lateral_movement_executable_tool_transfer_smb.toml
nldcsc_elastic_rules/rules/windows/lateral_movement_execution_from_tsclient_mup.toml
nldcsc_elastic_rules/rules/windows/lateral_movement_execution_via_file_shares_sequence.toml
nldcsc_elastic_rules/rules/windows/lateral_movement_incoming_winrm_shell_execution.toml
nldcsc_elastic_rules/rules/windows/lateral_movement_incoming_wmi.toml
nldcsc_elastic_rules/rules/windows/lateral_movement_mount_hidden_or_webdav_share_net.toml
nldcsc_elastic_rules/rules/windows/lateral_movement_powershell_remoting_target.toml
nldcsc_elastic_rules/rules/windows/lateral_movement_rdp_enabled_registry.toml
nldcsc_elastic_rules/rules/windows/lateral_movement_rdp_sharprdp_target.toml
nldcsc_elastic_rules/rules/windows/lateral_movement_remote_file_copy_hidden_share.toml
nldcsc_elastic_rules/rules/windows/lateral_movement_remote_service_installed_winlog.toml
nldcsc_elastic_rules/rules/windows/lateral_movement_remote_services.toml
nldcsc_elastic_rules/rules/windows/lateral_movement_remote_task_creation_winlog.toml
nldcsc_elastic_rules/rules/windows/lateral_movement_scheduled_task_target.toml
nldcsc_elastic_rules/rules/windows/lateral_movement_suspicious_rdp_client_imageload.toml
nldcsc_elastic_rules/rules/windows/lateral_movement_unusual_dns_service_children.toml
nldcsc_elastic_rules/rules/windows/lateral_movement_unusual_dns_service_file_writes.toml
nldcsc_elastic_rules/rules/windows/lateral_movement_via_startup_folder_rdp_smb.toml
nldcsc_elastic_rules/rules/windows/lateral_movement_via_wsus_update.toml
nldcsc_elastic_rules/rules/windows/persistence_ad_adminsdholder.toml
nldcsc_elastic_rules/rules/windows/persistence_adobe_hijack_persistence.toml
nldcsc_elastic_rules/rules/windows/persistence_app_compat_shim.toml
nldcsc_elastic_rules/rules/windows/persistence_appcertdlls_registry.toml
nldcsc_elastic_rules/rules/windows/persistence_appinitdlls_registry.toml
nldcsc_elastic_rules/rules/windows/persistence_browser_extension_install.toml
nldcsc_elastic_rules/rules/windows/persistence_dontexpirepasswd_account.toml
nldcsc_elastic_rules/rules/windows/persistence_evasion_hidden_local_account_creation.toml
nldcsc_elastic_rules/rules/windows/persistence_evasion_registry_ifeo_injection.toml
nldcsc_elastic_rules/rules/windows/persistence_evasion_registry_startup_shell_folder_modified.toml
nldcsc_elastic_rules/rules/windows/persistence_group_modification_by_system.toml
nldcsc_elastic_rules/rules/windows/persistence_local_scheduled_job_creation.toml
nldcsc_elastic_rules/rules/windows/persistence_local_scheduled_task_creation.toml
nldcsc_elastic_rules/rules/windows/persistence_local_scheduled_task_scripting.toml
nldcsc_elastic_rules/rules/windows/persistence_ms_office_addins_file.toml
nldcsc_elastic_rules/rules/windows/persistence_ms_outlook_vba_template.toml
nldcsc_elastic_rules/rules/windows/persistence_msds_alloweddelegateto_krbtgt.toml
nldcsc_elastic_rules/rules/windows/persistence_msi_installer_task_startup.toml
nldcsc_elastic_rules/rules/windows/persistence_msoffice_startup_registry.toml
nldcsc_elastic_rules/rules/windows/persistence_netsh_helper_dll.toml
nldcsc_elastic_rules/rules/windows/persistence_powershell_exch_mailbox_activesync_add_device.toml
nldcsc_elastic_rules/rules/windows/persistence_powershell_profiles.toml
nldcsc_elastic_rules/rules/windows/persistence_priv_escalation_via_accessibility_features.toml
nldcsc_elastic_rules/rules/windows/persistence_registry_uncommon.toml
nldcsc_elastic_rules/rules/windows/persistence_remote_password_reset.toml
nldcsc_elastic_rules/rules/windows/persistence_run_key_and_startup_broad.toml
nldcsc_elastic_rules/rules/windows/persistence_runtime_run_key_startup_susp_procs.toml
nldcsc_elastic_rules/rules/windows/persistence_scheduled_task_creation_winlog.toml
nldcsc_elastic_rules/rules/windows/persistence_scheduled_task_updated.toml
nldcsc_elastic_rules/rules/windows/persistence_sdprop_exclusion_dsheuristics.toml
nldcsc_elastic_rules/rules/windows/persistence_service_dll_unsigned.toml
nldcsc_elastic_rules/rules/windows/persistence_service_windows_service_winlog.toml
nldcsc_elastic_rules/rules/windows/persistence_services_registry.toml
nldcsc_elastic_rules/rules/windows/persistence_startup_folder_file_written_by_suspicious_process.toml
nldcsc_elastic_rules/rules/windows/persistence_startup_folder_file_written_by_unsigned_process.toml
nldcsc_elastic_rules/rules/windows/persistence_startup_folder_scripts.toml
nldcsc_elastic_rules/rules/windows/persistence_suspicious_com_hijack_registry.toml
nldcsc_elastic_rules/rules/windows/persistence_suspicious_image_load_scheduled_task_ms_office.toml
nldcsc_elastic_rules/rules/windows/persistence_suspicious_scheduled_task_runtime.toml
nldcsc_elastic_rules/rules/windows/persistence_suspicious_service_created_registry.toml
nldcsc_elastic_rules/rules/windows/persistence_suspicious_user_mandatory_profile_file.toml
nldcsc_elastic_rules/rules/windows/persistence_sysmon_wmi_event_subscription.toml
nldcsc_elastic_rules/rules/windows/persistence_system_shells_via_services.toml
nldcsc_elastic_rules/rules/windows/persistence_temp_scheduled_task.toml
nldcsc_elastic_rules/rules/windows/persistence_time_provider_mod.toml
nldcsc_elastic_rules/rules/windows/persistence_user_account_added_to_privileged_group_ad.toml
nldcsc_elastic_rules/rules/windows/persistence_user_account_creation.toml
nldcsc_elastic_rules/rules/windows/persistence_via_application_shimming.toml
nldcsc_elastic_rules/rules/windows/persistence_via_bits_job_notify_command.toml
nldcsc_elastic_rules/rules/windows/persistence_via_hidden_run_key_valuename.toml
nldcsc_elastic_rules/rules/windows/persistence_via_lsa_security_support_provider_registry.toml
nldcsc_elastic_rules/rules/windows/persistence_via_telemetrycontroller_scheduledtask_hijack.toml
nldcsc_elastic_rules/rules/windows/persistence_via_update_orchestrator_service_hijack.toml
nldcsc_elastic_rules/rules/windows/persistence_via_windows_management_instrumentation_event_subscription.toml
nldcsc_elastic_rules/rules/windows/persistence_via_wmi_stdregprov_run_services.toml
nldcsc_elastic_rules/rules/windows/persistence_via_xp_cmdshell_mssql_stored_procedure.toml
nldcsc_elastic_rules/rules/windows/persistence_web_shell_aspx_write.toml
nldcsc_elastic_rules/rules/windows/persistence_webshell_detection.toml
nldcsc_elastic_rules/rules/windows/persistence_werfault_reflectdebugger.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_account_takeover_mixed_logon_types.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_badsuccessor_dmsa_abuse.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_create_process_as_different_user.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_create_process_with_token_unpriv.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_credroaming_ldap.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_disable_uac_registry.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_dmsa_creation_by_unusual_user.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_dns_serverlevelplugindll.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_driver_newterm_imphash.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_expired_driver_loaded.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_exploit_cve_202238028.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_gpo_schtask_service_creation.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_group_policy_iniscript.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_group_policy_privileged_groups.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_group_policy_scheduled_task.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_installertakeover.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_krbrelayup_service_creation.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_lsa_auth_package.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_make_token_local.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_msi_repair_via_mshelp_link.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_named_pipe_impersonation.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_newcreds_logon_rare_process.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_persistence_phantom_dll.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_port_monitor_print_processor_abuse.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_posh_token_impersonation.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_printspooler_registry_copyfiles.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_printspooler_service_suspicious_file.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_printspooler_suspicious_file_deletion.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_printspooler_suspicious_spl_file.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_reg_service_imagepath_mod.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_rogue_windir_environment_var.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_samaccountname_spoofing_attack.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_service_control_spawned_script_int.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_suspicious_dnshostname_update.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_takeover_new_source_ip.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_thread_cpu_priority_hijack.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_tokenmanip_sedebugpriv_enabled.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_uac_bypass_com_clipup.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_uac_bypass_com_ieinstal.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_uac_bypass_com_interface_icmluautil.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_uac_bypass_diskcleanup_hijack.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_uac_bypass_dll_sideloading.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_uac_bypass_event_viewer.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_uac_bypass_mock_windir.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_uac_bypass_winfw_mmc_hijack.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_unquoted_service_path.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_unusual_parentchild_relationship.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_unusual_printspooler_childprocess.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_unusual_svchost_childproc_childless.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_via_ppid_spoofing.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_via_rogue_named_pipe.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_via_token_theft.toml
nldcsc_elastic_rules/rules/windows/privilege_escalation_windows_service_via_unusual_client.toml