# packages

pkgId: 55c9d2f0b83b4585bea0647e3957066e14d4d4bc24ff14ecccf981697d7da9df
name: elasticsearch-oss
arch: x86_64
version: 7.10.0
epoch: 0
release: 1
summary: Distributed RESTful search engine built for the cloud
url: https://www.elastic.co/
rpm_license: ASL 2.0
rpm_vendor: Elasticsearch
rpm_group: Application/Internet
rpm_buildhost: packer-virtualbox-iso-1600176624
rpm_sourcerpm: elasticsearch-oss-7.10.0-1-src.rpm
rpm_packager: Elasticsearch
location_href: elasticsearch-oss-7.10.0-x86_64.rpm
checksum_type: sha256
description:
  Reference documentation can be found at
    https://www.elastic.co/guide/en/elasticsearch/reference/current/index.html
    and the 'Elasticsearch: The Definitive Guide' book can be found at
    https://www.elastic.co/guide/en/elasticsearch/guide/current/index.html


pkgId: 6e33714b097e3e9956987f22cefe7e42256a64e5d3d4af609bd3d407f4bccacd
name: opendistro-alerting
arch: noarch
version: 1.10.1.0
epoch: 0
release: 1
description: Amazon OpenDistro alerting plugin
url: https://opendistro.github.io/for-elasticsearch/downloads.html
rpm_license: ASL-2.0
rpm_vendor: Amazon
rpm_buildhost: fv-az128
rpm_sourcerpm: opendistro-alerting-1.10.1.0-1-src.rpm
rpm_packager: Amazon
location_href: opendistro-alerting-1.10.1.0-1.noarch.rpm
checksum_type: sha256
summary:
  Open Distro for Elasticsearch Alerting.      Reference documentation can be found at https://opendistro.github.io/for-elasticsearch-docs/.


pkgId: 0389f1bf31370ebe553fb3ac5b7f2cdec8c364063fbd78ae08fbf45ba89d6f8d
name: opendistro-anomaly-detection
arch: noarch
version: 1.10.1.0
epoch: 0
release: 1
description: Amazon opendistro elasticsearch anomaly detector plugin
url: https://opendistro.github.io/for-elasticsearch/downloads.html
rpm_license: ASL-2.0
rpm_vendor: Amazon
rpm_buildhost: fv-az176
rpm_sourcerpm: opendistro-anomaly-detection-1.10.1.0-1-src.rpm
rpm_packager: Amazon
location_href: opendistro-anomaly-detection-1.10.1.0-1.noarch.rpm
checksum_type: sha256
summary:
  Anomaly Detection plugin for OpenDistro for Elasticsearch.      Reference documentation can be found at https://opendistro.github.io/for-elasticsearch-docs/.


pkgId: b1676feff598c71e00a74528d42523470859ebcffb50351eb2f1319691920702
name: opendistro-asynchronous-search
arch: noarch
version: 1.13.0.1
epoch: 0
release: 1
description: Provides support for asynchronous search
url: https://opendistro.github.io/for-elasticsearch/downloads.html
rpm_license: ASL-2.0
rpm_vendor: Amazon
rpm_buildhost: fv-az133-55
rpm_sourcerpm: opendistro-asynchronous-search-1.13.0.1-1-src.rpm
rpm_packager: Amazon
location_href: opendistro-asynchronous-search-1.13.0.1.rpm
checksum_type: sha256
summary:
  Open Distro for Elasticsearch Asynchronous Search.      Reference documentation can be found at https://opendistro.github.io/for-elasticsearch-docs/.


pkgId: 1c64072a2e74cccd1aad7adece922daf8c5d27b4f39654cd287565414b88faff
name: opendistro-index-management
arch: noarch
version: 1.10.1.0
epoch: 0
release: 1
description: Open Distro Index Management Plugin
url: https://opendistro.github.io/for-elasticsearch/downloads.html
rpm_license: ASL-2.0
rpm_vendor: Amazon
rpm_buildhost: fv-az168
rpm_sourcerpm: opendistro-index-management-1.10.1.0-1-src.rpm
rpm_packager: Amazon
location_href: opendistro-index-management-1.10.1.0-1.noarch.rpm
checksum_type: sha256
summary:
  Open Distro for Elasticsearch Index Management.      Reference documentation can be found at https://opendistro.github.io/for-elasticsearch-docs/.


pkgId: fab143e66ba9961822e341abdf04e8a32bd383ab2f1a6d41881e6680ea907c08
name: opendistro-job-scheduler
arch: noarch
version: 1.10.1.0
epoch: 0
release: 1
description: Open Distro for Elasticsearch job schduler plugin
url: https://opendistro.github.io/for-elasticsearch/downloads.html
rpm_license: ASL-2.0
rpm_vendor: Amazon
rpm_buildhost: Mac-1795.local
rpm_sourcerpm: opendistro-job-scheduler-1.10.1.0-1-src.rpm
rpm_packager: Amazon
location_href: opendistro-job-scheduler-1.10.1.0-1.noarch.rpm
checksum_type: sha256
summary:
  JobScheduler plugin for OpenDistro for Elasticsearch.      Reference documentation can be found at https://opendistro.github.io/for-elasticsearch-docs/.


pkgId: 7199a970bc1bf3ee45e38ba49ca9dd80feddb14f47cb5b432bab5938c2bc7661
name: opendistro-knn
arch: noarch
version: 1.10.1.0
epoch: 0
release: 1
description: Open Distro for Elasticsearch KNN
url: https://opendistro.github.io/for-elasticsearch/downloads.html
rpm_license: ASL-2.0
rpm_vendor: Amazon
rpm_buildhost: fv-az139
rpm_sourcerpm: opendistro-knn-1.10.1.0-1-src.rpm
rpm_packager: Amazon
location_href: opendistro-knn-1.10.1.0-1.noarch.rpm
checksum_type: sha256
summary:
  KNN plugin for OpenDistro for Elasticsearch.      Reference documentation can be found at https://opendistro.github.io/for-elasticsearch-docs/.


pkgId: be4ab9111e19c02b51ef1f1c6c2e333cf8d13be8348e5b0f3dd6e31886943213
name: opendistro-knnlib
arch: x86_64
version: 1.10.1.0
epoch: 0
release: 1
description: Open Distro for Elasticsearch KNN JNI Library
url: https://opendistro.github.io/elasticsearch/downloads
rpm_license: ASL-2.0
rpm_vendor: Amazon
rpm_group: unknown
rpm_buildhost: c52f62e8ba1f
rpm_sourcerpm: opendistro-knnlib-1.10.1.0-1.src.rpm
location_href: opendistro-knnlib-1.10.1.0-1_linux.x86_64.rpm
checksum_type: sha256
summary:
  KNN JNI library built off of NMSLIB for OpenDistro for Elasticsearch. Reference documentation can be found at https://opendistro.github.io/for-elasticsearch-docs/.


pkgId: 1aa36bfcfa24edb2ad4b363dd38f7e81b23c513fcb7d304f839b6cadf4ebc0ce
name: opendistro-performance-analyzer
arch: noarch
version: 1.10.1.0
epoch: 0
release: 1
description: Performance Analyzer Plugin
url: https://opendistro.github.io/elasticsearch/downloads
rpm_license: ASL-2.0
rpm_vendor: Amazon
rpm_buildhost: fv-az76
rpm_sourcerpm: opendistro-performance-analyzer-1.10.1.0-1-src.rpm
rpm_packager: Amazon
location_href: opendistro-performance-analyzer-1.10.1.0-1.noarch.rpm
checksum_type: sha256
summary:
  Performance Analyzer plugin for OpenDistro for Elasticsearch. Reference documentation can be found at https://opendistro.github.io/elasticsearch/docs.


pkgId: 5d5b57a1290eea34a57b5b9f6b80740aab2c41025b797610005a1e08097ccd9a
name: opendistro-performance-analyzer
arch: noarch
version: 1.12.0.0
epoch: 0
release: 1
description: Performance Analyzer Plugin
url: https://opendistro.github.io/for-elasticsearch/downloads.html
rpm_license: ASL-2.0
rpm_vendor: Amazon
rpm_buildhost: fv-az128-642
rpm_sourcerpm: opendistro-performance-analyzer-1.12.0.0-1-src.rpm
rpm_packager: Amazon
location_href: opendistro-performance-analyzer-1.12.0.0-1.noarch.rpm
checksum_type: sha256
summary:
  Performance Analyzer plugin for OpenDistro for Elasticsearch. Reference documentation can be found at https://opendistro.github.io/for-elasticsearch-docs/.


pkgId: 90d4210c2215f7f2b270dc53e2edce61f242da38bd1b5431b1f0f5e7542ccce3
name: opendistro-reports-scheduler
arch: noarch
version: 1.12.0.0
epoch: 0
release: 1
description: Scheduler for ODFE Kibana Reports Plugin
url: https://opendistro.github.io/elasticsearch/downloads
rpm_license: ASL-2.0
rpm_vendor: Amazon
rpm_buildhost: fv-az87-153
rpm_sourcerpm: opendistro-reports-scheduler-1.12.0.0-1-src.rpm
rpm_packager: Amazon
location_href: opendistro-reports-scheduler-1.12.0.0-1.noarch.rpm
checksum_type: sha256
summary:
  Open Distro for Elasticsearch Report scheduler.      Reference documentation can be found at https://opendistro.github.io/elasticsearch/docs.


pkgId: af2245d1de893759cb808ff0af3bf1bde53e394c929a59b995d428eca28906cb
name: opendistro-security
arch: noarch
version: 1.10.1.0
epoch: 0
release: 0
url: https://opendistro.github.io/for-elasticsearch/downloads.html
rpm_license: ASL-2.0
rpm_vendor: Amazon
rpm_buildhost: fv-az32
rpm_sourcerpm: opendistro-security-1.10.1.0-0-src.rpm
rpm_packager: Amazon
location_href: opendistro-security-1.10.1.0.rpm
checksum_type: sha256
summary:
  Security plugin for OpenDistro for Elasticsearch.  Reference documentation can be found at https://opendistro.github.io/for-elasticsearch-docs/.


pkgId: e902b3de4462d8cefb8479703720000882b145352b6cf01d20e134c6bde193c9
name: opendistro-sql
arch: noarch
version: 1.10.1.0
epoch: 0
release: 1
description: Open Distro for Elasticsearch SQL
url: https://opendistro.github.io/for-elasticsearch/downloads.html
rpm_license: ASL-2.0
rpm_vendor: Amazon
rpm_buildhost: fv-az175
rpm_sourcerpm: opendistro-sql-1.10.1.0-1-src.rpm
rpm_packager: Amazon
location_href: opendistro-sql-1.10.1.0-1.noarch.rpm
checksum_type: sha256
summary:
  SQL plugin for OpenDistro for Elasticsearch.      Reference documentation can be found at https://opendistro.github.io/for-elasticsearch-docs/.


pkgId: 1a7e43d65959fc3c4993bb096b411e748d55d3037a62d690c2819ab4b1362c29
name: opendistroforelasticsearch
arch: noarch
version: 1.10.1
epoch: 0
release: 1
url: https://opendistro.github.io/for-elasticsearch/downloads.html
rpm_license: ASL-2.0
rpm_vendor: Amazon
rpm_buildhost: b99d6837ed9e
rpm_sourcerpm: opendistroforelasticsearch-1.10.1-1-src.rpm
rpm_packager: Amazon
location_href: opendistroforelasticsearch-1.10.1.rpm
checksum_type: sha256
summary:
  OpenDistro for Elasticsearch.  Reference documentation can be found at https://opendistro.github.io/for-elasticsearch-docs/.


pkgId: 1be7497bc1c0f3af3db86698e6d984fa9133f4d19161efc3cceb27135b12790d
name: wazuh-agent
arch: aarch64
version: 4.0.0
epoch: 0
release: 1
url: https://www.wazuh.com/
rpm_license: GPL
rpm_vendor: Wazuh, Inc <info@wazuh.com>
rpm_group: System Environment/Daemons
rpm_buildhost: ip-172-31-140-236.ec2.internal
rpm_sourcerpm: wazuh-agent-4.0.0-1.src.rpm
rpm_packager: Wazuh, Inc <info@wazuh.com>
location_href: wazuh-agent-4.0.0-1.aarch64.rpm
checksum_type: sha256
summary:
  Wazuh helps you to gain security visibility into your infrastructure by monitoring hosts at an operating system and application level. It provides the following capabilities: log analysis, file integrity monitoring, intrusions detection and policy and compliance monitoring

description:
  Wazuh helps you to gain security visibility into your infrastructure by monitoring
  hosts at an operating system and application level. It provides the following capabilities:
  log analysis, file integrity monitoring, intrusions detection and policy and compliance monitoring


pkgId: 665611ed551da922b49f1d756897d3e50233d6638175c7ed683202b2d1800746
name: wazuh-dashboard
arch: x86_64
version: 4.10.0
epoch: 0
release: 1
url: https://www.wazuh.com/
rpm_license: GPL
rpm_vendor: Wazuh, Inc <info@wazuh.com>
rpm_group: System Environment/Daemons
rpm_buildhost: beefbbea32bd
rpm_sourcerpm: wazuh-dashboard-4.10.0-1.src.rpm
rpm_packager: Wazuh, Inc <info@wazuh.com>
location_href: wazuh-dashboard-4.10.0-1.x86_64.rpm
checksum_type: sha256
summary:
  Wazuh dashboard is a user interface and visualization tool for security-related data. Documentation can be found at https://documentation.wazuh.com/current/getting-started/components/wazuh-dashboard.html

description:
  Wazuh dashboard is a user interface and visualization tool for security-related data. This Wazuh central component enables exploring, visualizing, and analyzing the stored security alerts generated by the Wazuh server. Wazuh dashboard enables inspecting the status and managing the configurations of the Wazuh cluster and agents as well as creating and managing users and roles. In addition, it allows testing the ruleset and making calls to the Wazuh API. Documentation can be found at https://documentation.wazuh.com/current/getting-started/components/wazuh-dashboard.html


pkgId: d178b84f265e8ad224aa3ba0235b742b7a9afd4c41dc58c1c8410d6d68c33864
name: wazuh-indexer
arch: x86_64
version: 4.10.0
epoch: 0
release: 1
summary: An open source distributed and RESTful search engine
url: https://www.wazuh.com/
rpm_license: Apache-2.0
rpm_vendor: Wazuh, Inc <info@wazuh.com>
rpm_group: Application/Internet
rpm_buildhost: fv-az1719-471.hfl3wxmui1xebh43nkpysbkljf.cx.internal.cloudapp.net
rpm_sourcerpm: wazuh-indexer-4.10.0-1.src.rpm
rpm_packager: Wazuh, Inc <info@wazuh.com>
location_href: wazuh-indexer-4.10.0-1.x86_64.rpm
checksum_type: sha256
description:
  Wazuh indexer is a near real-time full-text search and analytics engine that
  gathers security-related data into one platform. This Wazuh central component
  indexes and stores alerts generated by the Wazuh server. Wazuh indexer can be
  configured as a single-node or multi-node cluster, providing scalability and
  high availability.
  For more information, see: https://www.wazuh.com/


pkgId: df19829216d4260180745f736f7d208921a44d84d1635620f87f5c5cf3ff4018
name: wazuh-indexer
arch: x86_64
version: 4.3.0
epoch: 0
release: 1
url: https://www.wazuh.com/
rpm_license: GPL
rpm_vendor: Wazuh, Inc <info@wazuh.com>
rpm_group: System Environment/Daemons
rpm_buildhost: ip-172-31-58-156.ec2.internal
rpm_sourcerpm: wazuh-indexer-4.3.0-1.src.rpm
rpm_packager: Wazuh, Inc <info@wazuh.com>
location_href: wazuh-indexer-4.3.0-1.x86_64.rpm
checksum_type: sha256
summary:
  Wazuh indexer is a search and analytics engine for security-related data. Documentation can be found at https://documentation.wazuh.com/current/getting-started/components/wazuh-indexer.html

description:
  Wazuh indexer is a near real-time full-text search and analytics engine that gathers security-related data into one platform. This Wazuh central component indexes and stores alerts generated by the Wazuh server. Wazuh indexer can be configured as a single-node or multi-node cluster, providing scalability and high availability. Documentation can be found at https://documentation.wazuh.com/current/getting-started/components/wazuh-indexer.html


# files

type: file
name:
  /usr/share/elasticsearch/plugins/opendistro_performance_analyzer/performance-analyzer-rca/bin/performance-analyzer-rca


type: file
name:
  /usr/share/elasticsearch/plugins/opendistro_performance_analyzer/performance-analyzer-rca/bin/performance-analyzer-rca.bat


type: file
name:
  /usr/share/elasticsearch/plugins/opendistro_performance_analyzer/performance-analyzer-rca/pa_bin/performance-analyzer-agent


type: file
name:
  /usr/share/elasticsearch/plugins/opendistro-performance-analyzer/performance-analyzer-rca/bin/performance-analyzer-rca


type: file
name:
  /usr/share/elasticsearch/plugins/opendistro-performance-analyzer/performance-analyzer-rca/bin/performance-analyzer-rca.bat


type: file
name:
  /usr/share/elasticsearch/plugins/opendistro-performance-analyzer/performance-analyzer-rca/pa_bin/performance-analyzer-agent


type: file
name:
  /usr/share/kibana/node_modules/core-js-compat/node_modules/node-releases/node_modules/semver/bin/semver.js


type: file
name:
  /usr/share/kibana/plugins/opendistro-alerting/node_modules/formik/node_modules/warning/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistro-alerting/node_modules/prop-types/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistro-alerting/node_modules/react-router-dom/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistro-alerting/node_modules/react-router/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/fbjs/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/prop-types/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/react-redux/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistro-sql-workbench/node_modules/prop-types/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistro-sql-workbench/node_modules/react-dom/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistro-sql-workbench/node_modules/scheduler/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/@choojs/findup/bin/findup.js


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/boundary-cells/node_modules/.bin/tape


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/d3-hexbin/build/d3-hexbin.js


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/d3-hexbin/build/d3-hexbin.min.js


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/d3-hexbin/img/bivariate.jpg


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/d3-hexbin/img/dynamic.jpg


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/escodegen/bin/escodegen.js


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/escodegen/bin/esgenerate.js


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/escodegen/node_modules/.bin/esparse


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/escodegen/node_modules/.bin/esvalidate


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/esprima/bin/esvalidate.js


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/falafel/node_modules/.bin/acorn


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/gl-axes3d/node_modules/.bin/glslify


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/gl-cone3d/node_modules/.bin/glslify


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/gl-contour2d/node_modules/.bin/glslify


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/gl-error3d/node_modules/.bin/glslify


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/gl-heatmap2d/node_modules/.bin/glslify


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/gl-line3d/node_modules/.bin/glslify


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/gl-mesh3d/node_modules/.bin/glslify


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/gl-plot2d/node_modules/.bin/glslify


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/gl-plot3d/node_modules/.bin/glslify


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/gl-pointcloud2d/node_modules/.bin/glslify


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/gl-scatter3d/node_modules/.bin/glslify


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/gl-select-box/node_modules/.bin/glslify


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/gl-spikes3d/node_modules/.bin/glslify


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/gl-streamtube3d/node_modules/.bin/glslify


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/gl-surface3d/node_modules/.bin/glslify


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/glslify-deps/node_modules/.bin/findup


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/image-size/bin/image-size.js


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/mapbox-gl/node_modules/.bin/geojson-rewind


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/mapbox-gl/node_modules/.bin/pbf


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/mapbox-gl/src/style-spec/bin/gl-style-composite


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/mapbox-gl/src/style-spec/bin/gl-style-format


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/mapbox-gl/src/style-spec/bin/gl-style-migrate


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/mapbox-gl/src/style-spec/bin/gl-style-validate


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/plotly.js/node_modules/.bin/glslify


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/plotly.js/node_modules/.bin/image-size


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/plotly.js/node_modules/.bin/topo2geo


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/plotly.js/node_modules/.bin/topomerge


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/plotly.js/node_modules/.bin/topoquantize


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/regl-line2d/node_modules/.bin/glslify


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/regl-scatter2d/node_modules/.bin/glslify


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/sane-topojson/bin/common.js


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/sane-topojson/bin/geo2topo.js


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/sane-topojson/bin/shp2geo.js


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/sane-topojson/bin/stats.js


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/sane-topojson/bin/wget.js


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/static-eval/node_modules/.bin/escodegen


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/static-eval/node_modules/.bin/esgenerate


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/tape/node_modules/.bin/ignored


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/topojson-client/bin/topo2geo


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/topojson-client/bin/topomerge


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/topojson-client/bin/topoquantize


type: file
name:
  /usr/share/kibana/plugins/opendistro-anomaly-detection-kibana/node_modules/vt-pbf/node_modules/.bin/pbf


type: file
name:
  /usr/share/kibana/plugins/opendistro-notebooks-kibana/node_modules/.bin/upgrade-blueprint-2.0.0-rename


type: file
name:
  /usr/share/kibana/plugins/opendistro-notebooks-kibana/node_modules/.bin/upgrade-blueprint-3.0.0-rename


type: file
name:
  /usr/share/kibana/plugins/opendistro-notebooks-kibana/node_modules/@blueprintjs/select/node_modules/.bin/upgrade-blueprint-2.0.0-rename


type: file
name:
  /usr/share/kibana/plugins/opendistro-notebooks-kibana/node_modules/@blueprintjs/select/node_modules/.bin/upgrade-blueprint-3.0.0-rename


type: file
name:
  /usr/share/kibana/plugins/opendistro-notebooks-kibana/node_modules/@nteract/presentational-components/node_modules/.bin/upgrade-blueprint-2.0.0-rename


type: file
name:
  /usr/share/kibana/plugins/opendistro-notebooks-kibana/node_modules/@nteract/presentational-components/node_modules/.bin/upgrade-blueprint-3.0.0-rename


type: file
name:
  /usr/share/kibana/plugins/opendistro-notebooks-kibana/node_modules/prop-types/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistro-notebooks-kibana/node_modules/react-dom/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistro-notebooks-kibana/node_modules/react-transition-group/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistro-notebooks-kibana/node_modules/react/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistro-notebooks-kibana/node_modules/scheduler/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistro-notebooks-kibana/node_modules/warning/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistro-query-workbench/node_modules/prop-types/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistro-query-workbench/node_modules/react-dom/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistro-query-workbench/node_modules/scheduler/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistroAlertingKibana/node_modules/history/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistroAlertingKibana/node_modules/prop-types/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistroAlertingKibana/node_modules/react-router-dom/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistroAlertingKibana/node_modules/react-router/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistroAlertingKibana/node_modules/warning/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistroAnomalyDetectionKibana/node_modules/prop-types/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistroAnomalyDetectionKibana/node_modules/react-redux/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistroGanttChartKibana/node_modules/prop-types/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistroNotebooksKibana/node_modules/.bin/upgrade-blueprint-2.0.0-rename


type: file
name:
  /usr/share/kibana/plugins/opendistroNotebooksKibana/node_modules/.bin/upgrade-blueprint-3.0.0-rename


type: file
name:
  /usr/share/kibana/plugins/opendistroNotebooksKibana/node_modules/@babel/cli/bin/babel-external-helpers.js


type: file
name:
  /usr/share/kibana/plugins/opendistroNotebooksKibana/node_modules/@blueprintjs/select/node_modules/.bin/upgrade-blueprint-2.0.0-rename


type: file
name:
  /usr/share/kibana/plugins/opendistroNotebooksKibana/node_modules/@blueprintjs/select/node_modules/.bin/upgrade-blueprint-3.0.0-rename


type: file
name:
  /usr/share/kibana/plugins/opendistroNotebooksKibana/node_modules/@nteract/presentational-components/node_modules/.bin/upgrade-blueprint-2.0.0-rename


type: file
name:
  /usr/share/kibana/plugins/opendistroNotebooksKibana/node_modules/@nteract/presentational-components/node_modules/.bin/upgrade-blueprint-3.0.0-rename


type: file
name:
  /usr/share/kibana/plugins/opendistroNotebooksKibana/node_modules/prop-types/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistroNotebooksKibana/node_modules/react-dom/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistroNotebooksKibana/node_modules/react-transition-group/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistroNotebooksKibana/node_modules/react/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistroNotebooksKibana/node_modules/scheduler/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistroNotebooksKibana/node_modules/source-map-resolve/node_modules/.bin/atob


type: file
name:
  /usr/share/kibana/plugins/opendistroNotebooksKibana/node_modules/warning/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistroReportsKibana/node_modules/acorn-globals/node_modules/.bin/acorn


type: file
name:
  /usr/share/kibana/plugins/opendistroReportsKibana/node_modules/enzyme-adapter-react-16/node_modules/.bin/semver


type: file
name:
  /usr/share/kibana/plugins/opendistroReportsKibana/node_modules/enzyme-adapter-utils/node_modules/.bin/semver


type: file
name:
  /usr/share/kibana/plugins/opendistroReportsKibana/node_modules/escodegen/node_modules/.bin/esvalidate


type: file
name:
  /usr/share/kibana/plugins/opendistroReportsKibana/node_modules/extract-zip/node_modules/mkdirp/bin/cmd.js


type: file
name:
  /usr/share/kibana/plugins/opendistroReportsKibana/node_modules/extract-zip/node_modules/mkdirp/bin/usage.txt


type: file
name:
  /usr/share/kibana/plugins/opendistroReportsKibana/node_modules/history/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistroReportsKibana/node_modules/http-signature/node_modules/.bin/sshpk-conv


type: file
name:
  /usr/share/kibana/plugins/opendistroReportsKibana/node_modules/http-signature/node_modules/.bin/sshpk-sign


type: file
name:
  /usr/share/kibana/plugins/opendistroReportsKibana/node_modules/http-signature/node_modules/.bin/sshpk-verify


type: file
name:
  /usr/share/kibana/plugins/opendistroReportsKibana/node_modules/prop-types/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistroReportsKibana/node_modules/puppeteer-core/node_modules/.bin/extract-zip


type: file
name:
  /usr/share/kibana/plugins/opendistroReportsKibana/node_modules/puppeteer-core/node_modules/.bin/mime


type: file
name:
  /usr/share/kibana/plugins/opendistroReportsKibana/node_modules/puppeteer-core/node_modules/.bin/rimraf


type: file
name:
  /usr/share/kibana/plugins/opendistroReportsKibana/node_modules/react-router-dom/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistroReportsKibana/node_modules/react-router/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistroReportsKibana/node_modules/react-transition-group/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistroReportsKibana/node_modules/scheduler/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/kibana/plugins/opendistroTraceAnalyticsKibana/node_modules/prop-types/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/wazuh-dashboard/plugins/alertingDashboards/node_modules/prop-types/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/wazuh-dashboard/plugins/customImportMapDashboards/node_modules/@cypress/request/node_modules/.bin/uuid


type: file
name:
  /usr/share/wazuh-dashboard/plugins/customImportMapDashboards/node_modules/@cypress/request/node_modules/uuid/dist/bin/uuid


type: file
name:
  /usr/share/wazuh-dashboard/plugins/customImportMapDashboards/node_modules/@mapbox/geojson-coords/node_modules/.bin/geojson-normalize


type: file
name:
  /usr/share/wazuh-dashboard/plugins/customImportMapDashboards/node_modules/@mapbox/geojson-extent/bin/geojson-extent


type: file
name:
  /usr/share/wazuh-dashboard/plugins/customImportMapDashboards/node_modules/@mapbox/mapbox-gl-draw/node_modules/.bin/geojson-extent


type: file
name:
  /usr/share/wazuh-dashboard/plugins/customImportMapDashboards/node_modules/@mapbox/mapbox-gl-draw/node_modules/.bin/geojson-normalize


type: file
name:
  /usr/share/wazuh-dashboard/plugins/customImportMapDashboards/node_modules/cross-spawn/node_modules/.bin/node-which


type: file
name:
  /usr/share/wazuh-dashboard/plugins/customImportMapDashboards/node_modules/cross-spawn/node_modules/which/bin/node-which


type: file
name:
  /usr/share/wazuh-dashboard/plugins/customImportMapDashboards/node_modules/cypress-file-upload/node_modules/.bin/cypress


type: file
name:
  /usr/share/wazuh-dashboard/plugins/customImportMapDashboards/node_modules/cypress/node_modules/.bin/extract-zip


type: file
name:
  /usr/share/wazuh-dashboard/plugins/customImportMapDashboards/node_modules/cypress/node_modules/.bin/is-ci


type: file
name:
  /usr/share/wazuh-dashboard/plugins/customImportMapDashboards/node_modules/cypress/node_modules/.bin/semver


type: file
name:
  /usr/share/wazuh-dashboard/plugins/customImportMapDashboards/node_modules/global-prefix/node_modules/.bin/which


type: file
name:
  /usr/share/wazuh-dashboard/plugins/customImportMapDashboards/node_modules/http-signature/node_modules/.bin/sshpk-conv


type: file
name:
  /usr/share/wazuh-dashboard/plugins/customImportMapDashboards/node_modules/http-signature/node_modules/.bin/sshpk-sign


type: file
name:
  /usr/share/wazuh-dashboard/plugins/customImportMapDashboards/node_modules/http-signature/node_modules/.bin/sshpk-verify


type: file
name:
  /usr/share/wazuh-dashboard/plugins/customImportMapDashboards/node_modules/maplibre-gl/node_modules/.bin/geojson-rewind


type: file
name:
  /usr/share/wazuh-dashboard/plugins/customImportMapDashboards/node_modules/maplibre-gl/node_modules/.bin/pbf


type: file
name:
  /usr/share/wazuh-dashboard/plugins/customImportMapDashboards/node_modules/maplibre-gl/src/style-spec/bin/gl-style-composite


type: file
name:
  /usr/share/wazuh-dashboard/plugins/customImportMapDashboards/node_modules/maplibre-gl/src/style-spec/bin/gl-style-format


type: file
name:
  /usr/share/wazuh-dashboard/plugins/customImportMapDashboards/node_modules/maplibre-gl/src/style-spec/bin/gl-style-migrate


type: file
name:
  /usr/share/wazuh-dashboard/plugins/customImportMapDashboards/node_modules/maplibre-gl/src/style-spec/bin/gl-style-validate


type: file
name:
  /usr/share/wazuh-dashboard/plugins/customImportMapDashboards/node_modules/tmp/node_modules/.bin/rimraf


type: file
name:
  /usr/share/wazuh-dashboard/plugins/customImportMapDashboards/node_modules/vt-pbf/node_modules/.bin/pbf


type: file
name:
  /usr/share/wazuh-dashboard/plugins/ganttChartDashboards/node_modules/prop-types/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/acorn-globals/node_modules/.bin/acorn


type: file
name:
  /usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/acorn-globals/node_modules/acorn/bin/acorn


type: file
name:
  /usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/babel-plugin-macros/node_modules/.bin/resolve


type: file
name:
  /usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/crc32-stream/node_modules/.bin/crc32


type: file
name:
  /usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/enzyme-adapter-react-16/node_modules/.bin/semver


type: file
name:
  /usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/enzyme-adapter-utils/node_modules/.bin/semver


type: file
name:
  /usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/escodegen/node_modules/.bin/esparse


type: file
name:
  /usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/escodegen/node_modules/.bin/esvalidate


type: file
name:
  /usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/history/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/jsdom/node_modules/.bin/esgenerate


type: file
name:
  /usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/prop-types/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/react-router-dom/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/react-router/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/react-transition-group/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/scheduler/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/tesseract.js/node_modules/.bin/opencollective-postinstall


type: file
name:
  /usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/zlibjs/bin/inflate_stream.dev.min.js


type: file
name:
  /usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/zlibjs/bin/zlib_and_gzip.dev.min.js


type: file
name:
  /usr/share/wazuh-dashboard/plugins/securityDashboards/node_modules/degenerator/node_modules/.bin/escodegen


type: file
name:
  /usr/share/wazuh-dashboard/plugins/securityDashboards/node_modules/degenerator/node_modules/.bin/esgenerate


type: file
name:
  /usr/share/wazuh-dashboard/plugins/securityDashboards/node_modules/degenerator/node_modules/.bin/esparse


type: file
name:
  /usr/share/wazuh-dashboard/plugins/securityDashboards/node_modules/degenerator/node_modules/.bin/esvalidate


type: file
name:
  /usr/share/wazuh-dashboard/plugins/securityDashboards/node_modules/escodegen/node_modules/.bin/esparse


type: file
name:
  /usr/share/wazuh-dashboard/plugins/securityDashboards/node_modules/escodegen/node_modules/.bin/esvalidate


type: file
name:
  /usr/share/wazuh-dashboard/plugins/wazuh/node_modules/@foliojs-fork/linebreak/node_modules/.bin/brfs


type: file
name:
  /usr/share/wazuh-dashboard/plugins/wazuh/node_modules/ast-transform/node_modules/escodegen/bin/escodegen.js


type: file
name:
  /usr/share/wazuh-dashboard/plugins/wazuh/node_modules/ast-transform/node_modules/escodegen/bin/esgenerate.js


type: file
name:
  /usr/share/wazuh-dashboard/plugins/wazuh/node_modules/ast-transform/node_modules/escodegen/node_modules/.bin/esparse


type: file
name:
  /usr/share/wazuh-dashboard/plugins/wazuh/node_modules/ast-transform/node_modules/escodegen/node_modules/.bin/esvalidate


type: file
name:
  /usr/share/wazuh-dashboard/plugins/wazuh/node_modules/create-react-class/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/wazuh-dashboard/plugins/wazuh/node_modules/escodegen/node_modules/esprima/bin/esvalidate.js


type: file
name:
  /usr/share/wazuh-dashboard/plugins/wazuh/node_modules/jsdom/node_modules/escodegen/bin/esgenerate.js


type: file
name:
  /usr/share/wazuh-dashboard/plugins/wazuh/node_modules/jsdom/node_modules/escodegen/node_modules/.bin/esparse


type: file
name:
  /usr/share/wazuh-dashboard/plugins/wazuh/node_modules/jsdom/node_modules/escodegen/node_modules/.bin/esvalidate


type: file
name:
  /usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/@babel/generator/node_modules/.bin/jsesc


type: file
name:
  /usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/@babel/generator/node_modules/.bin/parser


type: file
name:
  /usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/@babel/template/node_modules/.bin/parser


type: file
name:
  /usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/@babel/traverse/node_modules/.bin/parser


type: file
name:
  /usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/cosmiconfig/node_modules/.bin/yaml


type: file
name:
  /usr/share/wazuh-dashboard/plugins/anomalyDetectionDashboards/node_modules/prop-types/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/wazuh-dashboard/plugins/anomalyDetectionDashboards/node_modules/react-redux/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/wazuh-dashboard/plugins/alertingDashboards/node_modules/history/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/wazuh-dashboard/plugins/alertingDashboards/node_modules/react-router-dom/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/wazuh-dashboard/plugins/alertingDashboards/node_modules/react-router/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/wazuh-dashboard/plugins/observabilityDashboards/node_modules/.bin/upgrade-blueprint-2.0.0-rename


type: file
name:
  /usr/share/wazuh-dashboard/plugins/observabilityDashboards/node_modules/.bin/upgrade-blueprint-3.0.0-rename


type: file
name:
  /usr/share/wazuh-dashboard/plugins/observabilityDashboards/node_modules/@blueprintjs/select/node_modules/.bin/upgrade-blueprint-2.0.0-rename


type: file
name:
  /usr/share/wazuh-dashboard/plugins/observabilityDashboards/node_modules/@blueprintjs/select/node_modules/.bin/upgrade-blueprint-3.0.0-rename


type: file
name:
  /usr/share/wazuh-dashboard/plugins/observabilityDashboards/node_modules/@nteract/presentational-components/node_modules/.bin/upgrade-blueprint-2.0.0-rename


type: file
name:
  /usr/share/wazuh-dashboard/plugins/observabilityDashboards/node_modules/@nteract/presentational-components/node_modules/.bin/upgrade-blueprint-3.0.0-rename


type: file
name:
  /usr/share/wazuh-dashboard/plugins/observabilityDashboards/node_modules/prop-types/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/wazuh-dashboard/plugins/observabilityDashboards/node_modules/react-transition-group/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/wazuh-dashboard/plugins/observabilityDashboards/node_modules/warning/node_modules/.bin/loose-envify


type: file
name:
  /usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/extract-zip/node_modules/.bin/mkdirp


type: file
name:
  /usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/extract-zip/node_modules/mkdirp/bin/cmd.js


type: file
name:
  /usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/extract-zip/node_modules/mkdirp/bin/usage.txt


type: file
name:
  /usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/http-signature/node_modules/.bin/sshpk-conv


type: file
name:
  /usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/http-signature/node_modules/.bin/sshpk-sign


type: file
name:
  /usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/http-signature/node_modules/.bin/sshpk-verify


type: file
name:
  /usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/puppeteer-core/node_modules/.bin/extract-zip


type: file
name:
  /usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/puppeteer-core/node_modules/.bin/mime


type: file
name:
  /usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/puppeteer-core/node_modules/.bin/rimraf


type: file
name:
  /usr/share/wazuh-dashboard/plugins/notificationsDashboards/node_modules/@cypress/request/node_modules/.bin/uuid


type: file
name:
  /usr/share/wazuh-dashboard/plugins/notificationsDashboards/node_modules/cross-spawn/node_modules/.bin/node-which


type: file
name:
  /usr/share/wazuh-dashboard/plugins/notificationsDashboards/node_modules/cypress/node_modules/.bin/extract-zip


type: file
name:
  /usr/share/wazuh-dashboard/plugins/notificationsDashboards/node_modules/cypress/node_modules/.bin/is-ci


type: file
name:
  /usr/share/wazuh-dashboard/plugins/notificationsDashboards/node_modules/extract-zip/node_modules/.bin/mkdirp


type: file
name:
  /usr/share/wazuh-dashboard/plugins/notificationsDashboards/node_modules/http-signature/node_modules/.bin/sshpk-conv


type: file
name:
  /usr/share/wazuh-dashboard/plugins/notificationsDashboards/node_modules/http-signature/node_modules/.bin/sshpk-sign


type: file
name:
  /usr/share/wazuh-dashboard/plugins/notificationsDashboards/node_modules/http-signature/node_modules/.bin/sshpk-verify


type: file
name:
  /usr/share/wazuh-dashboard/plugins/notificationsDashboards/node_modules/tmp/node_modules/.bin/rimraf


type: file
name:
  /usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/babel-eslint/node_modules/.bin/parser


type: file
name:
  /usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/babel-eslint/node_modules/@babel/generator/node_modules/.bin/jsesc


type: file
name:
  /usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/babel-eslint/node_modules/@babel/parser/bin/babel-parser.js


type: file
name:
  /usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/babel-eslint/node_modules/@babel/template/node_modules/.bin/parser


type: file
name:
  /usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/babel-eslint/node_modules/@babel/traverse/node_modules/.bin/parser


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/ad_ldap/azure_aad_secops_signin_failure_bad_password_threshold.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/ad_ldap/azure_aadhybridhealth_adfs_new_server.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/ad_ldap/azure_aadhybridhealth_adfs_service_delete.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/ad_ldap/azure_ad_device_registration_or_join_without_mfa.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/ad_ldap/azure_ad_device_registration_policy_changes.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/ad_ldap/azure_ad_sign_ins_from_noncompliant_devices.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/ad_ldap/azure_ad_sign_ins_from_unknown_devices.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/ad_ldap/azure_ad_user_added_to_admin_role.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/ad_ldap/azure_ad_users_added_to_device_admin_roles.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_aad_secops_ca_policy_removedby_bad_actor.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_aad_secops_ca_policy_updatedby_bad_actor.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_aad_secops_new_ca_policy_addedby_bad_actor.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_aad_secops_signin_failure_bad_password_threshold.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_aadhybridhealth_adfs_new_server.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_aadhybridhealth_adfs_service_delete.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_ad_auth_to_important_apps_using_single_factor_auth.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_ad_authentications_from_countries_you_do_not_operate_out_of.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_ad_device_registration_or_join_without_mfa.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_ad_device_registration_policy_changes.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_ad_failed_auth_from_countries_you_do_not_operate_out_of.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_ad_guest_users_invited_to_tenant_by_non_approved_inviters.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_ad_only_single_factor_auth_required.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_ad_risky_sign_ins_with_singlefactorauth_from_unknown_devices.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_ad_sign_ins_from_noncompliant_devices.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_ad_sign_ins_from_unknown_devices.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_ad_suspicious_signin_bypassing_mfa.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_ad_users_added_to_device_admin_roles.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_app_delegated_permissions_all_users.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_app_device_code_authentication.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_application_gateway_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_application_security_group_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_change_to_authentication_method.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_container_registry_created_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_creating_number_of_resources_detection.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_device_no_longer_managed_or_compliant.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_device_or_configuration_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_firewall_rule_collection_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_granting_permission_detection.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_group_user_addition_ca_modification.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_group_user_removal_ca_modification.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_identity_protection_anomalous_token.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_identity_protection_anomalous_user.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_identity_protection_anonymous_ip_activity.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_identity_protection_anonymous_ip_address.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_identity_protection_atypical_travel.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_identity_protection_impossible_travel.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_identity_protection_inbox_forwarding_rule.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_identity_protection_inbox_manipulation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_identity_protection_leaked_credentials.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_identity_protection_malicious_ip_address.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_identity_protection_malicious_ip_address_suspicious.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_identity_protection_malware_linked_ip.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_identity_protection_new_coutry_region.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_identity_protection_password_spray.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_identity_protection_prt_access.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_identity_protection_suspicious_browser.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_identity_protection_threat_intel.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_identity_protection_token_issuer_anomaly.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_identity_protection_unfamilar_sign_in.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_keyvault_key_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_keyvault_secrets_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_kubernetes_admission_controller.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_kubernetes_cluster_created_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_kubernetes_network_policy_change.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_kubernetes_rolebinding_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_kubernetes_secret_or_config_object_access.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_kubernetes_service_account_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_legacy_authentication_protocols.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_network_firewall_policy_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_network_firewall_rule_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_network_p2s_vpn_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_network_security_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_network_virtual_device_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_owner_removed_from_application_or_service_principal.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_pim_role_assigned_outside_of_pim.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_priviledged_role_assignment_add.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_priviledged_role_assignment_bulk_change.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_subscription_permissions_elevation_via_activitylogs.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_subscription_permissions_elevation_via_auditlogs.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_unusual_authentication_interruption.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_user_login_blocked_by_conditional_access.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_users_authenticating_to_other_azure_ad_tenants.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_virtual_network_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/azure/azure_vpn_connection_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/cloudtrail/aws_attached_malicious_lambda_layer.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/cloudtrail/aws_cloudtrail_disable_logging.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/cloudtrail/aws_create_load_balancer_layer.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/cloudtrail/aws_ecs_task_definition_backdoor.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/cloudtrail/aws_ecs_task_definition_cred_endpoint_query.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/cloudtrail/aws_efs_fileshare_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/cloudtrail/aws_efs_fileshare_mount_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/cloudtrail/aws_eks_cluster_created_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/cloudtrail/aws_elasticache_security_group_created.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/cloudtrail/aws_elasticache_security_group_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/cloudtrail/aws_iam_s3browser_loginprofile_creation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/cloudtrail/aws_iam_s3browser_templated_s3_bucket_policy_creation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/cloudtrail/aws_iam_s3browser_user_or_accesskey_creation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/cloudtrail/aws_lambda_function_created_or_invoked.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/cloudtrail/aws_passed_role_to_glue_development_endpoint.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/cloudtrail/aws_rds_change_master_password.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/cloudtrail/aws_route_53_domain_transferred_lock_disabled.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/cloudtrail/aws_route_53_domain_transferred_to_another_account.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/cloudtrail/aws_securityhub_finding_evasion.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/cloudtrail/aws_snapshot_backup_exfiltration.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/cloudtrail/aws_sts_getsessiontoken_misuse.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/dns/net_dns_external_service_interaction_domains.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/dns/net_dns_high_null_records_requests_rate.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/dns/net_dns_high_txt_records_requests_rate.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/github/github_disable_high_risk_configuration.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/github/github_disabled_outdated_dependency_or_vulnerability.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/github/github_outside_collaborator_detected.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/github/github_push_protection_bypass_detected.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/github/github_secret_scanning_feature_disabled.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/github/github_self_hosted_runner_changes_detected.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/gworkspace/gcp_gworkspace_application_access_levels_modified.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/gworkspace/gcp_gworkspace_application_removed.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/gworkspace/gcp_gworkspace_granted_domain_api_access.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/gworkspace/gcp_gworkspace_role_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/gworkspace/gcp_gworkspace_role_privilege_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/gworkspace/gcp_gworkspace_user_granted_admin_privileges.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/auditd/lnx_auditd_auditing_config_change.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/auditd/lnx_auditd_bpfdoor_file_accessed.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/auditd/lnx_auditd_bpfdoor_port_redirect.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/auditd/lnx_auditd_capabilities_discovery.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/auditd/lnx_auditd_change_file_time_attr.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/auditd/lnx_auditd_chattr_immutable_removal.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/auditd/lnx_auditd_clipboard_collection.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/auditd/lnx_auditd_clipboard_image_collection.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/auditd/lnx_auditd_disable_system_firewall.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/auditd/lnx_auditd_file_or_folder_permissions.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/auditd/lnx_auditd_find_cred_in_files.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/auditd/lnx_auditd_hidden_binary_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/auditd/lnx_auditd_hidden_files_directories.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/auditd/lnx_auditd_hidden_zip_files_steganography.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/auditd/lnx_auditd_keylogging_with_pam_d.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/auditd/lnx_auditd_ld_so_preload_mod.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/auditd/lnx_auditd_load_module_insmod.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/auditd/lnx_auditd_logging_config_change.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/auditd/lnx_auditd_masquerading_crond.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/auditd/lnx_auditd_modify_system_firewall.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/auditd/lnx_auditd_network_service_scanning.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/auditd/lnx_auditd_omigod_scx_runasprovider_executeshellcommand.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/auditd/lnx_auditd_password_policy_discovery.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/auditd/lnx_auditd_pers_systemd_reload.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/auditd/lnx_auditd_screencapture_import.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/auditd/lnx_auditd_screencaputre_xwd.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/auditd/lnx_auditd_split_file_into_pieces.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/auditd/lnx_auditd_steghide_embed_steganography.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/auditd/lnx_auditd_steghide_extract_steganography.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/auditd/lnx_auditd_susp_histfile_operations.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/auditd/lnx_auditd_system_info_discovery.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/auditd/lnx_auditd_system_info_discovery2.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/auditd/lnx_auditd_system_shutdown_reboot.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/auditd/lnx_auditd_systemd_service_creation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/auditd/lnx_auditd_unix_shell_configuration_modification.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/auditd/lnx_auditd_unzip_hidden_zip_files_steganography.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/builtin/auth/lnx_auth_pwnkit_local_privilege_escalation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/builtin/clamav/lnx_clamav_relevant_message.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/builtin/cron/lnx_cron_crontab_file_modification.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/builtin/guacamole/lnx_guacamole_susp_guacamole.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/builtin/lnx_nimbuspwn_privilege_escalation_exploit.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/builtin/lnx_potential_susp_ebpf_activity.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/builtin/lnx_privileged_user_creation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/builtin/lnx_shell_clear_cmd_history.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/builtin/sshd/lnx_sshd_ssh_cve_2018_15473.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/builtin/sudo/lnx_sudo_cve_2019_14287_user.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/builtin/syslog/lnx_syslog_security_tools_disabling_syslog.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/builtin/syslog/lnx_syslog_susp_named.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/builtin/vsftpd/lnx_vsftpd_susp_error_messages.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/file_event/file_event_lnx_doas_conf_creation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/file_event/file_event_lnx_persistence_cron_files.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/file_event/file_event_lnx_persistence_sudoers_files.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/file_event/file_event_lnx_susp_shell_script_under_profile_directory.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/file_event/file_event_lnx_triple_cross_rootkit_lock_file.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/file_event/file_event_lnx_triple_cross_rootkit_persistence.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/file_event/file_event_lnx_wget_download_file_in_tmp_dir.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/network_connection/net_connection_lnx_back_connect_shell_dev.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/network_connection/net_connection_lnx_crypto_mining_indicators.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/network_connection/net_connection_lnx_ngrok_tunnel.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_at_command.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_base64_decode.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_base64_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_base64_shebang_cli.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_bash_interactive_shell.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_bpf_kprob_tracing_enabled.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_bpftrace_unsafe_option_usage.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_capa_discovery.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_cat_sudoers.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_chattr_immutable_removal.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_clear_logs.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_clear_syslog.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_clipboard_collection.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_cp_passwd_or_shadow_tmp.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_crontab_enumeration.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_crontab_removal.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_crypto_mining.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_curl_usage.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_cve_2022_26134_atlassian_confluence.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_cve_2022_33891_spark_shell_command_injection.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_dd_file_overwrite.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_dd_process_injection.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_disable_ufw.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_doas_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_esxcli_network_discovery.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_esxcli_permission_change_admin.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_esxcli_storage_discovery.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_esxcli_syslog_config_change.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_esxcli_system_discovery.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_esxcli_user_account_creation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_esxcli_vm_discovery.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_esxcli_vm_kill.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_esxcli_vsan_discovery.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_file_and_directory_discovery.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_file_deletion.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_grep_os_arch_discovery.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_groupdel.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_gtfobin_apt.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_gtfobin_vim.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_install_root_certificate.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_install_suspicioua_packages.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_iptables_flush_ufw.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_kill_process.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_local_account.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_local_groups.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_malware_gobrat_grep_payload_discovery.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_mkfifo_named_pipe_creation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_mkfifo_named_pipe_creation_susp_location.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_mount_hidepid.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_netcat_reverse_shell.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_nohup.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_nohup_susp_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_omigod_scx_runasprovider_executescript.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_omigod_scx_runasprovider_executeshellcommand.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_perl_reverse_shell.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_php_reverse_shell.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_process_discovery.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_proxy_connection.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_python_pty_spawn.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_python_reverse_shell.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_remote_access_tools_teamviewer_incoming_connection.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_remote_system_discovery.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_remove_package.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_ruby_reverse_shell.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_schedule_task_job_cron.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_security_software_discovery.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_security_tools_disabling.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_services_stop_and_disable.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_setgid_setuid.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_ssm_agent_abuse.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_sudo_cve_2019_14287.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_susp_chmod_directories.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_susp_container_residence_discovery.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_susp_curl_fileupload.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_susp_curl_useragent.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_susp_dockerenv_recon.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_susp_execution_tmp_folder.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_susp_find_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_susp_git_clone.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_susp_history_delete.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_susp_history_recon.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_susp_hktl_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_susp_inod_listing.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_susp_interactive_bash.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_susp_java_children.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_susp_network_utilities_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_susp_pipe_shell.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_susp_recon_indicators.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_susp_sensitive_file_access.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_susp_shell_child_process_from_parent_tmp_folder.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_susp_shell_script_exec_from_susp_location.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_system_info_discovery.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_system_network_connections_discovery.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_system_network_discovery.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_touch_susp.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_triple_cross_rootkit_execve_hijack.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_triple_cross_rootkit_install.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_userdel.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_usermod_susp_group.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_webshell_detection.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_wget_download_suspicious_directory.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/linux/process_creation/proc_creation_lnx_xterm_reverse_shell.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/m365/microsoft365_activity_by_terminated_user.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/m365/microsoft365_activity_from_anonymous_ip_addresses.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/m365/microsoft365_activity_from_infrequent_country.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/m365/microsoft365_data_exfiltration_to_unsanctioned_app.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/m365/microsoft365_impossible_travel_activity.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/m365/microsoft365_logon_from_risky_ip_address.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/m365/microsoft365_new_federated_domain_added.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/m365/microsoft365_new_federated_domain_added_audit.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/m365/microsoft365_new_federated_domain_added_exchange.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/m365/microsoft365_potential_ransomware_activity.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/m365/microsoft365_pst_export_alert_using_new_compliancesearchaction.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/m365/microsoft365_susp_oauth_app_file_download_activities.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/m365/microsoft365_unusual_volume_of_file_deletion.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/m365/microsoft365_user_restricted_from_sending_email.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/network/cisco/aaa/cisco_cli_crypto_actions.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/network/cisco/aaa/cisco_cli_disable_logging.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/network/cisco/aaa/cisco_cli_file_deletion.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/network/cisco/aaa/cisco_cli_input_capture.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/network/cisco/aaa/cisco_cli_local_accounts.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/network/cisco/aaa/cisco_cli_modify_config.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/network/cisco/bgp/cisco_bgp_md5_auth_failed.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/network/cisco/ldp/cisco_ldp_md5_auth_failed.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/network/firewall/net_firewall_cleartext_protocols.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/network/firewall/net_firewall_high_dns_bytes_out.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/network/firewall/net_firewall_high_dns_requests_rate.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/network/firewall/net_firewall_susp_network_scan_by_ip.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/network/firewall/net_firewall_susp_network_scan_by_port.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/network/zeek/zeek_dce_rpc_domain_user_enumeration.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/network/zeek/zeek_dce_rpc_mitre_bzar_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/network/zeek/zeek_dce_rpc_mitre_bzar_persistence.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/network/zeek/zeek_dce_rpc_potential_petit_potam_efs_rpc_call.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/network/zeek/zeek_dce_rpc_printnightmare_print_driver_install.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/network/zeek/zeek_dce_rpc_smb_spoolss_named_pipe.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/network/zeek/zeek_default_cobalt_strike_certificate.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/network/zeek/zeek_http_executable_download_from_webdav.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/network/zeek/zeek_http_omigod_no_auth_rce.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/network/zeek/zeek_http_webdav_put_request.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/network/zeek/zeek_smb_converted_win_atsvc_task.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/network/zeek/zeek_smb_converted_win_impacket_secretdump.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/network/zeek/zeek_smb_converted_win_lm_namedpipe.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/network/zeek/zeek_smb_converted_win_susp_psexec.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/network/zeek/zeek_smb_converted_win_susp_raccess_sensitive_fext.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/network/zeek/zeek_smb_converted_win_transferring_files_with_credential_data.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/okta/okta_admin_role_assigned_to_user_or_group.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/okta/okta_application_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/okta/okta_application_sign_on_policy_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/okta/okta_network_zone_deactivated_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/okta/okta_policy_rule_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_application/antivirus/av_exploiting.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_application/antivirus/av_password_dumper.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_application/antivirus/av_printernightmare_cve_2021_34527.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_application/antivirus/av_ransomware.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_application/antivirus/av_relevant_files.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_application/django/appframework_django_exceptions.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_application/python/app_python_sql_exceptions.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_application/rpc_firewall/rpc_firewall_atsvc_lateral_movement.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_application/rpc_firewall/rpc_firewall_atsvc_recon.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_application/rpc_firewall/rpc_firewall_dcsync_attack.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_application/rpc_firewall/rpc_firewall_efs_abuse.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_application/rpc_firewall/rpc_firewall_eventlog_recon.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_application/rpc_firewall/rpc_firewall_itaskschedulerservice_lateral_movement.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_application/rpc_firewall/rpc_firewall_itaskschedulerservice_recon.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_application/rpc_firewall/rpc_firewall_printing_lateral_movement.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_application/rpc_firewall/rpc_firewall_remote_dcom_or_wmi.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_application/rpc_firewall/rpc_firewall_remote_registry_lateral_movement.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_application/rpc_firewall/rpc_firewall_remote_registry_recon.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_application/rpc_firewall/rpc_firewall_remote_server_service_abuse.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_application/rpc_firewall/rpc_firewall_remote_service_lateral_movement.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_application/rpc_firewall/rpc_firewall_sasec_lateral_movement.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_application/rpc_firewall/rpc_firewall_sasec_recon.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_application/rpc_firewall/rpc_firewall_sharphound_recon_account.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_application/rpc_firewall/rpc_firewall_sharphound_recon_sessions.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_application/ruby/appframework_ruby_on_rails_exceptions.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_application/spring/appframework_spring_exceptions.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_application/sql/app_sqlinjection_errors.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_aad_secops_signin_failure_bad_password_threshold.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_aadhybridhealth_adfs_new_server.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_aadhybridhealth_adfs_service_delete.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_ad_bitlocker_key_retrieval.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_ad_device_registration_or_join_without_mfa.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_ad_device_registration_policy_changes.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_ad_sign_ins_from_noncompliant_devices.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_ad_sign_ins_from_unknown_devices.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_ad_user_added_to_admin_role.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_ad_users_added_to_device_admin_roles.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_app_appid_uri_changes.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_app_credential_added.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_app_credential_modification.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_app_device_code_authentication.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_app_ropc_authentication.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_app_uri_modifications.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_application_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_application_gateway_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_application_security_group_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_blocked_account_attempt.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_change_to_authentication_method.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_conditional_access_failure.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_container_registry_created_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_creating_number_of_resources_detection.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_device_no_longer_managed_or_compliant.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_device_or_configuration_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_dns_zone_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_federation_modified.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_firewall_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_firewall_rule_collection_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_granting_permission_detection.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_keyvault_key_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_keyvault_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_keyvault_secrets_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_kubernetes_admission_controller.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_kubernetes_cluster_created_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_kubernetes_cronjob.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_kubernetes_events_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_kubernetes_network_policy_change.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_kubernetes_pods_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_kubernetes_role_access.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_kubernetes_rolebinding_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_kubernetes_secret_or_config_object_access.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_kubernetes_service_account_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_login_to_disabled_account.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_network_firewall_policy_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_network_firewall_rule_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_network_p2s_vpn_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_network_security_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_network_virtual_device_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_new_cloudshell_created.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_owner_removed_from_application_or_service_principal.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_service_principal_created.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_service_principal_removed.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_subscription_permissions_elevation_via_activitylogs.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_subscription_permissions_elevation_via_auditlogs.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_suppression_rule_created.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_unusual_authentication_interruption.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_user_login_blocked_by_conditional_access.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_virtual_network_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/azure/azure_vpn_connection_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/gcp/gcp_bucket_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/gcp/gcp_dlp_re_identifies_sensitive_information.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/gcp/gcp_dns_zone_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/gcp/gcp_firewall_rule_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/gcp/gcp_full_network_traffic_packet_capture.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/gcp/gcp_kubernetes_admission_controller.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/gcp/gcp_kubernetes_rolebinding.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/gcp/gcp_kubernetes_secrets_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/gcp/gcp_service_account_disabled_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/gcp/gcp_service_account_modified.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/gcp/gcp_sql_database_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/gcp/gcp_vpn_tunnel_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/gworkspace/gworkspace_application_removed.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/gworkspace/gworkspace_granted_domain_api_access.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/gworkspace/gworkspace_mfa_disabled.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/gworkspace/gworkspace_role_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/gworkspace/gworkspace_role_privilege_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/gworkspace/gworkspace_user_granted_admin_privileges.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/m365/microsoft365_activity_by_terminated_user.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/m365/microsoft365_activity_from_anonymous_ip_addresses.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/m365/microsoft365_activity_from_infrequent_country.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/m365/microsoft365_data_exfiltration_to_unsanctioned_app.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/m365/microsoft365_from_susp_ip_addresses.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/m365/microsoft365_impossible_travel_activity.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/m365/microsoft365_logon_from_risky_ip_address.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/m365/microsoft365_new_federated_domain_added.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/m365/microsoft365_potential_ransomware_activity.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/m365/microsoft365_susp_inbox_forwarding.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/m365/microsoft365_susp_oauth_app_file_download_activities.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/m365/microsoft365_unusual_volume_of_file_deletion.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/m365/microsoft365_user_restricted_from_sending_email.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/okta/okta_admin_role_assigned_to_user_or_group.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/okta/okta_application_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/okta/okta_application_sign_on_policy_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/okta/okta_mfa_reset_or_deactivated.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/okta/okta_network_zone_deactivated_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/okta/okta_policy_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/okta/okta_policy_rule_modified_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/okta/okta_security_threat_detected.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/okta/okta_unauthorized_access_to_app.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/okta/okta_user_account_locked_out.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/onelogin/onelogin_assumed_another_user.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_cloud/onelogin/onelogin_user_account_locked.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_compliance/default_credentials_usage.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_compliance/firewall_cleartext_protocols.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_compliance/group_modification_logging.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_compliance/netflow_cleartext_protocols.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_macos/file_event/file_event_macos_emond_launch_daemon.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_macos/file_event/file_event_macos_startup_items.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_macos/process_creation/proc_creation_macos_applescript.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_macos/process_creation/proc_creation_macos_base64_decode.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_macos/process_creation/proc_creation_macos_binary_padding.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_macos/process_creation/proc_creation_macos_change_file_time_attr.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_macos/process_creation/proc_creation_macos_clear_system_logs.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_macos/process_creation/proc_creation_macos_create_account.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_macos/process_creation/proc_creation_macos_create_hidden_account.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_macos/process_creation/proc_creation_macos_creds_from_keychain.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_macos/process_creation/proc_creation_macos_disable_security_tools.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_macos/process_creation/proc_creation_macos_file_and_directory_discovery.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_macos/process_creation/proc_creation_macos_find_cred_in_files.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_macos/process_creation/proc_creation_macos_gui_input_capture.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_macos/process_creation/proc_creation_macos_local_account.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_macos/process_creation/proc_creation_macos_local_groups.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_macos/process_creation/proc_creation_macos_network_service_scanning.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_macos/process_creation/proc_creation_macos_network_sniffing.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_macos/process_creation/proc_creation_macos_remote_system_discovery.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_macos/process_creation/proc_creation_macos_schedule_task_job_cron.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_macos/process_creation/proc_creation_macos_screencapture.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_macos/process_creation/proc_creation_macos_security_software_discovery.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_macos/process_creation/proc_creation_macos_space_after_filename.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_macos/process_creation/proc_creation_macos_split_file_into_pieces.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_macos/process_creation/proc_creation_macos_susp_histfile_operations.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_macos/process_creation/proc_creation_macos_susp_macos_firmware_activity.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_macos/process_creation/proc_creation_macos_system_network_connections_discovery.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_macos/process_creation/proc_creation_macos_system_network_discovery.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_macos/process_creation/proc_creation_macos_system_shutdown_reboot.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_macos/process_creation/proc_creation_macos_xattr_gatekeeper_bypass.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_proxy/proxy_download_susp_tlds_blacklist.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_proxy/proxy_download_susp_tlds_whitelist.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_proxy/proxy_raw_paste_service_access.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_proxy/proxy_susp_flash_download_loc.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_proxy/proxy_ursnif_malware_download_url.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_web/web_cve_2010_5278_exploitation_attempt.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_web/web_cve_2018_13379_fortinet_preauth_read_exploit.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_web/web_cve_2018_2894_weblogic_exploit.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_web/web_cve_2019_11510_pulsesecure_exploit.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_web/web_cve_2019_19781_citrix_exploit.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_web/web_cve_2020_0688_exchange_exploit.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_web/web_cve_2020_10148_solarwinds_exploit.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_web/web_cve_2020_14882_weblogic_exploit.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_web/web_cve_2020_28188_terramaster_rce_exploit.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_web/web_cve_2020_3452_cisco_asa_ftd.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_web/web_cve_2020_8193_8195_citrix_exploit.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_web/web_cve_2021_20090_2021_20091_arcadyan_router_exploit.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_web/web_cve_2021_2109_weblogic_rce_exploit.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_web/web_cve_2021_21972_vsphere_unauth_rce_exploit.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_web/web_cve_2021_21978_vmware_view_planner_exploit.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_web/web_cve_2021_22005_vmware_file_upload.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_web/web_cve_2021_22123_fortinet_exploit.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_web/web_cve_2021_22893_pulse_secure_rce_exploit.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_web/web_cve_2021_28480_exchange_exploit.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_web/web_cve_2021_33766_msexchange_proxytoken.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_web/web_cve_2021_40539_adselfservice.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_web/web_cve_2021_40539_manageengine_adselfservice_exploit.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_web/web_cve_2021_41773_apache_path_traversal.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_web/web_cve_2021_42237_sitecore_report_ashx.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_web/web_cve_2021_44228_log4j_fields.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_web/web_exchange_exploitation_hafnium.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_web/web_exchange_proxyshell_successful.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_web/web_java_payload_in_access_logs.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_web/web_multiple_susp_resp_codes_single_source.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_web/web_path_traversal_exploitation_attempt.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_web/web_solarwinds_supernova_webshell.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_web/web_sonicwall_jarrewrite_exploit.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_web/web_sql_injection_in_access_logs.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_web/web_unc2546_dewmode_php_webshell.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/others_web/web_win_webshells_in_access_logs.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/test_windows/dns_query_win_regsvr32_network_activity.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/test_windows/net_connection_win_regsvr32_network_activity.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/test_windows/proc_creation_win_susp_regsvr32_no_dll.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/test_windows/proc_creation_win_system_exe_anomaly.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/waf/web_cve_2023_25717_ruckus_wireless_admin_exploit_attempt.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/application/win_audit_cve.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/application/win_av_relevant_match.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/application/win_builtin_remove_application.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/application/win_software_atera_rmm_agent_install.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/application/win_susp_backup_delete.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/application/win_susp_msmpeng_crash.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/application/win_vul_cve_2020_0688.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/application/win_vul_cve_2021_41379.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/applocker/win_applocker_file_was_not_allowed_to_run.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/bits_client/win_bits_client_susp_domain.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/bits_client/win_bits_client_susp_local_file.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/bits_client/win_bits_client_susp_local_folder.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/bits_client/win_bits_client_susp_powershell_job.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/bits_client/win_bits_client_susp_use_bitsadmin.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/bits_client/win_bits_client_uncommon_domain.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/code_integrity/win_codeintegrity_failed_driver_load.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/dns_server/win_apt_gallium.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/dns_server/win_susp_dns_config.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/driverframeworks/win_usb_device_plugged.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/firewall_as/win_firewall_as_add_rule.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/firewall_as/win_firewall_as_change_rule.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/firewall_as/win_firewall_as_delete_rule.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/firewall_as/win_firewall_as_failed.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/firewall_as/win_firewall_as_reset.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/firewall_as/win_firewall_as_setting_change.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/msexchange/win_exchange_cve_2021_42321.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/msexchange/win_exchange_proxylogon_oabvirtualdir.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/msexchange/win_exchange_proxyshell_certificate_generation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/msexchange/win_exchange_proxyshell_mailbox_export.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/msexchange/win_exchange_proxyshell_remove_mailbox_export.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/msexchange/win_exchange_transportagent.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/msexchange/win_exchange_transportagent_failed.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/msexchange/win_set_oabvirtualdirectory_externalurl.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/ntlm/win_susp_ntlm_brute_force.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/printservice/win_exploit_cve_2021_1675_printspooler.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/printservice/win_exploit_cve_2021_1675_printspooler_operational.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_aadhealth_mon_agent_regkey_access.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_aadhealth_svc_agent_regkey_access.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_account_backdoor_dcsync_rights.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_account_discovery.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_ad_object_writedac_access.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_ad_replication_non_machine_account.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_ad_user_enumeration.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_adcs_certificate_template_configuration_vulnerability.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_adcs_certificate_template_configuration_vulnerability_eku.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_admin_rdp_login.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_admin_share_access.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_alert_active_directory_user_control.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_alert_ad_user_backdoors.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_alert_enable_weak_encryption.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_apt_chafer_mar18_security.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_apt_slingshot.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_camera_microphone_access.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_dce_rpc_smb_spoolss_named_pipe.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_dcom_iertutil_dll_hijack.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_defender_bypass.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_disable_event_logging.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_dpapi_domain_backupkey_extraction.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_dpapi_domain_masterkey_backup_attempt.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_etw_modification.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_event_log_cleared.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_exploit_cve_2021_1675_printspooler_security.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_external_device.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_global_catalog_enumeration.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_gpo_scheduledtasks.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_hidden_user_creation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_hybridconnectionmgr_svc_installation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_impacket_psexec.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_impacket_secretdump.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_invoke_obfuscation_clip_services_security.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_invoke_obfuscation_obfuscated_iex_services_security.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_invoke_obfuscation_stdin_services_security.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_invoke_obfuscation_var_services_security.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_invoke_obfuscation_via_compress_services_security.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_invoke_obfuscation_via_rundll_services_security.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_invoke_obfuscation_via_stdin_services_security.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_invoke_obfuscation_via_use_clip_services_security.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_invoke_obfuscation_via_use_mshta_services_security.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_invoke_obfuscation_via_use_rundll32_services_security.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_invoke_obfuscation_via_var_services_security.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_lm_namedpipe.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_lolbas_execution_of_nltest.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_lsass_access_non_system_account.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_mal_wceaux_dll.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_metasploit_authentication.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_net_ntlm_downgrade.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_net_share_obj_susp_desktop_ini.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_new_or_renamed_user_account_with_dollar_sign.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_not_allowed_rdp_access.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_overpass_the_hash.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_pass_the_hash.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_pass_the_hash_2.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_petitpotam_network_share.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_petitpotam_susp_tgt_request.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_possible_dc_shadow.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_privesc_cve_2020_1472.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_protected_storage_service_access.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_rare_schtasks_creations.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_rdp_bluekeep_poc_scanner.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_rdp_localhost_login.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_rdp_reverse_tunnel.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_register_new_logon_process_by_rubeus.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_remote_powershell_session.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_remote_registry_management_using_reg_utility.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_sam_registry_hive_handle_request.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_samaccountname_spoofing_cve_2021_42287.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_scheduled_task_deletion.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_scm_database_handle_failure.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_scm_database_privileged_operation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_scrcons_remote_wmi_scripteventconsumer.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_security_cobaltstrike_service_installs.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_security_mal_creddumper.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_security_mal_service_installs.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_security_metasploit_or_impacket_smb_psexec_service_install.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_security_meterpreter_or_cobaltstrike_getsystem_service_install.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_security_powershell_script_installed_as_service.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_security_tap_driver_installation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_security_wmi_persistence.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_smb_file_creation_admin_shares.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_add_domain_trust.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_add_sid_history.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_codeintegrity_check_failure.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_dsrm_password_change.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_eventlog_cleared.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_failed_logon_reasons.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_failed_logon_source.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_failed_logons_explicit_credentials.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_failed_logons_single_process.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_failed_logons_single_source.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_failed_logons_single_source2.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_failed_logons_single_source_kerberos.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_failed_logons_single_source_kerberos2.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_failed_logons_single_source_kerberos3.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_failed_logons_single_source_ntlm.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_failed_logons_single_source_ntlm2.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_failed_remote_logons_single_source.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_interactive_logons.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_kerberos_manipulation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_krbrelayup.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_ldap_dataexchange.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_local_anon_logon_created.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_logon_explicit_credentials.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_lsass_dump.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_lsass_dump_generic.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_multiple_files_renamed_or_deleted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_net_recon_activity.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_opened_encrypted_zip.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_opened_encrypted_zip_filename.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_opened_encrypted_zip_outlook.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_outbound_kerberos_connection.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_raccess_sensitive_fext.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_rc4_kerberos.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_rottenpotato.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_samr_pwset.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_sdelete.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_time_modification.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_susp_wmi_login.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_svcctl_remote_service.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_syskey_registry_access.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_sysmon_channel_reference_deletion.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_transferring_files_with_credential_data_via_network_shares.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_user_added_to_local_administrators.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_user_couldnt_call_privileged_service_lsaregisterlogonprocess.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_user_creation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_user_driver_loaded.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_vssaudit_secevent_source_registration.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/security/win_wmiprvse_wbemcomn_dll_hijack.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/servicebus/win_hybridconnectionmgr_svc_running.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/smbclient/win_susp_failed_guest_logon.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_apt_carbonpaper_turla.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_apt_chafer_mar18_system.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_apt_stonedrill.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_apt_turla_service_png.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_cobaltstrike_service_installs.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_eventlog_cleared.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_invoke_obfuscation_clip_services.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_invoke_obfuscation_obfuscated_iex_services.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_invoke_obfuscation_stdin_services.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_invoke_obfuscation_var_services.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_invoke_obfuscation_via_compress_services.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_invoke_obfuscation_via_rundll_services.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_invoke_obfuscation_via_stdin_services.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_invoke_obfuscation_via_use_clip_services.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_invoke_obfuscation_via_use_mshta_services.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_invoke_obfuscation_via_use_rundll32_services.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_invoke_obfuscation_via_var_services.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_mal_creddumper.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_meterpreter_or_cobaltstrike_getsystem_service_installation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_moriya_rootkit.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_ntfs_vuln_exploit.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_possible_zerologon_exploitation_using_wellknown_tools.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_powershell_script_installed_as_service.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_quarkspwdump_clearing_hive_access_history.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_rare_service_installs.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_rdp_potential_cve_2019_0708.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_security_krbrelayup_service_installation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_service_hacktools.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_service_install_susp_double_ampersand.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_susp_dhcp_config.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_susp_dhcp_config_failed.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_susp_proceshacker.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_susp_service_installation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_susp_service_installation_folder.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_susp_service_installation_folder_pattern.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_susp_service_installation_script.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_susp_system_update_error.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_system_application_sysmon_crash.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_system_defender_disabled.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_system_susp_eventlog_cleared.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_tap_driver_installation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_volume_shadow_copy_mount.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_vul_cve_2020_1472.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/system/win_vul_cve_2021_42278_or_cve_2021_42287.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/taskscheduler/win_rare_schtask_creation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/terminalservices/win_terminalservices_rdp_ngrok.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/win_alert_mimikatz_keywords.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/win_susp_logon_newcredentials.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/windefend/win_alert_lsass_access.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/windefend/win_defender_amsi_trigger.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/windefend/win_defender_disabled.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/windefend/win_defender_exclusions.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/windefend/win_defender_history_delete.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/windefend/win_defender_psexec_wmi_asr.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/windefend/win_defender_tamper_protection_trigger.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/builtin/windefend/win_defender_threat.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/create_remote_thread/create_remote_thread_win_susp_targets.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/create_remote_thread/create_remote_thread_win_ttdinjec.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/create_remote_thread/sysmon_cactustorch.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/create_remote_thread/sysmon_cobaltstrike_process_injection.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/create_remote_thread/sysmon_createremotethread_loadlibrary.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/create_remote_thread/sysmon_password_dumper_keepass.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/create_remote_thread/sysmon_password_dumper_lsass.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/create_remote_thread/sysmon_powershell_code_injection.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/create_remote_thread/sysmon_susp_powershell_rundll32.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/create_remote_thread/sysmon_susp_remote_thread.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/create_stream_hash/sysmon_ads_executable.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/create_stream_hash/sysmon_regedit_export_to_ads.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/dns_query/dns_query_win_gotoopener.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/dns_query/dns_query_win_hybridconnectionmgr_servicebus.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/dns_query/dns_query_win_lobas_appinstaller.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/dns_query/dns_query_win_mal_cobaltstrike.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/dns_query/dns_query_win_possible_dns_rebinding.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/dns_query/dns_query_win_regsvr32_network_activity.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/dns_query/dns_query_win_susp_ipify.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/dns_query/dns_query_win_susp_teamviewer.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/dns_query/dns_query_win_tor_onion.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/driver_load/driver_load_mal_creddumper.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/driver_load/driver_load_meterpreter_or_cobaltstrike_getsystem_service_installation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/driver_load/driver_load_powershell_script_installed_as_service.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/driver_load/driver_load_susp_temp_use.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/driver_load/driver_load_vuln_dell_driver.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/driver_load/driver_load_windivert.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_access/file_access_win_browser_credential_stealing.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_delete/file_delete_win_cve_2021_1675_printspooler_del.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_delete/file_delete_win_delete_appli_log.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_delete/file_delete_win_delete_backup_file.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_delete/file_delete_win_delete_prefetch.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_delete/file_delete_win_sysinternals_sdelete_file_deletion.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_access_susp_unattend_xml.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_advanced_ip_scanner.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_anydesk_artefact.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_apt_unidentified_nov_18.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_crackmapexec_patterns.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_creation_new_shim_database.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_creation_scr_binary_file.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_creation_system_file.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_creation_unquoted_service_path.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_cred_dump_tools_dropped_files.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_csharp_compile_artefact.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_cve_2021_1675_printspooler.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_cve_2021_26858_msexchange.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_cve_2021_31979_cve_2021_33771_exploits.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_cve_2021_41379_msi_lpe.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_cve_2021_44077_poc_default_files.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_cve_2022_24527_lpe.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_detect_powerup_dllhijacking.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_ghostpack_safetykatz.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_gotoopener_artefact.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_hack_dumpert.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_hivenightmare_file_exports.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_hktl_nppspy.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_install_teamviewer_desktop.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_iso_file_recent.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_lsass_dump.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_lsass_memory_dump_file_creation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_lsass_werfault_dump.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_macro_file.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_mal_adwind.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_mal_octopus_scanner.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_mal_vhd_download.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_mimikatz_kirbi_file_creation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_mimimaktz_memssp_log_file.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_moriya_rootkit.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_new_src_file.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_notepad_plus_plus_persistence.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_ntds_dit.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_ntds_exfil_tools.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_office_persistence.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_outlook_c2_macro_creation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_outlook_newform.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_pcre_net_temp_file.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_pingback_backdoor.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_powershell_exploit_scripts.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_powershell_startup_shortcuts.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_quarkspw_filedump.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_rclone_exec_file.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_redmimicry_winnti_filedrop.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_sam_dump.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_screenconnect_artefact.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_script_creation_by_office_using_file_ext.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_startup_folder_file_write.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_susp_adsi_cache_usage.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_susp_clr_logs.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_susp_colorcpl.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_susp_creation_by_mobsync.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_susp_default_gpo_dir_write.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_susp_desktop_ini.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_susp_desktop_txt.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_susp_desktopimgdownldr_file.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_susp_diagcab.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_susp_dropper.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_susp_exchange_aspx_write.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_susp_get_variable.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_susp_ntds_dit.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_susp_pfx_file_creation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_susp_powershell_profile_create.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_susp_procexplorer_driver_created_in_tmp_folder.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_susp_system_interactive_powershell.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_susp_task_write.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_susp_teamviewer_remote_session.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_susp_winword_startup.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_tool_psexec.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_tsclient_filewrite_startup.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_uac_bypass_consent_comctl32.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_uac_bypass_dotnet_profiler.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_uac_bypass_eventvwr.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_uac_bypass_idiagnostic_profile.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_uac_bypass_ieinstal.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_uac_bypass_msconfig_gui.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_uac_bypass_ntfs_reparse_point.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_uac_bypass_winsat.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_uac_bypass_wmp.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_webshell_creation_detect.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_werfault_dll_hijacking.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_win_cscript_wscript_dropper.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_win_shell_write_susp_directory.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_winrm_awl_bypass.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_winword_cve_2021_40444.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_wmi_persistence_script_event_consumer_write.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_wmiprvse_wbemcomn_dll_hijack.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_word_template_creation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_event/file_event_win_writing_local_admin_share.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/file_rename/file_rename_win_not_dll_to_dll.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/image_load/image_load_abusing_azure_browser_sso.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/image_load/image_load_alternate_powershell_hosts_moduleload.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/image_load/image_load_foggyweb_nobelium.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/image_load/image_load_in_memory_powershell.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/image_load/image_load_mimikatz_inmemory_detection.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/image_load/image_load_msdt_sdiageng.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/image_load/image_load_pcre_net_load.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/image_load/image_load_pingback_backdoor.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/image_load/image_load_scrcons_imageload_wmi_scripteventconsumer.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/image_load/image_load_silenttrinity_stage_use.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/image_load/image_load_spoolsv_dll_load.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/image_load/image_load_susp_advapi32_dll.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/image_load/image_load_susp_dbghelp_dbgcore_load.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/image_load/image_load_susp_fax_dll.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/image_load/image_load_susp_image_load.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/image_load/image_load_susp_office_dotnet_assembly_dll_load.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/image_load/image_load_susp_office_dotnet_clr_dll_load.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/image_load/image_load_susp_office_dotnet_gac_dll_load.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/image_load/image_load_susp_office_dsparse_dll_load.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/image_load/image_load_susp_office_kerberos_dll_load.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/image_load/image_load_susp_python_image_load.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/image_load/image_load_susp_script_dotnet_clr_dll_load.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/image_load/image_load_susp_system_drawing_load.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/image_load/image_load_susp_vss_ps_load.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/image_load/image_load_susp_winword_vbadll_load.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/image_load/image_load_svchost_dll_search_order_hijack.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/image_load/image_load_tttracer_mod_load.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/image_load/image_load_uac_bypass_via_dism.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/image_load/image_load_uipromptforcreds_dlls.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/image_load/image_load_unsigned_image_loaded_into_lsass.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/image_load/image_load_usp_svchost_clfsw32.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/image_load/image_load_wmi_module_load.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/image_load/image_load_wmi_persistence_commandline_event_consumer.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/image_load/image_load_wmic_remote_xsl_scripting_dlls.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/image_load/image_load_wmiprvse_wbemcomn_dll_hijack.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/image_load/image_load_wsman_provider_image_load.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/network_connection/net_connection_susp_win_binary_no_cmdline.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/network_connection/net_connection_win_binary_github_com.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/network_connection/net_connection_win_binary_susp_com.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/network_connection/net_connection_win_crypto_mining.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/network_connection/net_connection_win_dllhost_net_connections.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/network_connection/net_connection_win_eqnedt.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/network_connection/net_connection_win_excel_outbound_network_connection.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/network_connection/net_connection_win_imewdbld.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/network_connection/net_connection_win_malware_backconnect_ports.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/network_connection/net_connection_win_mega_nz.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/network_connection/net_connection_win_msiexec.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/network_connection/net_connection_win_notepad_network_connection.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/network_connection/net_connection_win_powershell_network_connection.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/network_connection/net_connection_win_python.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/network_connection/net_connection_win_rdp_reverse_tunnel.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/network_connection/net_connection_win_rdp_to_http.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/network_connection/net_connection_win_regsvr32_network_activity.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/network_connection/net_connection_win_remote_powershell_session_network.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/network_connection/net_connection_win_rundll32_net_connections.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/network_connection/net_connection_win_silenttrinity_stager_msbuild_activity.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/network_connection/net_connection_win_susp_dropbox_api.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/network_connection/net_connection_win_susp_outbound_kerberos_connection.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/network_connection/net_connection_win_susp_outbound_mobsync_connection.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/network_connection/net_connection_win_susp_outbound_smtp_connections.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/network_connection/net_connection_win_susp_prog_location_network_connection.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/network_connection/net_connection_win_susp_rdp.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/network_connection/net_connection_win_wuauclt_network_connection.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/pipe_created/pipe_created_alternate_powershell_hosts_pipe.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/pipe_created/pipe_created_apt_turla_namedpipes.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/pipe_created/pipe_created_cred_dump_tools_named_pipes.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/pipe_created/pipe_created_efspotato_namedpipe.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/pipe_created/pipe_created_mal_cobaltstrike.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/pipe_created/pipe_created_mal_cobaltstrike_re.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/pipe_created/pipe_created_mal_namedpipes.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/pipe_created/pipe_created_powershell_execution_pipe.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/pipe_created/pipe_created_psexec_pipes_artifacts.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/pipe_created/pipe_created_susp_adfs_namedpipe_connection.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/pipe_created/pipe_created_susp_cobaltstrike_pipe_patterns.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/pipe_created/pipe_created_susp_wmi_consumer_namedpipe.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/pipe_created/pipe_created_tool_psexec.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_classic/posh_pc_alternate_powershell_hosts.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_classic/posh_pc_delete_volume_shadow_copies.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_classic/posh_pc_downgrade_attack.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_classic/posh_pc_exe_calling_ps.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_classic/posh_pc_powercat.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_classic/posh_pc_remote_powershell_session.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_classic/posh_pc_renamed_powershell.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_classic/posh_pc_susp_athremotefxvgpudisablementcommand.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_classic/posh_pc_susp_download.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_classic/posh_pc_susp_get_nettcpconnection.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_classic/posh_pc_susp_zip_compress.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_classic/posh_pc_tamper_with_windows_defender.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_classic/posh_pc_wsman_com_provider_no_powershell.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_classic/posh_pc_xor_commandline.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_module/posh_pm_alternate_powershell_hosts.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_module/posh_pm_bad_opsec_artifacts.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_module/posh_pm_clear_powershell_history.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_module/posh_pm_decompress_commands.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_module/posh_pm_get_addbaccount.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_module/posh_pm_get_clipboard.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_clip.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_obfuscated_iex.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_stdin.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_var.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_compress.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_rundll.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_stdin.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_use_clip.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_use_mhsta.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_use_rundll32.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_var.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_module/posh_pm_powercat.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_module/posh_pm_remote_powershell_session.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_module/posh_pm_susp_ad_group_reco.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_module/posh_pm_susp_athremotefxvgpudisablementcommand.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_module/posh_pm_susp_download.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_module/posh_pm_susp_get_nettcpconnection.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_module/posh_pm_susp_invocation_generic.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_module/posh_pm_susp_invocation_specific.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_module/posh_pm_susp_local_group_reco.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_module/posh_pm_susp_reset_computermachinepassword.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_module/posh_pm_susp_smb_share_reco.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_module/posh_pm_susp_zip_compress.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_module/posh_pm_syncappvpublishingserver_exe.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_access_to_browser_login_data.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_accessing_win_api.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_adrecon_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_as_rep_roasting.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_automated_collection.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_azurehound_commands.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_capture_screenshots.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_cl_invocation_lolscript.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_cl_invocation_lolscript_count.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_cl_mutexverifiers_lolscript.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_cl_mutexverifiers_lolscript_count.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_clear_powershell_history.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_clearing_windows_console_history.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_cmdlet_scheduled_task.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_copy_item_system32.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_cor_profiler.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_create_local_user.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_create_volume_shadow_copy.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_data_compressed.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_detect_vm_env.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_directorysearcher.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_directoryservices_accountmanagement.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_dnscat_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_dump_password_windows_credential_manager.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_enable_psremoting.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_enumerate_password_windows_credential_manager.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_etw_trace_evasion.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_file_and_directory_discovery.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_get_acl_service.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_get_adreplaccount.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_get_childitem_bookmarks.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_hotfix_enum.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_icmp_exfiltration.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_invoke_command_remote.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_invoke_dnsexfiltration.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_invoke_nightmare.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_clip.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_obfuscated_iex.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_stdin.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_var.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_compress.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_rundll.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_stdin.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_use_clip.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_use_mhsta.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_use_rundll32.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_var.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_keylogging.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_localuser.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_malicious_commandlets.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_malicious_keywords.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_memorydump_getstoragediagnosticinfo.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_msxml_com.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_nishang_malicious_commandlets.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_ntfs_ads_access.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_office_comobject_registerxll.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_powerview_malicious_commandlets.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_prompt_credentials.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_psattack.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_remote_session_creation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_remove_item_path.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_request_kerberos_ticket.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_root_certificate_installed.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_run_from_mount_diskimage.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_security_software_discovery.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_send_mailmessage.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_set_policies_to_unsecure_level.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_shellcode_b64.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_shellintel_malicious_commandlets.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_software_discovery.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_store_file_in_alternate_data_stream.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_ad_group_reco.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_directory_enum.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_download.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_execute_batch_script.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_export_pfxcertificate.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_extracting.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_follina_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_get_adcomputer.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_get_addefaultdomainpasswordpolicy.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_get_adgroup.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_get_current_user.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_get_gpo.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_get_process.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_getprocess_lsass.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_gettypefromclsid.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_gwmi.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_hyper_v_condlet.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_invocation_generic.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_invocation_specific.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_invoke_webrequest_useragent.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_iofilestream.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_keywords.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_local_group_reco.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_mail_acces.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_mount_diskimage.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_mounted_share_deletion.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_networkcredential.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_new_psdrive.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_recon_export.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_remove_adgroupmember.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_smb_share_reco.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_ssl_keyword.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_start_process.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_unblock_file.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_wallpaper.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_win32_pnpentity.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_win32_shadowcopy.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_windowstyle.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_susp_zip_compress.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_syncappvpublishingserver_exe.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_tamper_defender.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_test_netconnection.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_timestomp.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_trigger_profiles.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_upload.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_web_request.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_win32_product_install_msi.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_windows_firewall_profile_disabled.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_winlogon_helper_dll.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_wmi_persistence.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_wmimplant.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/powershell/powershell_script/posh_ps_xml_iex.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_access/proc_access_win_cmstp_execution_by_access.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_access/proc_access_win_cobaltstrike_bof_injection_pattern.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_access/proc_access_win_cred_dump_lsass_access.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_access/proc_access_win_direct_syscall_ntopenprocess.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_access/proc_access_win_handlekatz_lsass_access.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_access/proc_access_win_in_memory_assembly_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_access/proc_access_win_invoke_phantom.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_access/proc_access_win_lazagne_cred_dump_lsass_access.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_access/proc_access_win_littlecorporal_generated_maldoc.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_access/proc_access_win_load_undocumented_autoelevated_com_interface.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_access/proc_access_win_lsass_dump_comsvcs_dll.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_access/proc_access_win_lsass_memdump.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_access/proc_access_win_lsass_memdump_evasion.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_access/proc_access_win_lsass_memdump_indicators.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_access/proc_access_win_lsass_werfault.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_access/proc_access_win_malware_verclsid_shellcode.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_access/proc_access_win_mimikatz_trough_winrm.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_access/proc_access_win_pypykatz_cred_dump_lsass_access.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_access/proc_access_win_rare_proc_access_lsass.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_access/proc_access_win_susp_proc_access_lsass.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_access/proc_access_win_susp_proc_access_lsass_susp_source.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_access/proc_access_win_svchost_cred_dump.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_access/proc_access_win_uac_bypass_wow64_logger.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_access/process_access_win_shellcode_inject_msf_empire.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_access/process_access_win_susp_seclogon.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_7zip_cve_2022_29072.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_abusing_debug_privilege.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_abusing_windows_telemetry_for_persistence.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_accesschk_usage_after_priv_escalation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_ad_find_discovery.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_advanced_ip_scanner.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_advanced_port_scanner.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_alternate_data_streams.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_always_install_elevated_msi_spawned_cmd_powershell.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_always_install_elevated_windows_installer.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_anydesk.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_anydesk_silent_install.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_anydesk_susp_folder.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_actinium_persistence.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_apt29_thinktanks.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_babyshark.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_bear_activity_gtr19.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_bluemashroom.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_chafer_mar18.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_cloudhopper.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_dragonfly.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_elise.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_emissarypanda_sep19.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_empiremonkey.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_equationgroup_dll_u_load.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_evilnum_jul20.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_gallium.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_gallium_sha1.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_gamaredon_ultravnc.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_greenbug_may20.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_hafnium.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_hurricane_panda.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_judgement_panda_gtr19.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_ke3chang_regadd.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_lazarus_activity_apr21.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_lazarus_activity_dec20.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_lazarus_loader.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_lazarus_session_highjack.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_muddywater_dnstunnel.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_mustangpanda.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_revil_kaseya.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_slingshot.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_sofacy.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_sourgrum.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_ta17_293a_ps.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_ta505_dropper.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_taidoor.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_tropictrooper.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_turla_commands_critical.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_turla_commands_medium.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_turla_comrat_may20.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_unc2452_cmds.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_unc2452_ps.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_unidentified_nov_18.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_winnti_mal_hk_jan20.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_winnti_pipemon.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_wocao.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_apt_zxshell.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_arbitrary_shell_execution_via_settingcontent.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_archiver_iso_phishing.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_asr_bypass_via_appvlp_re.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_atlassian_confluence_cve_2021_26084_exploit.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_attrib_hiding_files.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_attrib_system.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_attrib_system_susp_paths.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_automated_collection.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_bad_opsec_sacrificial_processes.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_base64_invoke_susp_cmdlets.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_base64_listing_shadowcopy.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_base64_reflective_assembly_load.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_bitsadmin_download.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_domain.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_ext.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_ip.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_targetfolder.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_bitsadmin_download_uncommon_targetfolder.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_bootconf_mod.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_bypass_squiblytwo.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_c3_load_by_rundll32.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_certoc_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_change_default_file_assoc_susp.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_change_default_file_association.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_chrome_load_extension.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_cleanwipe.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_clip.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_cmd_delete.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_cmd_dosfuscation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_cmd_redirect.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_cmdkey_recon.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_cmstp_com_object_access.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_cmstp_execution_by_creation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_cobaltstrike_bloopers_cmd.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_cobaltstrike_bloopers_modules.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_cobaltstrike_load_by_rundll32.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_cobaltstrike_process_patterns.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_commandline_path_traversal.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_commandline_path_traversal_evasion.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_conhost_path_traversal.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_conti_cmd_ransomware.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_conti_sqlcmd.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_control_panel_item.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_copying_sensitive_files_with_credential_data.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_crackmapexec_patterns.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_creation_mavinject_dll.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_creative_cloud_node_abuse.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_credential_access_via_password_filter.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_crime_fireball.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_crime_maze_ransomware.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_crime_snatch_ransomware.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_crypto_mining_monero.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_curl_download.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_cve_2021_26857_msexchange.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_data_compressed_with_rar.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_delete_systemstatebackup.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_detecting_fake_instances_of_hxtsr.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_dinjector.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_discover_private_keys.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_dns_exfiltration_tools_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_dns_serverlevelplugindll.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_dnscat2_powershell_implementation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_dotnet.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_dsacls_abuse_permissions.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_dsacls_password_spray.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_dsim_remove.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_dumpstack_log_evasion.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_embed_exe_lnk.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_encoded_frombase64string.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_encoded_iex.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_enumeration_for_credentials_cli.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_enumeration_for_credentials_in_registry.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_esentutl_webcache.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_etw_modification_cmdline.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_etw_trace_evasion.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_evil_winrm.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_exfiltration_and_tunneling_tools_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_expand_cabinet_files.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_exploit_cve_2015_1641.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_exploit_cve_2017_0261.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_exploit_cve_2017_11882.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_exploit_cve_2017_8759.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_exploit_cve_2019_1378.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_exploit_cve_2019_1388.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_exploit_cve_2020_10189.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_exploit_cve_2020_1048.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_exploit_cve_2020_1350.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_exploit_lpe_cve_2021_41379.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_exploit_systemnightmare.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_false_sysinternalsuite.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_file_permission_modifications.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_findstr_gpp_passwords.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_fsutil_drive_enumeration.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_fsutil_symlinkevaluation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_gotoopener.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_grabbing_sensitive_hives_via_reg.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_hack_adcspwn.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_hack_bloodhound.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_hack_cube0x0_tools.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_hack_dumpert.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_hack_hydra.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_hack_koadic.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_hack_krbrelay.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_hack_krbrelayup.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_hack_rubeus.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_hack_secutyxploded.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_hack_wce.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_hacktool_imphashes.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_hashcat.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_headless_browser_file_download.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_hh_chm.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_hiding_malware_in_fonts_folder.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_high_integrity_sdclt.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_hktl_createminidump.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_hktl_uacme_uac_bypass.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_html_help_spawn.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_hwp_exploits.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_iis_http_logging.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_impacket_compiled_tools.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_impacket_lateralization.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_indirect_cmd.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_infdefaultinstall.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_install_reg_debugger_backdoor.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_interactive_at.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_invoke_obfuscation_clip.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_invoke_obfuscation_obfuscated_iex_commandline.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_invoke_obfuscation_stdin.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_invoke_obfuscation_var.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_invoke_obfuscation_via_compress.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_invoke_obfuscation_via_rundll.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_invoke_obfuscation_via_stdin.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_invoke_obfuscation_via_use_clip.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_invoke_obfuscation_via_use_mhsta.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_invoke_obfuscation_via_use_rundll32.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_invoke_obfuscation_via_var.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_jlaive_batch_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lethalhta.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_local_system_owner_account_discovery.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_logmein.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_logon_scripts_userinitmprlogonscript_proc.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_adplus.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_aspnet_compiler.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_bash.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_certoc_download.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_cl_invocation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_cl_loadassembly.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_cl_mutexverifiers.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_class_exec_xwizard.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_cmdl32.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_configsecuritypolicy.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_cscript_gathernetworkinfo.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_data_exfiltration_by_using_datasvcutil.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_diantz_ads.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_diantz_remote_cab.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_dll_sideload_xwizard.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_dump64.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_execution_via_winget.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_extexport.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_extrac32.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_extrac32_ads.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_findstr.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_forfiles.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_fsharp_interpreters.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_gpscript.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_ie4uinit.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_ieexec_download.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_ilasm.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_jsc.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_mftrace.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_msdt_answer_file.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_offlinescannershell.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_openconsole.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_pcalua.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_pcwrun.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_pcwrun_follina.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_pktmon.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_presentationhost.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_printbrm.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_pubprn.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_rasautou_dll_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_remote.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_replace.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_rundll32_installscreensaver.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_scriptrunner.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_squirrel.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_susp_acccheckconsole.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_susp_atbroker.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_susp_certreq_download.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_susp_driver_installed_by_pnputil.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_susp_dxcap.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_susp_grpconv.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_susp_mpcmdrun_download.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_susp_sqldumper_activity.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_susp_wsl.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_syncappvpublishingserver_execute_psh.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_syncappvpublishingserver_vbs_execute_psh.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_ttdinject.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_tttracer_mod_load.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_utilityfunctions.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_visual_basic_compiler.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_visualuiaverifynative.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_vsiisexelauncher.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_wfc.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_winword.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbin_wlrmdr.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbins_by_office_applications.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lolbins_with_wmiprvse_parent_process.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_long_powershell_commandline.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_lsass_dump.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_mailboxexport_share.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_mal_adwind.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_mal_blue_mockingbird.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_mal_darkside_ransomware.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_mal_hermetic_wiper_activity.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_mal_lockergoga_ransomware.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_mal_ryuk.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_malware_conti.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_malware_conti_7zip.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_malware_conti_shadowcopy.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_malware_dridex.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_malware_dtrack.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_malware_emotet.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_malware_formbook.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_malware_notpetya.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_malware_qbot.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_malware_ryuk.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_malware_script_dropper.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_malware_trickbot_recon_activity.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_malware_trickbot_wermgr.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_malware_wannacry.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_manage_bde_lolbas.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_mavinject_proc_inj.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_meterpreter_or_cobaltstrike_getsystem_service_start.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_mimikatz_command_line.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_mmc20_lateral_movement.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_mmc_spawn_shell.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_modif_of_services_for_via_commandline.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_monitoring_for_persistence_via_bits.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_mouse_lock.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_msdeploy.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_msdt.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_msdt_diagcab.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_msdt_susp_cab_options.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_msdt_susp_parent.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_msedge_minimized_download.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_mshta_javascript.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_mshta_spawn_shell.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_msiexec_dll.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_msiexec_embedding.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_msiexec_execute_dll.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_msiexec_install_quiet.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_msra_process_injection.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_mstsc.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_multiple_susp_cli.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_net_enum.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_net_use_admin_share.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_net_user_add.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_netcat_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_netsh_allow_port_rdp.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_netsh_fw_add.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_netsh_fw_add_susp_image.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_netsh_fw_enable_group_rule.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_netsh_packet_capture.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_netsh_port_fwd.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_netsh_port_fwd_3389.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_netsh_wifi_credential_harvesting.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_network_scan_loop.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_network_sniffing.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_new_service_creation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_nltest_recon.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_non_interactive_powershell.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_non_priv_reg_or_ps.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_office_applications_spawning_wmi_commandline.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_office_dir_traversal_cli.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_office_from_proxy_executing_regsvr32_payload.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_office_from_proxy_executing_regsvr32_payload2.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_office_shell.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_office_spawn_exe_from_users_directory.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_office_spawning_wmi_commandline.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_outlook_shell.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_pingback_backdoor.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_plugx_susp_exe_locations.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_possible_applocker_bypass.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_possible_privilege_escalation_via_service_reg_perm.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_powershell_amsi_bypass.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_powershell_audio_capture.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_powershell_b64_shellcode.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_powershell_bitsjob.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_powershell_cmdline_reversed_strings.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_powershell_cmdline_special_characters.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_powershell_cmdline_specific_comb_methods.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_powershell_defender_base64.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_powershell_defender_disable_feature.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_powershell_defender_exclusion.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_powershell_disable_windef_av.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_powershell_dll_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_powershell_downgrade_attack.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_powershell_download.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_powershell_download_patterns.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_powershell_frombase64string.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_powershell_get_clipboard.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_powershell_public_folder.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_powershell_reverse_shell_connection.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_powershell_snapins_hafnium.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_powershell_susp_parameter_variation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_powershell_xor_commandline.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_powersploit_empire_schtasks.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_proc_dump_createdump.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_proc_dump_dumpminitool.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_proc_dump_rdrleakdiag.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_proc_dump_susp_dumpminitool.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_proc_wrong_parent.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_procdump.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_procdump_evasion.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_process_dump_rdrleakdiag.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_process_dump_rundll32_comsvcs.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_protocolhandler_susp_file.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_proxy_execution_wuauclt.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_psexesvc_start.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_public_folder_parent.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_purplesharp_indicators.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_pypykatz.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_python_pty_spawn.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_query_registry.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_ransom_blackbyte.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_rdp_hijack_shadowing.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_redirect_to_stream.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_redmimicry_winnti_proc.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_reg_add_run_key.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_reg_defender_exclusion.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_reg_defender_tampering.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_reg_dump_sam.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_reg_enable_rdp.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_reg_lsass_ppl.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_reg_service_imagepath_change.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_regedit_export_critical_keys.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_regedit_export_keys.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_regedit_import_keys.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_regedit_import_keys_ads.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_regini.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_regini_ads.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_remote_powershell_session_process.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_remote_time_discovery.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_remove_windows_defender_definition_files.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_renamed_binary.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_renamed_binary_highly_relevant.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_renamed_browsercore.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_renamed_jusched.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_renamed_megasync.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_renamed_msdt.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_renamed_paexec.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_renamed_plink.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_renamed_powershell.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_renamed_procdump.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_renamed_psexec.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_renamed_rundll32.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_renamed_whoami.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_root_certificate_installed.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_rpcss_anomalies.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_run_executable_invalid_extension.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_run_from_zip.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_run_powershell_script_from_ads.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_run_powershell_script_from_input_stream.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_run_virtualbox.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_rundll32_not_from_c_drive.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_rundll32_parent_explorer.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_rundll32_registered_com_objects.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_rundll32_without_parameters.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_schtasks_appdata_local_system.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_schtasks_powershell_windowsapps_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_schtasks_reg_loader.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_screenconnect.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_screenconnect_anomaly.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_script_event_consumer_spawn.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_sdbinst_shim_persistence.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_sdclt_child_process.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_sdelete.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_sdiagnhost_susp_child.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_service_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_service_stop.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_set_policies_to_unsecure_level.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_shadow_copies_access_symlink.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_shadow_copies_creation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_shadow_copies_deletion.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_shell_spawn_by_java.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_shell_spawn_susp_program.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_silenttrinity_stage_use.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_software_discovery.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_soundrec_audio_capture.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_spn_enum.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_sqlcmd_veeam_dump.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_sqlite_firefox_cookies.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_sticky_keys_unauthenticated_privileged_cmd_access.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_stickykey_like_backdoor.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_stordiag_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_sus_auditpol_usage.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_7z.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_ad_reco.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_add_user_remote_desktop.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_adfind.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_adfind_enumerate.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_adidnsdump.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_advancedrun.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_advancedrun_priv_user.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_athremotefxvgpudisablementcommand.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_base64_invoke.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_base64_load.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_bcdedit.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_bginfo.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_bitstransfer.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_calc.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_cdb.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_certutil_command.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_certutil_encode.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_char_in_cmd.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_child_process_as_system_.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_cipher.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_cli_escape.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_cmd_http_appdata.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_cmd_shadowcopy_access.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_codepage_lookup.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_codepage_switch.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_commandline_chars.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_commands_recon_activity.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_compression_params.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_comsvcs_procdump.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_conhost.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_conhost_option.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_control_cve_2021_40444.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_control_dll_load.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_copy_lateral_movement.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_copy_system32.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_covenant.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_crackmapexec_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_crackmapexec_flags.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_crackmapexec_powershell_obfuscation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_csc.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_csc_folder.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_cscript_vbs.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_csi.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_curl_download.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_curl_fileupload.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_curl_start_combo.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_curl_useragent.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_dctask64_proc_inject.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_del.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_desktopimgdownldr.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_devinit_lolbin.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_devtoolslauncher.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_dir.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_direct_asep_reg_keys_modification.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_disable_eventlog.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_disable_ie_features.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_disable_raccine.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_diskshadow.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_ditsnap.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_dllhost_no_cli.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_dnx.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_double_extension.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_download_office_domain.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_dtrace_kernel_dump.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_emotet_rundll32_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_esentutl_params.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_eventlog_clear.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_execution_path.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_execution_path_webserver.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_explorer.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_explorer_break_proctree.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_explorer_nouaccheck.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_file_characteristics.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_file_download_via_gfxdownloadwrapper.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_findstr_385201.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_findstr_lnk.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_finger_usage.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_firewall_disable.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_format.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_fsutil_usage.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_ftp.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_gpresult.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_gup.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_gup_download.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_gup_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_hostname.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_image_missing.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_instalutil.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_iss_module_install.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_lsass_clone.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_machineguid.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_mounted_share_deletion.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_mpiexec_lolbin.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_mshta_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_mshta_pattern.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_msiexec_cwd.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_msiexec_web_install.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_msoffice.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_net_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_net_use_password_plaintext.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_netsh_command.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_netsh_dll_persistence.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_network_command.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_network_listing_connections.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_ngrok_pua.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_nmap.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_non_exe_image.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_nt_resource_kit_auditpol_usage.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_ntdll_type_redirect.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_ntds.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_ntdsutil.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_ntlmrelay.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_odbcconf.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_openwith.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_outlook.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_outlook_temp.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_parents.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_pcwutl.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_pester.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_ping_hex_ip.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_plink_remote_forward.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_powershell_cmd_patterns.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_powershell_download_cradles.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_powershell_download_iex.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_powershell_empire_launch.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_powershell_empire_uac_bypass.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_powershell_enc_cmd.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_powershell_encode.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_powershell_encoded_param.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_powershell_getprocess_lsass.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_powershell_hidden_b64_cmd.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_powershell_iex_patterns.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_powershell_parent_combo.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_powershell_parent_process.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_powershell_sam_access.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_powershell_sub_processes.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_powershell_webclient_casing.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_pressynkey_lolbin.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_print.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_procdump.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_procdump_lsass.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_progname.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_ps_appdata.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_ps_downloadfile.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_psexec_eula.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_psexex_paexec_escalate_system.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_psexex_paexec_flags.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_psloglist.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_psr_capture_screenshots.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_radmin.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_rar_flags.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_rasdial_activity.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_razorinstaller_explorer.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_rclone_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_recon.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_recon_activity.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_recon_net_activity.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_redir_local_admin_share.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_reg_bitlocker.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_reg_disable_sec_services.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_reg_open_command.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_regedit_trustedinstaller.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_register_cimprovider.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_registration_via_cscript.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_regsvr32_anomalies.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_regsvr32_explorer.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_regsvr32_flags_anomaly.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_regsvr32_http_pattern.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_regsvr32_image.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_regsvr32_no_dll.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_renamed_dctask64.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_renamed_debugview.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_renamed_paexec.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_rpcping.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_run_folder.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_run_locations.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_rundll32_activity.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_rundll32_by_ordinal.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_rundll32_inline_vbs.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_rundll32_js_runhtmlapplication.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_rundll32_keymgr.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_rundll32_no_params.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_rundll32_script_run.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_rundll32_setupapi_installhinfsection.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_rundll32_spawn_explorer.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_rundll32_sys.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_rundll32_user32_dll.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_runonce_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_runscripthelper.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_sc_query.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_schtask_creation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_schtask_creation_temp_folder.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_schtasks_disable.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_schtasks_env_folder.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_schtasks_folder_combos.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_schtasks_parent.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_schtasks_pattern.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_schtasks_user_temp.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_screenconnect_access.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_screensaver_reg.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_script_exec_from_env_folder.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_script_exec_from_temp.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_script_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_service_dacl_modification.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_service_dir.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_service_modification.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_service_path_modification.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_servu_exploitation_cve_2021_35211.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_servu_process_pattern.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_sharpview.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_shell_spawn_by_java.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_shell_spawn_by_java_keytool.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_shell_spawn_from_mssql.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_shell_spawn_from_winrm.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_shimcache_flush.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_shutdown.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_splwow64.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_spoolsv_child_processes.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_squirrel_lolbin.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_svchost.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_svchost_no_cli.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_sysprep_appdata.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_system_user_anomaly.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_systeminfo.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_sysvol_access.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_takeown.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_target_location_shell32.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_taskkill.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_tasklist_command.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_taskmgr_localsystem.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_taskmgr_parent.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_tracker_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_trolleyexpress_procdump.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_tscon_localsystem.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_tscon_rdp_redirect.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_uac_bypass_trustedpath.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_use_of_csharp_console.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_use_of_sqlps_bin.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_use_of_sqltoolsps_bin.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_use_of_te_bin.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_use_of_vsjitdebugger_bin.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_userinit_child.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_vaultcmd.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_vboxdrvinst.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_vbscript_unc2452.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_volsnap_disable.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_web_request_cmd.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_webdav_client_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_where_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_whoami.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_whoami_anomaly.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_whoami_as_param.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_winrar_dmp.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_winrar_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_winrm_awl_bypass.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_winrm_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_winzip.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_wmi_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_wmic_eventconsumer_create.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_wmic_proc_create_rundll32.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_wmic_security_product_uninstall.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_workfolders.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_wuauclt.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_wuauclt_cmdline.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_zip_compress.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_susp_zipexec.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_sysinternals_eula_accepted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_sysinternals_psservice.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_sysmon_driver_unload.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_sysmon_uac_bypass_eventvwr.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_system_exe_anomaly.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_tap_installer_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_task_folder_evasion.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_termserv_proc_spawn.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_tool_nircmd.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_tool_nircmd_as_system.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_tool_nsudo_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_tool_psexec.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_tool_runx_as_system.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_tools_relay_attacks.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_tor_browser.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_trust_discovery.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_uac_bypass_changepk_slui.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_uac_bypass_cleanmgr.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_uac_bypass_cmstp.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_uac_bypass_computerdefaults.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_uac_bypass_consent_comctl32.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_uac_bypass_dismhost.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_uac_bypass_fodhelper.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_uac_bypass_idiagnostic_profile.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_uac_bypass_ieinstal.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_uac_bypass_msconfig_gui.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_uac_bypass_ntfs_reparse_point.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_uac_bypass_pkgmgr_dism.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_uac_bypass_winsat.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_uac_bypass_wmp.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_uac_bypass_wsreset.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_uac_bypass_wsreset_integrity_level.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_uninstall_crowdstrike_falcon.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_uninstall_sysmon.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_using_sc_to_change_sevice_image_path_by_non_admin.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_using_sc_to_hide_sevices.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_using_settingsynchost_as_lolbin.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_verclsid_runs_com.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_vmtoolsd_susp_child_process.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_vul_java_remote_debugging.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_webshell_detection.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_webshell_hacking.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_webshell_recon_detection.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_webshell_spawn.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_whoami_as_priv_user.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_whoami_as_system.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_whoami_priv.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_win10_sched_task_0day.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_win_exchange_transportagent.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_winword_dll_load.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_wmi_backdoor_exchange_transport_agent.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_wmi_persistence_script_event_consumer.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_wmi_spwns_powershell.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_wmic_hotfix_enum.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_wmic_reconnaissance.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_wmic_remote_command.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_wmic_remote_service.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_wmic_remove_application.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_wmic_service.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_wmic_unquoted_service_search.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_wmiprvse_spawning_process.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_workflow_compiler.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_write_protect_for_storage_disabled.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_wsreset_uac_bypass.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_xordump.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/process_creation/proc_creation_win_xsl_script_processing.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/raw_access_thread/sysmon_raw_disk_access_using_illegitimate_tools.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_add/registry_add_logon_scripts_userinitmprlogonscript_reg.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_add/registry_add_mal_netwire.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_add/registry_add_mal_ursnif.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_add/registry_add_persistence_key_linking.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_add/registry_add_sysinternals_eula_accepted.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_add/registry_add_sysinternals_sdelete_registry_keys.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_delete/registry_delete_mstsc_history_cleared.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_delete/registry_delete_removal_amsi_registry_key.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_delete/registry_delete_removal_com_hijacking_registry_key.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_delete/registry_delete_removal_sd_value_scheduled_task_hide.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_add_local_hidden_user.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_apt_chafer_mar18.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_apt_leviathan.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_apt_oceanlotus_registry.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_apt_pandemic.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_bypass_via_wsreset.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_cmstp_execution_by_registry.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_crashdump_disabled.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_cve_2021_31979_cve_2021_33771_exploits.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_disable_security_events_logging_adding_reg_key_minint.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_disable_wdigest_credential_guard.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_dns_serverlevelplugindll.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_esentutl_volume_shadow_copy_service_keys.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_hack_wce_reg.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_hybridconnectionmgr_svc_installation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_mal_azorult.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_mal_flowcloud.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_mimikatz_printernightmare.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_modify_screensaver_binary_path.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_narrator_feedback_persistance.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_net_ntlm_downgrade.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_new_dll_added_to_appcertdlls_registry_key.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_new_dll_added_to_appinit_dlls_registry_key.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_office_test_regadd.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_persistence_recycle_bin.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_portproxy_registry_key.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_redmimicry_winnti_reg.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_runkey_winekey.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_runonce_persistence.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_shell_open_keys_manipulation.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_silentprocessexit_lsass.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_ssp_added_lsa_config.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_stickykey_like_backdoor.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_susp_atbroker_change.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_susp_download_run_key.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_susp_lsass_dll_load.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_susp_mic_cam_access.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_event/registry_event_trust_record_modification.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_abusing_windows_telemetry_for_persistence.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_add_load_service_in_safe_mode.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_add_port_monitor.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_classes.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_common.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_currentcontrolset.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_currentversion.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_currentversion_nt.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_internet_explorer.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_office.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_session_manager.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_system_scripts.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_winsock2.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_wow6432node.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_wow6432node_classes.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_wow6432node_currentversion.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_blackbyte_ransomware.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_bypass_uac_using_delegateexecute.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_bypass_uac_using_eventviewer.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_bypass_uac_using_silentcleanup_task.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_change_rdp_port.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_change_security_zones.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_chrome_extension.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_cobaltstrike_service_installs.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_comhijack_sdclt.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_creation_service_susp_folder.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_creation_service_temp_folder.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_creation_service_uncommon_folder.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_custom_file_open_handler_powershell_execution.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_cve_2020_1048_new_printer_port.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_cve_2022_30190_msdt_follina.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_defender_disabled.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_defender_exclusions.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_defender_realtime_protection_disabled.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_dhcp_calloutdll.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_disable_administrative_share.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_disable_defender_firewall.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_disable_fonction_user.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_disable_microsoft_office_security_features.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_disable_system_restore.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_disable_uac_registry.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_disable_winevt_logging.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_disabled_exploit_guard_net_protection_on_ms_defender.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_disabled_microsoft_defender_eventlog.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_disabled_pua_protection_on_microsoft_defender.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_disabled_tamper_protection_on_microsoft_defender.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_dns_over_https_enabled.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_enabling_cor_profiler_env_variables.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_enabling_turnoffcheck.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_etw_disabled.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_file_association_exefile.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_globalflags_persistence.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_hidden_extention.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_hide_file.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_hide_fonction_user.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_ie_persistence.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_install_root_or_ca_certificat.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_lolbin_onedrivestandaloneupdater.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_mal_adwind.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_mal_blue_mockingbird.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_new_application_appcompat.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_office_enable_dde.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_office_security.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_office_vsto_persistence.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_outlook_c2_registry_key.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_outlook_registry_todaypage.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_outlook_registry_webview.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_outlook_security.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_persistence_search_order.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_powershell_as_service.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_powershell_in_run_keys.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_powershell_logging_disabled.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_rdp_registry_modification.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_rdp_settings_hijack.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_scr_file_executed_by_rundll32.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_set_nopolicies_user.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_set_servicedll.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_shim_databases_persistence.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_silentprocessexit.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_susp_printer_driver.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_susp_reg_persist_explorer_run.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_susp_run_key_img_folder.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_susp_service_installed.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_taskcache_entry.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_telemetry_persistence.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_timeproviders_dllname.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_uac_bypass_eventvwr.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_uac_bypass_sdclt.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_uac_bypass_winsat.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_uac_bypass_wmp.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_vbs_payload_stored.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_wab_dllpath_reg_change.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_wdigest_enable_uselogoncredential.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/registry/registry_set/registry_set_winlogon_notify_key.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/sysmon/sysmon_accessing_winapi_in_powershell_credentials_dumping.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/sysmon/sysmon_config_modification.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/sysmon/sysmon_config_modification_error.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/sysmon/sysmon_config_modification_status.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/sysmon/sysmon_dcom_iertutil_dll_hijack.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/wmi_event/sysmon_wmi_event_subscription.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/wmi_event/sysmon_wmi_susp_encoded_scripts.yml


type: file
name:
  /etc/wazuh-indexer/opensearch-security-analytics/rules/windows/wmi_event/sysmon_wmi_susp_scripting.yml


type: file
name:
  /var/ossec/framework/python/lib/python3.10/site-packages/botocore/data/rbin/2021-06-15/endpoint-rule-set-1.json.gz


type: file
name:
  /var/ossec/framework/python/lib/python3.10/site-packages/botocore/data/rbin/2021-06-15/examples-1.json


type: file
name:
  /var/ossec/framework/python/lib/python3.10/site-packages/botocore/data/rbin/2021-06-15/paginators-1.json


type: file
name:
  /var/ossec/framework/python/lib/python3.10/site-packages/botocore/data/rbin/2021-06-15/service-2.json.gz


