From 88e3a0b0cfd04d52e6e8646cce169bbbdfe8e0b6 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Sat, 24 Jul 2021 08:22:20 +0200
Subject: [PATCH 001/149] squashed pull requests from original repo

This was necessary to allow us to 1. merge all open pull request of the original repo AND 2. allow our new repository to receive new pull requests
---
 README.md               |  58 ++++++++--------
 sysmonconfig-export.xml | 150 ++++++++++++++++++++++++++++++----------
 2 files changed, 141 insertions(+), 67 deletions(-)

diff --git a/README.md b/README.md
index 6e4ec413..26525c7a 100644
--- a/README.md
+++ b/README.md
@@ -1,49 +1,45 @@
-# sysmon-config | A Sysmon configuration file for everybody to fork #
+# sysmon-config | A Sysmon configuration file
 
-This is a Microsoft Sysinternals Sysmon configuration file template with default high-quality event tracing.
+This is a forked and modified version of @SwiftOnSecurity's [sysmon config](https://github.com/SwiftOnSecurity/sysmon-config).
 
-The file should function as a great starting point for system change monitoring in a self-contained and accessible package. This configuration and results should give you a good idea of what's possible for Sysmon. Note that this does not track things like authentication and other Windows events that are also vital for incident investigation.
+Currently it is simply a copy with most of the 30+ open pull requests of the original repository merged. Thus we have fixed many of the issues that are still present in the original version and extended the coverage by important new extensions that have been provided over the last year.
 
-&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;**[sysmonconfig-export.xml](https://github.com/SwiftOnSecurity/sysmon-config/blob/master/sysmonconfig-export.xml)**
+## Testing
 
-Because virtually every line is commented and sections are marked with explanations, it should also function as a tutorial for Sysmon and a guide to critical monitoring areas in Windows systems.
+This configuration is focused on detection coverage. We have only one rather small testing environment to avoid problematic expressions that trigger too often. It is recommended to test the downloaded configuration on a small set of systems in your environment in any case. 
 
-- For a far more exhaustive and detailed approach to Sysmon configuration from a different approach, see also **[sysmon-modular](https://github.com/olafhartong/sysmon-modular)** by [@olafhartong](https://twitter.com/olafhartong), which can act as a superset of sysmon-config.
+## Feedback
 
-- Sysmon is a compliment to native Windows logging abilities, not a replacement for it. For valuable advice on these configurations, see **[MalwareArchaeology Logging Cheat Sheets](https://www.malwarearchaeology.com/cheat-sheets)** by [@HackerHurricane](https://twitter.com/hackerhurricane).
+Since we don't have more than one environment to test the config ourselves, we rely on feedback from the community.
 
-Note: Exact syntax and filtering choices in the configuration are highly deliberate in what they target, and to have as little performance impact as possible. Sysmon's filtering abilities are different than the built-in Windows auditing features, so often a different approach is taken than the normal static listing of paths. 
+Please report:
 
-&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;**[See other forks of this configuration](https://github.com/SwiftOnSecurity/sysmon-config/network)**
+1. Expressions that cause a high volume of events
+2. Broken configuration elements (typos, wrong conditions)
+3. Missing coverage (preferrably as a pull request)
+
+## Usage
+
+### Install
 
-## Use ##
-### Install ###
 Run with administrator rights
-~~~~
+
+```batch
 sysmon.exe -accepteula -i sysmonconfig-export.xml
-~~~~
+```
 
-### Update existing configuration ###
-Run with administrator rights
-~~~~
-sysmon.exe -c sysmonconfig-export.xml
-~~~~
+### Update existing configuration
 
-### Uninstall ###
 Run with administrator rights
-~~~~
-sysmon.exe -u
-~~~~
-
-## Required actions ##
 
-### Prerequisites ###
-Highly recommend using [Notepad++](https://notepad-plus-plus.org/) to edit this configuration. It understands UNIX newline format and does XML syntax highlighting, which makes this very understandable. I do not recommend using the built-in Notepad.exe.
+```batch
+sysmon.exe -c sysmonconfig-export.xml
+```
 
-### Customization ###
-You will need to install and observe the results of the configuration in your own environment before deploying it widely. For example, you will need to exclude actions of your antivirus, which will otherwise likely fill up your logs with useless information.
+### Uninstall
 
-The configuration is highly commented and designed to be self-explanatory to assist you in this customization to your environment.
+Run with administrator rights
 
-### Design notes ###
-This configuration expects software to be installed system-wide and NOT in the C:\Users folder. Various pieces of software install themselves in User directories, which are subject to extra monitoring. Where possible, you should install the system-wide version of these pieces of software, like Chrome. See the configuration file for more instructions.
+```batch
+sysmon.exe -u
+```
diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index f4acf26c..9b2c0e77 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -1,14 +1,9 @@
-<!--
+<!--
   sysmon-config | A Sysmon configuration focused on default high-quality event tracing and easy customization by the community
   Source version:	73 | Date: 2021-02-16
   Source project:	https://github.com/SwiftOnSecurity/sysmon-config
   Source license:	Creative Commons Attribution 4.0 | You may privatize, fork, edit, teach, publish, or deploy for commercial use - with attribution in the text.
 
-  Fork version:	<N/A>
-  Fork author:	<N/A>
-  Fork project:	<N/A>
-  Fork license:	<N/A>
-
   REQUIRED: Sysmon version 13 or higher (due to changes in syntax and bug-fixes)
 	https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
 
@@ -60,7 +55,7 @@
 
 -->
 
-<Sysmon schemaversion="4.50">
+<Sysmon schemaversion="4.70">
 	<!--SYSMON META CONFIG-->
 	<HashAlgorithms>md5,sha256,IMPHASH</HashAlgorithms> <!-- Both MD5 and SHA256 are the industry-standard algorithms. Remove IMPHASH if you do not use DLL import fingerprinting. -->
 	<CheckRevocation/> <!-- Check loaded drivers, log if their code-signing certificate has been revoked, in case malware stole one to sign a kernel driver -->
@@ -82,7 +77,10 @@
 		<!--DATA: UtcTime, ProcessGuid, ProcessID, Image, FileVersion, Description, Product, Company, CommandLine, CurrentDirectory, User, LogonGuid, LogonId, TerminalSessionId, IntegrityLevel, Hashes, ParentProcessGuid, ParentProcessId, ParentImage, ParentCommandLine, RuleName-->
 	<RuleGroup name="" groupRelation="or">
 		<ProcessCreate onmatch="exclude">
+			<ParentCommandLine condition="is">"C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe" -Embedding</ParentCommandLine> <!-- SECTION: Azure OMS/MMA Agent -->
+			<CommandLine condition="contains">\Machine\Scripts\Startup\ipamprovisioning.ps1</CommandLine> <!-- Windows IP Address Management (IPAM) -->
 			<!--SECTION: Microsoft Windows-->
+			<CommandLine condition="is">C:\Windows\system32\cscript.exe" /nologo "MonitorKnowledgeDiscovery.vbs</CommandLine>
 			<CommandLine condition="begin with"> "C:\Windows\system32\wermgr.exe" "-queuereporting_svc" </CommandLine> <!--Windows:Windows error reporting/telemetry-->
 			<CommandLine condition="begin with">C:\Windows\system32\DllHost.exe /Processid</CommandLine> <!--Windows-->
 			<CommandLine condition="begin with">C:\Windows\system32\wbem\wmiprvse.exe -Embedding</CommandLine> <!--Windows: WMI provider host-->
@@ -131,7 +129,8 @@
 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k LocalService -p -s BthAvctpSvc</CommandLine>
 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localService -s nsi</CommandLine>
 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localService -s w32Time</CommandLine>
-			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation</CommandLine> <!--Windows: Network services-->
+      <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation</CommandLine> <!--Windows: Network services-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation -p</CommandLine> <!--Windows: Network services-->
 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s Dhcp</CommandLine> <!--Windows: Network services-->
 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s EventLog</CommandLine>
 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s TimeBrokerSvc</CommandLine>
@@ -150,8 +149,8 @@
 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s TabletInputService</CommandLine>
 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s UmRdpService</CommandLine>
 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s WPDBusEnum</CommandLine>
-			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s NgcSvc</CommandLine> <!--Microsoft:Passport--> 
-			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -p -s NgcCtnrSvc</CommandLine> <!--Microsoft:Passport Container--> 
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s NgcSvc</CommandLine> <!--Microsoft:Passport-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -p -s NgcCtnrSvc</CommandLine> <!--Microsoft:Passport Container-->
 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation -s SCardSvr</CommandLine>
 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv</CommandLine>
 			<CommandLine condition="is">C:\Windows\System32\svchost.exe -k netsvcs -p -s SessionEnv</CommandLine> <!--Windows:Remote desktop configuration-->
@@ -180,6 +179,7 @@
 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkService -s NlaSvc</CommandLine> <!--Windows:Network: Network Location Awareness-->
 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkService -s TermService</CommandLine> <!--Windows:Network: Terminal Services (RDP)-->
 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkService</CommandLine> <!--Windows: Network services-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkService -p</CommandLine> <!--Windows: Network services-->
 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkServiceNetworkRestricted</CommandLine> <!--Windows: Network services-->
 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k rPCSS</CommandLine> <!--Windows Services-->
 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k secsvcs</CommandLine>
@@ -201,10 +201,12 @@
 			<!--SECTION: Microsoft:dotNet-->
 			<CommandLine condition="begin with">C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe</CommandLine> <!--Microsoft:DotNet-->
 			<CommandLine condition="begin with">C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\Ngen.exe</CommandLine> <!--Microsoft:DotNet-->
+			<CommandLine condition="begin with">C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe</CommandLine> <!--Microsoft:DotNet-->
+			<CommandLine condition="begin with">C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe</CommandLine> <!--Microsoft:DotNet-->
 			<Image condition="is">C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe</Image> <!--Microsoft:DotNet-->
 			<Image condition="is">C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe</Image> <!--Microsoft:DotNet-->
 			<Image condition="is">C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe</Image> <!--Windows: Font cache service-->
-			<ParentCommandLine condition="contains">C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe</ParentCommandLine>
+			<ParentCommandLine condition="begin with">C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe</ParentCommandLine>
 			<ParentImage condition="is">C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe</ParentImage> <!--Microsoft:DotNet-->
 			<ParentImage condition="is">C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe</ParentImage> <!--Microsoft:DotNet-->
 			<ParentImage condition="is">C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe</ParentImage> <!--Microsoft:DotNet-->
@@ -226,7 +228,7 @@
 			<CommandLine condition="begin with">"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=</CommandLine> <!--Google:Chrome: massive command-line arguments-->
 		</ProcessCreate>
 	</RuleGroup>
-	
+
 	<!--SYSMON EVENT ID 2 : FILE CREATION TIME RETROACTIVELY CHANGED IN THE FILESYSTEM [FileCreateTime]-->
 		<!--COMMENT:	[ https://attack.mitre.org/wiki/Technique/T1099 ] -->
 
@@ -259,7 +261,7 @@
 		<!--TECHNICAL:	For the DestinationHostname, Sysmon uses the GetNameInfo API, which will often not have any information, and may just be a CDN. This is NOT reliable for filtering.-->
 		<!--TECHNICAL:	For the DestinationPortName, Sysmon uses the GetNameInfo API for the friendly name of ports you see in logs.-->
 		<!--TECHNICAL:	These exe do not initiate their connections, and thus includes do not work in this section: BITSADMIN NLTEST-->
-		
+
 		<!-- https://www.first.org/resources/papers/conf2017/APT-Log-Analysis-Tracking-Attack-Tools-by-Audit-Policy-and-Sysmon.pdf -->
 
 		<!--DATA: UtcTime, ProcessGuid, ProcessId, Image, User, Protocol, Initiated, SourceIsIpv6, SourceIp, SourceHostname, SourcePort, SourcePortName, DestinationIsIpV6, DestinationIp, DestinationHostname, DestinationPort, DestinationPortName-->
@@ -298,6 +300,7 @@
 			<Image condition="image">notepad.exe</Image> <!--Windows: [ https://secrary.com/ReversingMalware/CoinMiner/ ] [ https://blog.cobaltstrike.com/2013/08/08/why-is-notepad-exe-connecting-to-the-internet/ ] -->
 			<Image condition="image">nslookup.exe</Image> <!--Windows: Retrieve data over DNS -->
 			<Image condition="image">powershell.exe</Image> <!--Windows: PowerShell interface-->
+			<Image condition="image">powershell_ise.exe</Image> <!--Windows: PowerShell interface-->
 			<Image condition="image">qprocess.exe</Image> <!--Windows: [ https://www.first.org/resources/papers/conf2017/APT-Log-Analysis-Tracking-Attack-Tools-by-Audit-Policy-and-Sysmon.pdf ] -->
 			<Image condition="image">qwinsta.exe</Image> <!--Windows: Query remote sessions | Credit @ion-storm -->
 			<Image condition="image">qwinsta.exe</Image> <!--Windows: Remotely query login sessions on a server or workstation | Credit @ion-storm -->
@@ -312,10 +315,29 @@
 			<Image condition="image">tasklist.exe</Image> <!--Windows: List processes, has remote ability -->
 			<Image condition="image">wmic.exe</Image> <!--WindowsManagementInstrumentation: Credit @Cyb3rOps [ https://gist.github.com/Neo23x0/a4b4af9481e01e749409 ] -->
 			<Image condition="image">wscript.exe</Image> <!--WindowsScriptingHost: | Credit @arekfurt -->
+			<!--Live of the Land Binaries and scripts (LOLBAS) -->
+			<Image condition="image">bitsadmin.exe</Image> <!-- Windows: Background Intelligent Transfer Service - Can download from URLs -->
+			<Image condition="image">esentutl.exe</Image> <!-- Windows: Database utilities for the ESE - Can fetch from UNC paths -->
+			<Image condition="image">expand.exe</Image> <!-- Windows: Expands one or more compressed files - Can fetch from UNC paths -->
+			<Image condition="image">extrac32.exe</Image> <!--Windows: Uncompress .cab files - Can fetch from UNC paths -->
+			<Image condition="image">findstr.exe</Image> <!-- Windows: Search for strings - Can fetch from UNC paths -->
+			<Image condition="image">GfxDownloadWrapper.exe</Image> <!-- Intel Graphics Control Panel: Remote file download -->
+			<Image condition="image">ieexec.exe</Image> <!-- Windows: Microsoft .NET Framework application - Download and execute from URLs -->
+			<Image condition="image">makecab.exe</Image> <!-- Windows: Packages existing files into a .cab - Can fetch from UNC paths -->
+			<Image condition="image">replace.exe</Image> <!-- Windows: Used to replace file with another file - Can fetch from UNC paths -->
+			<Image condition="image">Excel.exe</Image> <!-- Windows Office: Excel - Can download from URLs -->
+			<Image condition="image">Powerpnt.exe</Image> <!-- Windows Office: PowerPoint - Can download from URLs -->
+			<Image condition="image">Winword.exe</Image> <!-- Windows Office: Word - Can download from URLs -->
+			<Image condition="image">squirrel.exe</Image> <!-- Windows: Update the Nuget/Squirrel packages. Part of Teams. - Can download from URLs -->
 			<!--Relevant 3rd Party Tools-->
+			<Image condition="image">netcat.exe</Image> <!-- Compiled netcat.c file if naming convention is kept https://github.com/DarrenRainey/netcat -->
 			<Image condition="image">nc.exe</Image> <!-- Nmap's modern version of netcat [ https://nmap.org/ncat/guide/index.html#ncat-overview ] [ https://securityblog.gr/1517/create-backdoor-in-windows-with-ncat/ ] -->
+			<Image condition="image">nc64.exe</Image> <!-- 64-bit version of nc that can be used on 64-bit Windows Architectures https://github.com/DarrenRainey/netcat-->
 			<Image condition="image">ncat.exe</Image> <!-- Nmap's modern version of netcat [ https://nmap.org/ncat/guide/index.html#ncat-overview ] [ https://securityblog.gr/1517/create-backdoor-in-windows-with-ncat/ ] -->
+			<Image condition="image">procdump.exe</Image> <!-- Sysinternals Suite client side that can be used to dump clear text passwords from memory -->
+   			<Image condition="image">procdump64.exe</Image> <!-- Sysinternals Suite client side 64-bit version that can be used to dump clear text passwords from memory -->
 			<Image condition="image">psexec.exe</Image> <!--Sysinternals:PsExec client side | Credit @Cyb3rOps -->
+			<Image condition="image">psexec64.exe</Image> <!-- Sysinernals:PsExec64 client side | 64-bit version of psexec.exe -->
 			<Image condition="image">psexesvc.exe</Image> <!--Sysinternals:PsExec server side | Credit @Cyb3rOps -->
 			<Image condition="image">tor.exe</Image> <!--Tor [ https://www.hybrid-analysis.com/sample/800bf028a23440134fc834efc5c1e02cc70f05b2e800bbc285d7c92a4b126b1c?environmentId=100 ] -->
 			<Image condition="image">vnc.exe</Image> <!-- VNC client | Credit @Cyb3rOps -->
@@ -332,7 +354,9 @@
 			<DestinationPort name="RDP" condition="is">3389</DestinationPort> <!--Windows:RDP: Monitor admin connections-->
 			<DestinationPort name="VNC" condition="is">5800</DestinationPort> <!--VNC protocol: Monitor admin connections, often insecure, using hard-coded admin password-->
 			<DestinationPort name="VNC" condition="is">5900</DestinationPort> <!--VNC protocol Monitor admin connections, often insecure, using hard-coded admin password-->
-			<DestinationPort name="Alert,Metasploit" condition="is">444</DestinationPort>
+			<DestinationPort name="WinRM" condition="is">5985</DestinationPort> <!-- WinRM protocol used for remote connections to execute commands -->
+			<DestinationPort name="WinRM over HTTPS" condition="is">5986</DestinationPort> <!-- WinRM over HTTPS when set up in an environment can be used for remote connections to execute commands -->
+			<DestinationPort name="Alert,Metasploit" condition="is">4444</DestinationPort> <!-- Default Metasploit port -->
 			<!--Ports: Proxy-->
 			<DestinationPort name="Proxy" condition="is">1080</DestinationPort> <!--Socks proxy port | Credit @ion-storm-->
 			<DestinationPort name="Proxy" condition="is">3128</DestinationPort> <!--Socks proxy port | Credit @ion-storm-->
@@ -349,12 +373,13 @@
 			<!--SECTION: Microsoft-->
 			<Image condition="begin with">C:\ProgramData\Microsoft\Windows Defender\Platform\</Image>
 			<Image condition="end with">AppData\Local\Microsoft\Teams\current\Teams.exe</Image> <!--Microsoft: Teams-->
+			<DestinationHostname condition="is">microsoft.com</DestinationHostname> <!--Microsoft:Update delivery-->
 			<DestinationHostname condition="end with">.microsoft.com</DestinationHostname> <!--Microsoft:Update delivery-->
-			<DestinationHostname condition="end with">microsoft.com.akadns.net</DestinationHostname> <!--Microsoft:Update delivery-->
-			<DestinationHostname condition="end with">microsoft.com.nsatc.net</DestinationHostname> <!--Microsoft:Update delivery-->
 			<!--OCSP known addresses-->
 			<DestinationIp condition="is">23.4.43.27</DestinationIp> <!--Digicert [ https://otx.alienvault.com/indicator/ip/23.4.43.27 ] -->
 			<DestinationIp condition="is">72.21.91.29</DestinationIp> <!--Digicert [ https://otx.alienvault.com/indicator/ip/72.21.91.29 ] -->
+			<DestinationHostname condition="is">microsoft.com.akadns.net</DestinationHostname> <!--Microsoft:Update delivery-->
+			<DestinationHostname condition="end with">.microsoft.com.nsatc.net</DestinationHostname> <!--Microsoft:Update delivery-->
 			<!--Section: Loopback Addresses-->
 			<DestinationIp condition="is">127.0.0.1</DestinationIp> <!--Credit @ITProPaul-->
 			<DestinationIp condition="begin with">fe80:0:0:0</DestinationIp> <!--Credit @ITProPaul-->
@@ -483,6 +508,8 @@
 			<TargetFilename condition="end with">.jnlp</TargetFilename> <!--Java applets-->
 			<TargetFilename condition="end with">.jse</TargetFilename> <!--Scripting [ Example: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Mal~Phires-C/detailed-analysis.aspx ] -->
 			<TargetFilename condition="end with">.hta</TargetFilename> <!--Scripting-->
+			<TargetFilename condition="end with">.aspx</TargetFilename> <!--Scripting-->
+			<TargetFilename condition="end with">.asp</TargetFilename> <!--Scripting-->
 			<TargetFilename condition="end with">.job</TargetFilename> <!--Scheduled task-->
 			<TargetFilename condition="end with">.pptm</TargetFilename> <!--Microsoft:Office:Word: Macro-->
 			<TargetFilename condition="end with">.ps1</TargetFilename> <!--PowerShell [ More information: http://www.hexacorn.com/blog/2014/08/27/beyond-good-ol-run-key-part-16/ ] -->
@@ -515,6 +542,13 @@
 			<TargetFilename condition="end with">.xls</TargetFilename> <!--Legacy Office files are often used for attacks-->
 			<TargetFilename condition="end with">.ppt</TargetFilename> <!--Legacy Office files are often used for attacks-->
 			<TargetFilename condition="end with">.rtf</TargetFilename> <!--RTF files often 0day malware vectors when opened by Office-->
+			<!-- Possible dropped webshells -->
+			<TargetFilename condition="end with">.php</TargetFilename> <!-- possible dropped webshell -->
+			<TargetFilename condition="end with">.asp</TargetFilename> <!-- possible dropped webshell -->
+			<TargetFilename condition="end with">.aspx</TargetFilename> <!-- possible dropped webshell -->
+			<TargetFilename condition="end with">.ashx</TargetFilename> <!-- possible dropped webshell -->
+			<TargetFilename condition="end with">.jsp</TargetFilename> <!-- possible dropped webshell -->
+			<TargetFilename condition="end with">.pl</TargetFilename> <!-- possible dropped webshell -->
 		</FileCreate>
 	</RuleGroup>
 
@@ -529,6 +563,7 @@
 			<Image condition="is">C:\Windows\system32\CompatTelRunner.exe</Image> <!-- Windows: Windows 10 app, creates tons of cache files-->
 			<Image condition="is">\\?\C:\Windows\system32\wbem\WMIADAP.EXE</Image> <!-- Windows: WMI Performance updates-->
 			<Image condition="is">C:\Windows\system32\mobsync.exe</Image> <!--Windows: Network file syncing-->
+			<Image condition="is">C:\Windows\System32\WUDFHost.exe</Image> <!--Windows: Windows User-Mode Driver Framework Host. Safe as long as in the correct path. -->
 			<TargetFilename condition="begin with">C:\Windows\system32\DriverStore\Temp\</TargetFilename> <!-- Windows: Temp files by DrvInst.exe-->
 			<TargetFilename condition="begin with">C:\Windows\system32\wbem\Performance\</TargetFilename> <!-- Windows: Created in wbem by WMIADAP.exe-->
 			<TargetFilename condition="begin with">C:\Windows\Installer\</TargetFilename> <!--Windows:Installer: Ignore MSI installer files caching-->
@@ -567,6 +602,7 @@
 				<!--ADDITIONAL REFERENCE: [ http://www.silentrunners.org/launchpoints.html ] -->
 				<!--ADDITIONAL REFERENCE: [ https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2 ] -->
 				<!--ADDITIONAL REFERENCE: [ https://web.archive.org/web/20200116001643/http://scholarworks.rit.edu/cgi/viewcontent.cgi?article=1533&context=theses | Understanding malware autostart techniques - Matthew Gottlieb ] -->
+			<TargetObject name="T1562.002" condition="end with">\MiniNT</TargetObject> <!--Windows: Disable eventlog by acting like WinPE [https://twitter.com/0gtweet/status/1182516740955226112]  -->
 			<TargetObject name="T1060,RunKey" condition="contains">CurrentVersion\Run</TargetObject> <!--Windows: Wildcard for Run keys, including RunOnce, RunOnceEx, RunServices, RunServicesOnce [Also covers terminal server] -->
 			<TargetObject name="T1060,RunPolicy" condition="contains">Policies\Explorer\Run</TargetObject> <!--Windows: Alternate runs keys | Credit @ion-storm-->
 			<TargetObject name="T1484" condition="contains">Group Policy\Scripts</TargetObject> <!--Windows: Group policy scripts-->
@@ -630,7 +666,7 @@
 			<!--Credential providers-->
 			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider</TargetObject> <!--Wildcard, includes Credential Providers and Credential Provider Filters-->
 			<TargetObject name="T1101" condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\</TargetObject> <!-- [ https://attack.mitre.org/wiki/Technique/T1131 ] [ https://attack.mitre.org/wiki/Technique/T1101 ] -->
-			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders</TargetObject> <!--Windows: Changes to WDigest-UseLogonCredential for password scraping [ https://www.trustedsec.com/april-2015/dumping-wdigest-creds-with-meterpreter-mimikatzkiwi-in-windows-8-1/ ] -->
+			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\</TargetObject> <!--Windows: Changes to WDigest-UseLogonCredential for password scraping [ https://www.trustedsec.com/april-2015/dumping-wdigest-creds-with-meterpreter-mimikatzkiwi-in-windows-8-1/ ] -->
 			<TargetObject condition="begin with">HKLM\Software\Microsoft\Netsh</TargetObject> <!--Windows: Netsh helper DLL [ https://attack.mitre.org/wiki/Technique/T1128 ] -->
 			<TargetObject condition="contains">Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable</TargetObject> <!--Windows: Malware often disables a web proxy for 2nd stage downloads -->
 			<!--Networking-->
@@ -647,6 +683,7 @@
 			<!--Office-->
 			<TargetObject name="T1137" condition="contains">Microsoft\Office\Outlook\Addins\</TargetObject> <!--Microsoft:Office: Outlook add-ins, access to sensitive data and often cause issues-->
 			<TargetObject name="T1137" condition="contains">Office Test\</TargetObject> <!-- Microsoft:Office: Persistence method [ http://www.hexacorn.com/blog/2014/04/16/beyond-good-ol-run-key-part-10/ ] | Credit @Hexacorn -->
+			<TargetObject name="Suspicious,ChangedURLOutlook" condition="contains all">\Software\Microsoft\Office\;\Outlook\WebView\;URL</TargetObject> <!-- The URL shouldn't be changed all that often and could enable persistance for hackers | @humpelpum [ https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=70 ]-->
 			<TargetObject name="Context,ProtectedModeExitOrMacrosUsed" condition="contains">Security\Trusted Documents\TrustRecords</TargetObject> <!--Microsoft:Office: Monitor when "Enable editing" or "Enable macros" is used | Credit @OutflankNL | [ https://outflank.nl/blog/2018/01/16/hunting-for-evil-detect-macros-being-executed/ ] -->
 			<!--IE-->
 			<TargetObject name="T1176" condition="contains">Internet Explorer\Toolbar\</TargetObject> <!--Microsoft:InternetExplorer: Machine and user [ Example: https://www.exterminate-it.com/malpedia/remove-mywebsearch ] -->
@@ -671,6 +708,7 @@
 			<TargetObject name="T1089,Tamper-Defender" condition="end with">\SpynetReporting</TargetObject> <!--Windows:Defender: State modified via registry-->
 			<TargetObject name="T1089,Tamper-Defender" condition="end with">DisableRealtimeMonitoring</TargetObject> <!--Windows:Defender: State modified via registry-->
 			<TargetObject name="T1089,Tamper-Defender" condition="end with">\SubmitSamplesConsent</TargetObject> <!--Windows:Defender: State modified via registry-->
+			<TargetObject name="T1089,Tamper-Defender" condition="begin with">HKLM\Software\Microsoft\Windows Defender\Exclusions</TargetObject> <!--Windows:Defender: State modified via registry-->
 			<!--Windows UAC tampering-->
 			<TargetObject name="T1088" condition="end with">HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA</TargetObject> <!--Detect: UAC Tampering | Credit @ion-storm -->
 			<TargetObject name="T1088" condition="end with">HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy</TargetObject> <!--Detect: UAC Tampering | Credit @ion-storm -->
@@ -698,9 +736,20 @@
 			<TargetObject name="InvDB-DriverVer" condition="end with">\DriverVerVersion</TargetObject> <!-- [ https://df-stream.com/2015/02/leveraging-devicecontainers-key/ ] -->
 			<TargetObject name="InvDB-CompileTimeClaim" condition="end with">\LinkDate</TargetObject> <!-- Compile time of EXE, may not be reliable [ https://en.wikipedia.org/wiki/Link_time ] -->
 			<TargetObject name="InvDB" condition="contains">Compatibility Assistant\Store\</TargetObject> <!-- Inventory -->
+			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports</TargetObject> <!--Microsoft:Windows: Printer port changes as used in CVE-2020-1048 [ https://windows-internals.com/printdemon-cve-2020-1048/ ] -->
+			<TargetObject condition="contains">\Keyboard Layout\Preload</TargetObject> <!--Microsoft:Windows: Keyboard layout loaded into user session [ https://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index ] -->
+			<TargetObject condition="contains">\Keyboard Layout\Substitutes</TargetObject> <!--Microsoft:Windows: Keyboard layout loaded into user session [ https://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index ] -->
 			<!--Suspicious sources-->
 			<Image name="Suspicious,ImageBeginWithBackslash" condition="end with">regedit.exe</Image> <!--Users and helpdesk staff making system modifications -->
 			<Image name="Suspicious,ImageBeginWithBackslash" condition="begin with">\</Image> <!--Devices and VSC shouldn't be executing changes | Credit: @SBousseaden @ionstorm @neu5ron @PerchedSystems [ https://twitter.com/SwiftOnSecurity/status/1133167323991486464 ] -->
+			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\</TargetObject> <!--Microsoft:Windows:UAC: Detect malware changes to UAC prompt level-->
+			<TargetObject condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\</TargetObject> <!--Microsoft:Defender: Detect changes to Defender administrative settings to monitor for disablement-->
+			<!--Windows trust architecture monitoring | Credit: @mattifestation-->
+			<!--ADDITIONAL REFERENCE: https://specterops.io/assets/resources/SpecterOps_Subverting_Trust_in_Windows.pdf-->
+			<TargetObject condition="contains">Microsoft\Cryptography\OID\</TargetObject> <!-- Important trust registry values to monitor -->
+			<TargetObject condition="contains">WOW6432Node\Microsoft\Cryptography\OID\</TargetObject> <!-- Important trust registry values to monitor -->
+			<TargetObject condition="contains">Microsoft\Cryptography\Providers\Trust\</TargetObject> <!-- Important trust registry values to monitor -->
+			<TargetObject condition="contains">WOW6432Node\Microsoft\Cryptography\Providers\Trust\</TargetObject> <!-- Important trust registry values to monitor -->
 		</RegistryEvent>
 	</RuleGroup>
 
@@ -808,7 +857,7 @@
 	<!--SYSMON EVENT ID 16 : SYSMON CONFIGURATION CHANGE-->
 		<!--EVENT 16: "Sysmon config state changed"-->
 		<!--COMMENT:	This ONLY logs if the hash of the configuration changes. Running "sysmon.exe -c" with the current configuration will not be logged with Event 16-->
-		
+
 		<!--DATA: UtcTime, Configuration, ConfigurationFileHash-->
 		<!--Cannot be filtered.-->
 
@@ -820,11 +869,23 @@
 		<!--ADDITIONAL REFERENCE: [ https://blog.cobaltstrike.com/2015/10/07/named-pipe-pivoting/ ] -->
 
 		<!--DATA: UtcTime, ProcessGuid, ProcessId, PipeName, Image-->
-	<RuleGroup name="" groupRelation="or">
-		<PipeEvent onmatch="include">
-			<!--NOTE: Using incide with no rules means nothing in this section will be logged-->
-		</PipeEvent>
-	</RuleGroup>
+		<RuleGroup name="" groupRelation="or">
+			<PipeEvent onmatch="include">
+				<!-- Remote Command Execution Tools -->
+				<PipeName condition="contains any">paexec;remcom;csexec</PipeName>
+				<!-- Password or Credential Dumpers -->
+				<PipeName condition="contains any">\lsadump;\cachedump;\wceservicepipe</PipeName>
+				<!-- Malware -->
+				<PipeName condition="contains any">\isapi_http;\isapi_dg;\isapi_dg2;\sdlrpc;\ahexec;\winsession;\lsassw;\46a676ab7f179e511e30dd2dc41bd388;\9f81f59bc58452127884ce513865ed20;\e710f28d59aa529d6792ca6ff0ca1b34;\rpchlp_3;\NamePipe_MoreWindows;\pcheap_reuse;\gruntsvc;\583da945-62af-10e8-4902-a8f205c72b2e;\bizkaz;\svcctl;\Posh;\jaccdpqnvbrrxlaf;\csexecsvc</PipeName>
+				<PipeName condition="contains any">\atctl;\userpipe;\iehelper;\sdlrpc;\comnap</PipeName>
+				<!-- Cobalt Strike Pipe Names -->
+				<PipeName condition="contains all">MSSE-;-server</PipeName>
+				<PipeName condition="begin with">\postex_</PipeName>
+				<PipeName condition="begin with">\postex_ssh_</PipeName>
+				<PipeName condition="begin with">\status_</PipeName>
+				<PipeName condition="begin with">\msagent_</PipeName>
+			</PipeEvent>
+		</RuleGroup>
 
 	<!--SYSMON EVENT ID 19 & 20 & 21 : WMI EVENT MONITORING [WmiEvent]-->
 		<!--EVENT 19: "WmiEventFilter activity detected"-->
@@ -947,7 +1008,8 @@
 			<!--Goodlist CDN-->
 			<QueryName condition="end with">.akadns.net</QueryName> <!--AkamaiCDN, extensively used by Microsoft | Microsoft default exclusion-->
 			<QueryName condition="end with">.netflix.com</QueryName>
-			<QueryName condition="end with">aspnetcdn.com</QueryName> <!--Microsoft [ https://docs.microsoft.com/en-us/aspnet/ajax/cdn/overview ]-->
+			<QueryName condition="is">aspnetcdn.com</QueryName> <!--Microsoft [ https://docs.microsoft.com/en-us/aspnet/ajax/cdn/overview ]-->
+			<QueryName condition="end with">.aspnetcdn.com</QueryName> <!--Microsoft [ https://docs.microsoft.com/en-us/aspnet/ajax/cdn/overview ]-->
 			<QueryName condition="is">ajax.googleapis.com</QueryName>
 			<QueryName condition="is">cdnjs.cloudflare.com</QueryName> <!--Cloudflare: Hosts popular javascript libraries-->
 			<QueryName condition="is">fonts.googleapis.com</QueryName> <!--Google fonts-->
@@ -991,7 +1053,7 @@
 			<QueryName condition="end with">.criteo.net</QueryName> <!--Ads [ https://better.fyi/trackers/criteo.com/ ] -->
 			<QueryName condition="end with">.crwdcntrl.net</QueryName> <!--Ads: Lotame [ https://better.fyi/trackers/crwdcntrl.net/ ] -->
 			<QueryName condition="end with">.demdex.net</QueryName> <!--Ads | Microsoft default exclusion-->
-			<QueryName condition="end with">.domdex.com</QueryName> 
+			<QueryName condition="end with">.domdex.com</QueryName>
 			<QueryName condition="end with">.dotomi.com</QueryName> <!--Ads | Microsoft default exclusion-->
 			<QueryName condition="end with">.doubleclick.net</QueryName> <!--Ads:Conversant | Microsoft default exclusion [ https://www.crunchbase.com/organization/dotomi ] -->
 			<QueryName condition="end with">.doubleverify.com</QueryName> <!--Ads: Google-->
@@ -1084,16 +1146,19 @@
 			<QueryName condition="is">ocsp.godaddy.com</QueryName>
 			<QueryName condition="is">ocsp.int-x3.letsencrypt.org</QueryName>
 			<QueryName condition="is">ocsp.msocsp.com</QueryName> <!--Microsoft:OCSP-->
-			<QueryName condition="end with">pki.goog</QueryName>
+			<QueryName condition="is">pki.goog</QueryName>
+			<QueryName condition="end with">.pki.goog</QueryName>
 			<QueryName condition="is">ocsp.godaddy.com</QueryName>
-			<QueryName condition="end with">amazontrust.com</QueryName>
+			<QueryName condition="is">amazontrust.com</QueryName>
+			<QueryName condition="end with">.amazontrust.com</QueryName>
 			<QueryName condition="is">ocsp.sectigo.com</QueryName>
 			<QueryName condition="is">pki-goog.l.google.com</QueryName>
 			<QueryName condition="end with">.usertrust.com</QueryName>
 			<QueryName condition="is">ocsp.comodoca.com</QueryName>
 			<QueryName condition="is">ocsp.verisign.com</QueryName>
 			<QueryName condition="is">ocsp.entrust.net</QueryName>
-			<QueryName condition="end with">ocsp.identrust.com</QueryName>
+			<QueryName condition="is">ocsp.identrust.com</QueryName>
+			<QueryName condition="end with">.ocsp.identrust.com</QueryName>
 			<QueryName condition="is">status.rapidssl.com</QueryName>
 			<QueryName condition="is">status.thawte.com</QueryName>
 			<QueryName condition="is">ocsp.int-x3.letsencrypt.org</QueryName>
@@ -1101,8 +1166,11 @@
 	</RuleGroup>
 
 	<!--SYSMON EVENT ID 23 : FILE DELETE [FileDelete]-->
-		<!--EVENT 22: "File Delete"-->
-		<!--COMMENT:	Sandbox usage. When a program signals to Windows a file should be deleted or wiped, Sysmon may be able to capture it. 
+		<!--EVENT 23: "File Delete"-->
+		<!--COMMENT:	Sandbox usage. When a program signals to Windows a file should be deleted or wiped, Sysmon may be able to capture it.
+		    Tries to save a copy of the deleted file in the archivedirectory which defaults to C:\Sysmon (to view uncheck "Hide protected
+			operating system files (Recommended)" from Folder Options). Can quickly fill the available drive space with copies of files.
+			Use EVENT ID 26 if a copy is not needed.
 			[ https://isc.sans.edu/forums/diary/Sysmon+and+File+Deletion/26084/ ]
 		-->
 
@@ -1110,8 +1178,8 @@
 
 	<!--
 	<RuleGroup name="" groupRelation="or">
-		<ClipboardChange onmatch="include">
-		</ClipboardChange>
+		<FileDelete onmatch="include">
+		</FileDelete>
 	</RuleGroup>
 	-->
 
@@ -1119,7 +1187,7 @@
 		<!--EVENT 24: "Clipboard changed"-->
 		<!--COMMENT:	Sandbox usage.  Sysmon can capture the contents of clipboard events.
 			An  example of what could be a production usage on restricted desktops is provided below, but it is commented-out. -->
-			
+
 		<!--DATA: EventType, UtcTime, ProcessGuid, ProcessId, Image, Session, ClientInfo, Hashes, Archived -->
 
 	<!--
@@ -1138,9 +1206,9 @@
 		<!--COMMENT:	This event is generated when a process image is changed from an external source, such as a different process.
 			This may or may not provide value in your environment as it requires tuning and a SIEM to correlate the ProcessGuids.
 			[ https://medium.com/falconforce/sysmon-13-process-tampering-detection-820366138a6c ] -->
-		
+
 		<!--DATA: EventType, RuleName, UtcTime, ProcessGuid, ProcessId, Image, Type -->
-	
+
 	<!--
 	<RuleGroup name="" groupRelation="or">
 		<ProcessTampering onmatch="exclude">
@@ -1149,6 +1217,16 @@
 	</RuleGroup>
 	-->
 
+	<!--SYSMON EVENT ID 26 : FILE DELETE LOGGED [FileDeleteDetected]-->
+		<!--EVENT 26: "File Delete logged"-->
+		<!--COMMENT:	This event is generated when a program signals to Windows a file should be deleted or wiped, Sysmon may be able to capture it.
+		    Unlike event ID 23 it does not archive a copy of the file deleted allowing for more widespread use outside of a sandbox or IR triage without
+			risk of filling up the storage space with deleted archives.
+			[ https://medium.com/falconforce/sysmon-13-10-filedeletedetected-fe2475cb419e ]
+		-->
+
+		<!--DATA: RuleName, UtcTime, ProcessGuid, ProcessId, User, Image, TargetFilename, Hashes, IsExecutable -->
+
 	<!--SYSMON EVENT ID 255 : ERROR-->
 		<!--"This event is generated when an error occurred within Sysmon. They can happen if the system is under heavy load
 			and certain tasked could not be performed or a bug exists in the Sysmon service. You can report any bugs on the
@@ -1156,4 +1234,4 @@
 		<!--Cannot be filtered.-->
 
 	</EventFiltering>
-</Sysmon>
\ No newline at end of file
+</Sysmon>

From bdc3fd2c784c93fc7f3c4c7f4672cf694e0d3316 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Sat, 24 Jul 2021 08:34:04 +0200
Subject: [PATCH 002/149] HiveNightmare detection

---
 sysmonconfig-export.xml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 9b2c0e77..19a761a0 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -549,6 +549,10 @@
 			<TargetFilename condition="end with">.ashx</TargetFilename> <!-- possible dropped webshell -->
 			<TargetFilename condition="end with">.jsp</TargetFilename> <!-- possible dropped webshell -->
 			<TargetFilename condition="end with">.pl</TargetFilename> <!-- possible dropped webshell -->
+			<TargetFilename condition="contains">\SAM-20</TargetFilename> <!-- Default output of HiveNightmare / SeriousSAM tools -->
+			<TargetFilename condition="contains">\SAM-haxx</TargetFilename> <!-- Default output of HiveNightmare / SeriousSAM tools -->
+			<TargetFilename condition="contains">\Sam.save</TargetFilename> <!-- Default output of HiveNightmare / SeriousSAM tools -->
+			<TargetFilename condition="contains">\hive_sam_</TargetFilename> <!-- Default output of HiveNightmare / SeriousSAM tools -->
 		</FileCreate>
 	</RuleGroup>
 

From ca2ccea5e6d1fa7cb04b0e60f5d59e84c11c1c93 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Sat, 24 Jul 2021 08:40:46 +0200
Subject: [PATCH 003/149] docs: give credits to the contributors of the
 squashed pull requests

---
 README.md | 98 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 98 insertions(+)

diff --git a/README.md b/README.md
index 26525c7a..0836b8f8 100644
--- a/README.md
+++ b/README.md
@@ -43,3 +43,101 @@ Run with administrator rights
 ```batch
 sysmon.exe -u
 ```
+
+## Credits
+
+Since we wanted to be able to receive new pull requests this repository, we had to squash all open(!) pull requests of the original reposiory into a single commit on this one.
+
+We've pull the following requests:
+
+Registry key to detect definitions of Windows Defender Exclusions
+155 opened 12 days ago by @phantinuss
+
+Outlook Webview URL changes
+154 opened on 14 Jun by @humpalum
+
+Event id 26
+153 opened on 14 Jun by @Richman711
+
+Important and relevant NamedPipe names
+151 opened on 27 May by @Neo23x0
+
+Added named pipe used by @Cobalt Strike
+150 opened on 26 May by @WojciechLesicki
+
+Fix FileDelete example.
+149 opened on 26 May by @sigalpes
+
+Add exclusion for WUDFHost.exe to Event 11
+148 opened on 19 Apr by @lord-garmadon
+
+Corrected event name for Event ID 23
+147 opened on 16 Apr by @lord-garmadon
+
+Monitor for .js files for Microsoft JScript
+146 opened on 7 Apr by @KevinDeNotariis
+
+Added WinRM ports and Service names
+145 opened on 16 Mar by @tobor88
+
+Add ASP files for webshells
+144 opened on 8 Mar by @GossiTheDog
+
+Update NetworkConnect rule to fix Metasploit default port
+143 opened on 6 Mar by @brokenvhs
+
+Ransomware artifacts added to File Creation config
+140 opened on 18 Feb by @sduff
+
+MiniNT registry key check
+130 opened on 9 Sep 2020 by @ThisIsNotTheUserYouAreLookingFor
+
+Added detection for CVE-2017-0199 and CVE-2017-8759.
+118 opened on 21 May 2020 by @d4rk-d4nph3
+
+Printer port changes as used in CVE-2020-1048
+115 opened on 15 May 2020 by @Neo23x0
+
+Update sysmonconfig-export.xml
+108 opened on 1 Mar 2020 by @harmonkc
+
+Changed the bypassable DNS hostname checks
+107 opened on 5 Feb 2020 by @MaxNad
+
+Added most of the missing LOLBAS for downloading executables
+106 opened on 5 Feb 2020 by @MaxNad
+
+Change Metasploit Alert port from 444 to 4444
+105 opened on 5 Feb 2020 by @ION28
+
+Add exclusion for Azure MMA agent | Add exclusion for IPAM GP PS script | Add exclusion for MonitorKnowledgeDiscovery
+104 opened on 29 Jan 2020 by @adrwh
+
+Fixed wdigest registry path
+102 opened on 13 Dec 2019 by @qz8xTD
+
+unnecessary shout out to Alpha version for DNS logging
+100 opened on 10 Dec 2019 by @itpropaul
+
+Add scripting filename targets
+98 opened on 14 Nov 2019 by @bartblaze
+
+Included some of the entries from PR to sysmonconfig-export.xml
+97 opened on 6 Nov 2019 by @cudeso
+
+Keyboard Layout Load
+92 opened on 13 Oct 2019 by @Neo23x0
+
+Fixed IMAP port
+71 opened on 12 Jan 2019 by @esecrpm
+66 opened on 21 Aug 2018 by @martboo
+59 opened on 25 May 2018 by @paalbra
+
+Micro-improvements to monitored scenarios
+53 opened on 6 Mar 2018 by @threathunting
+
+Corrected typo for RTF extension
+50 opened on 24 Jan 2018 by @kronflux
+
+Add Windows Trust registry keys to log
+40 opened on 4 Oct 2017 by @mdunten

From fe70b878b62795cf20d8659a1f833de07c488993 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Sat, 24 Jul 2021 08:42:55 +0200
Subject: [PATCH 004/149] docs: better line breaks in credits

---
 README.md | 60 +++++++++++++++++++++++++++----------------------------
 1 file changed, 30 insertions(+), 30 deletions(-)

diff --git a/README.md b/README.md
index 0836b8f8..7691ca6a 100644
--- a/README.md
+++ b/README.md
@@ -50,94 +50,94 @@ Since we wanted to be able to receive new pull requests this repository, we had
 
 We've pull the following requests:
 
-Registry key to detect definitions of Windows Defender Exclusions
+Registry key to detect definitions of Windows Defender Exclusions\
 155 opened 12 days ago by @phantinuss
 
-Outlook Webview URL changes
+Outlook Webview URL changes\
 154 opened on 14 Jun by @humpalum
 
-Event id 26
+Event id 26\
 153 opened on 14 Jun by @Richman711
 
-Important and relevant NamedPipe names
+Important and relevant NamedPipe names\
 151 opened on 27 May by @Neo23x0
 
-Added named pipe used by @Cobalt Strike
+Added named pipe used by @Cobalt Strike\
 150 opened on 26 May by @WojciechLesicki
 
-Fix FileDelete example.
+Fix FileDelete example.\
 149 opened on 26 May by @sigalpes
 
-Add exclusion for WUDFHost.exe to Event 11
+Add exclusion for WUDFHost.exe to Event 11\
 148 opened on 19 Apr by @lord-garmadon
 
-Corrected event name for Event ID 23
+Corrected event name for Event ID 23\
 147 opened on 16 Apr by @lord-garmadon
 
-Monitor for .js files for Microsoft JScript
+Monitor for .js files for Microsoft JScript\
 146 opened on 7 Apr by @KevinDeNotariis
 
-Added WinRM ports and Service names
+Added WinRM ports and Service names\
 145 opened on 16 Mar by @tobor88
 
-Add ASP files for webshells
+Add ASP files for webshells\
 144 opened on 8 Mar by @GossiTheDog
 
-Update NetworkConnect rule to fix Metasploit default port
+Update NetworkConnect rule to fix Metasploit default port\
 143 opened on 6 Mar by @brokenvhs
 
-Ransomware artifacts added to File Creation config
+Ransomware artifacts added to File Creation config\
 140 opened on 18 Feb by @sduff
 
-MiniNT registry key check
+MiniNT registry key check\
 130 opened on 9 Sep 2020 by @ThisIsNotTheUserYouAreLookingFor
 
-Added detection for CVE-2017-0199 and CVE-2017-8759.
+Added detection for CVE-2017-0199 and CVE-2017-8759.\
 118 opened on 21 May 2020 by @d4rk-d4nph3
 
-Printer port changes as used in CVE-2020-1048
+Printer port changes as used in CVE-2020-1048\
 115 opened on 15 May 2020 by @Neo23x0
 
-Update sysmonconfig-export.xml
+Update sysmonconfig-export.xml\
 108 opened on 1 Mar 2020 by @harmonkc
 
-Changed the bypassable DNS hostname checks
+Changed the bypassable DNS hostname checks\
 107 opened on 5 Feb 2020 by @MaxNad
 
-Added most of the missing LOLBAS for downloading executables
+Added most of the missing LOLBAS for downloading executables\
 106 opened on 5 Feb 2020 by @MaxNad
 
-Change Metasploit Alert port from 444 to 4444
+Change Metasploit Alert port from 444 to 4444\
 105 opened on 5 Feb 2020 by @ION28
 
-Add exclusion for Azure MMA agent | Add exclusion for IPAM GP PS script | Add exclusion for MonitorKnowledgeDiscovery
+Add exclusion for Azure MMA agent | Add exclusion for IPAM GP PS script | Add exclusion for MonitorKnowledgeDiscovery\
 104 opened on 29 Jan 2020 by @adrwh
 
-Fixed wdigest registry path
+Fixed wdigest registry path\
 102 opened on 13 Dec 2019 by @qz8xTD
 
-unnecessary shout out to Alpha version for DNS logging
+unnecessary shout out to Alpha version for DNS logging\
 100 opened on 10 Dec 2019 by @itpropaul
 
-Add scripting filename targets
+Add scripting filename targets\
 98 opened on 14 Nov 2019 by @bartblaze
 
-Included some of the entries from PR to sysmonconfig-export.xml
+Included some of the entries from PR to sysmonconfig-export.xml\
 97 opened on 6 Nov 2019 by @cudeso
 
-Keyboard Layout Load
+Keyboard Layout Load\
 92 opened on 13 Oct 2019 by @Neo23x0
 
-Fixed IMAP port
+Fixed IMAP port\
 71 opened on 12 Jan 2019 by @esecrpm
 66 opened on 21 Aug 2018 by @martboo
 59 opened on 25 May 2018 by @paalbra
 
-Micro-improvements to monitored scenarios
+Micro-improvements to monitored scenarios\
 53 opened on 6 Mar 2018 by @threathunting
 
-Corrected typo for RTF extension
+Corrected typo for RTF extension\
 50 opened on 24 Jan 2018 by @kronflux
 
-Add Windows Trust registry keys to log
+Add Windows Trust registry keys to log\
 40 opened on 4 Oct 2017 by @mdunten

From 23af2b46f1a8e81e61688f8000ceecd8617e412e Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Sat, 24 Jul 2021 08:57:57 +0200
Subject: [PATCH 005/149] PrinterNightmare coverage

---
 sysmonconfig-export.xml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 19a761a0..240dc9e2 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -754,6 +754,7 @@
 			<TargetObject condition="contains">WOW6432Node\Microsoft\Cryptography\OID\</TargetObject> <!-- Important trust registry values to monitor -->
 			<TargetObject condition="contains">Microsoft\Cryptography\Providers\Trust\</TargetObject> <!-- Important trust registry values to monitor -->
 			<TargetObject condition="contains">WOW6432Node\Microsoft\Cryptography\Providers\Trust\</TargetObject> <!-- Important trust registry values to monitor -->
+			<TargetObject condition="contains">Control\Print\Environments\Windows x64\Drivers</TargetObject> <!-- PrinterNightmare coverage -->
 		</RegistryEvent>
 	</RuleGroup>
 

From f893c68a5238d33a4626daf8cfb5fd0409202724 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Sat, 24 Jul 2021 09:11:13 +0200
Subject: [PATCH 006/149] feat: more PrinterNightmare coverage

---
 sysmonconfig-export.xml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 240dc9e2..21933331 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -553,6 +553,7 @@
 			<TargetFilename condition="contains">\SAM-haxx</TargetFilename> <!-- Default output of HiveNightmare / SeriousSAM tools -->
 			<TargetFilename condition="contains">\Sam.save</TargetFilename> <!-- Default output of HiveNightmare / SeriousSAM tools -->
 			<TargetFilename condition="contains">\hive_sam_</TargetFilename> <!-- Default output of HiveNightmare / SeriousSAM tools -->
+			<TargetFilename condition="begin with">C:\Windows\System32\spool\drivers\x64</TargetFilename> <!-- PrinterNight -->
 		</FileCreate>
 	</RuleGroup>
 

From 510e4eda990b52ea0912dbff8873869ad017dc41 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Sat, 24 Jul 2021 09:59:55 +0200
Subject: [PATCH 007/149] docs: info on extended coverage

---
 README.md               |   6 ++
 sysmonconfig-export.xml | 161 +---------------------------------------
 2 files changed, 8 insertions(+), 159 deletions(-)

diff --git a/README.md b/README.md
index 7691ca6a..d363ce72 100644
--- a/README.md
+++ b/README.md
@@ -4,6 +4,12 @@ This is a forked and modified version of @SwiftOnSecurity's [sysmon config](http
 
 Currently it is simply a copy with most of the 30+ open pull requests of the original repository merged. Thus we have fixed many of the issues that are still present in the original version and extended the coverage by important new extensions that have been provided over the last year.
 
+## Additional coverage includes
+
+- Cobalt Strike named pipes
+- PrinterNightmare
+- HiveNightmare
+
 ## Testing
 
 This configuration is focused on detection coverage. We have only one rather small testing environment to avoid problematic expressions that trigger too often. It is recommended to test the downloaded configuration on a small set of systems in your environment in any case. 
diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 21933331..47fdb8e2 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -357,6 +357,7 @@
 			<DestinationPort name="WinRM" condition="is">5985</DestinationPort> <!-- WinRM protocol used for remote connections to execute commands -->
 			<DestinationPort name="WinRM over HTTPS" condition="is">5986</DestinationPort> <!-- WinRM over HTTPS when set up in an environment can be used for remote connections to execute commands -->
 			<DestinationPort name="Alert,Metasploit" condition="is">4444</DestinationPort> <!-- Default Metasploit port -->
+			<User name="EFSRPC" condition="contains">NT AUTHOR</User> <!-- Default EFSRPC port -->
 			<!--Ports: Proxy-->
 			<DestinationPort name="Proxy" condition="is">1080</DestinationPort> <!--Socks proxy port | Credit @ion-storm-->
 			<DestinationPort name="Proxy" condition="is">3128</DestinationPort> <!--Socks proxy port | Credit @ion-storm-->
@@ -599,165 +600,7 @@
 								For example, most COM hijacking in CLSID's across the registry is covered by a single rule monitoring a InProcServer32 wildcard-->
 
 		<!--DATA: EventType, UtcTime, ProcessGuid, ProcessId, Image, TargetObject, Details (can't filter on), NewName (can't filter on)-->
-	<RuleGroup name="" groupRelation="or">
-		<RegistryEvent onmatch="include">
-			<!--Autorun or Startups-->
-				<!--ADDITIONAL REFERENCE: [ http://www.ghacks.net/2016/06/04/windows-automatic-startup-locations/ ] -->
-				<!--ADDITIONAL REFERENCE: [ https://view.officeapps.live.com/op/view.aspx?src=https://arsenalrecon.com/downloads/resources/Registry_Keys_Related_to_Autorun.ods ] -->
-				<!--ADDITIONAL REFERENCE: [ http://www.silentrunners.org/launchpoints.html ] -->
-				<!--ADDITIONAL REFERENCE: [ https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2 ] -->
-				<!--ADDITIONAL REFERENCE: [ https://web.archive.org/web/20200116001643/http://scholarworks.rit.edu/cgi/viewcontent.cgi?article=1533&context=theses | Understanding malware autostart techniques - Matthew Gottlieb ] -->
-			<TargetObject name="T1562.002" condition="end with">\MiniNT</TargetObject> <!--Windows: Disable eventlog by acting like WinPE [https://twitter.com/0gtweet/status/1182516740955226112]  -->
-			<TargetObject name="T1060,RunKey" condition="contains">CurrentVersion\Run</TargetObject> <!--Windows: Wildcard for Run keys, including RunOnce, RunOnceEx, RunServices, RunServicesOnce [Also covers terminal server] -->
-			<TargetObject name="T1060,RunPolicy" condition="contains">Policies\Explorer\Run</TargetObject> <!--Windows: Alternate runs keys | Credit @ion-storm-->
-			<TargetObject name="T1484" condition="contains">Group Policy\Scripts</TargetObject> <!--Windows: Group policy scripts-->
-			<TargetObject name="T1484" condition="contains">Windows\System\Scripts</TargetObject> <!--Windows: Wildcard for Logon, Loggoff, Shutdown-->
-			<TargetObject name="T1060" condition="contains">CurrentVersion\Windows\Load</TargetObject> <!--Windows: [ https://msdn.microsoft.com/en-us/library/jj874148.aspx ] -->
-			<TargetObject name="T1060" condition="contains">CurrentVersion\Windows\Run</TargetObject> <!--Windows: [ https://msdn.microsoft.com/en-us/library/jj874148.aspx ] -->
-			<TargetObject name="T1060" condition="contains">CurrentVersion\Winlogon\Shell</TargetObject> <!--Windows: [ https://msdn.microsoft.com/en-us/library/ms838576(v=winembedded.5).aspx ] -->
-			<TargetObject name="T1060" condition="contains">CurrentVersion\Winlogon\System</TargetObject> <!--Windows [ https://www.exterminate-it.com/malpedia/regvals/zlob-dns-changer/118 ] -->
-			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify</TargetObject> <!--Windows: Autorun location [ https://attack.mitre.org/wiki/Technique/T1004 ] [ https://www.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order ] -->
-			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell</TargetObject> <!--Windows: [ https://technet.microsoft.com/en-us/library/ee851671.aspx ] -->
-			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit</TargetObject> <!--Windows: Autorun location [ https://www.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order ] -->
-			<TargetObject condition="begin with">HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32</TargetObject> <!--Windows: Legacy driver loading | Credit @ion-storm -->
-			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute</TargetObject> <!--Windows: Autorun | Credit @ion-storm | [ https://www.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order ] -->
-			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug</TargetObject> <!--Windows: Automatic program crash debug program [ https://www.symantec.com/security_response/writeup.jsp?docid=2007-050712-5453-99&tabid=2 ] -->
-			<TargetObject condition="contains">UserInitMprLogonScript</TargetObject> <!--Windows: Legacy logon script environment variable [ http://www.hexacorn.com/blog/2014/11/14/beyond-good-ol-run-key-part-18/ ] -->
-			<TargetObject name="T1112,ChangeStartupFolderPath" condition="end with">user shell folders\startup</TargetObject> <!--Monitor changes to Startup folder location for monitoring evasion | Credit @SBousseaden-->
-			<!--Services-->
-			<TargetObject name="T1031,T1050" condition="end with">\ServiceDll</TargetObject> <!--Windows: Points to a service's DLL [ https://blog.cylance.com/windows-registry-persistence-part-1-introduction-attack-phases-and-windows-services ] -->
-			<TargetObject name="T1031,T1050" condition="end with">\ServiceManifest</TargetObject> <!--Windows: Manifest pointing to service's DLL [ https://www.geoffchappell.com/studies/windows/win32/services/svchost/index.htm ] -->
-			<TargetObject name="T1031,T1050" condition="end with">\ImagePath</TargetObject> <!--Windows: Points to a service's EXE [ https://attack.mitre.org/wiki/Technique/T1050 ] -->
-			<TargetObject name="T1031,T1050" condition="end with">\Start</TargetObject> <!--Windows: Services start mode changes (Disabled, Automatically, Manual)-->
-			<!--RDP-->
-			<TargetObject name="RDP port change" condition="end with">Control\Terminal Server\WinStations\RDP-Tcp\PortNumber</TargetObject> <!--Windows: RDP port change under Control [ https://blog.menasec.net/2019/02/of-rdp-hijacking-part1-remote-desktop.html ]-->
-			<TargetObject name="RDP port change" condition="end with">Control\Terminal Server\fSingleSessionPerUser</TargetObject> <!--Windows: Allow same user to have mutliple RDP sessions, to hide from admin being impersonated-->
-			<TargetObject name="ModifyRemoteDesktopState" condition="end with">fDenyTSConnections</TargetObject> <!--Windows: Attacker turning on RDP-->
-			<TargetObject condition="end with">LastLoggedOnUser</TargetObject> <!--Windows: Changing last-logged in user-->
-			<TargetObject name="ModifyRemoteDesktopPort" condition="end with">RDP-tcp\PortNumber</TargetObject> <!--Windows: Changing RDP port to evade IDS-->
-			<TargetObject condition="end with">Services\PortProxy\v4tov4</TargetObject> <!--Windows: Changing RDP port to evade IDS-->
-			<!--CLSID launch commands and Default File Association changes-->
-			<TargetObject name="T1042" condition="contains">\command\</TargetObject> <!--Windows: Sensitive sub-key under file associations and CLSID that map to launch command-->
-			<TargetObject name="T1122" condition="contains">\ddeexec\</TargetObject> <!--Windows: Sensitive sub-key under file associations and CLSID that map to launch command-->
-			<TargetObject name="T1122" condition="contains">{86C86720-42A0-1069-A2E8-08002B30309D}</TargetObject> <!--Windows: Tooltip handler-->
-			<TargetObject name="T1042" condition="contains">exefile</TargetObject> <!--Windows Executable handler, to log any changes not already monitored-->
-			<!--Windows COM-->
-			<TargetObject name="T1122" condition="end with">\InprocServer32\(Default)</TargetObject> <!--Windows:COM Object Hijacking [ https://blog.gdatasoftware.com/2014/10/23941-com-object-hijacking-the-discreet-way-of-persistence ] | Credit @ion-storm -->
-			<!--Windows shell visual modifications used by malware-->
-			<TargetObject name="T1158" condition="end with">\Hidden</TargetObject> <!--Windows:Explorer: Some types of malware try to hide their hidden system files from the user, good signal event -->
-			<TargetObject name="T1158" condition="end with">\ShowSuperHidden</TargetObject> <!--Windows:Explorer: Some types of malware try to hide their hidden system files from the user, good signal event [ Example: https://www.symantec.com/security_response/writeup.jsp?docid=2007-061811-4341-99&tabid=2 ] -->
-			<TargetObject name="T1158" condition="end with">\HideFileExt</TargetObject> <!--Windows:Explorer: Some malware hides file extensions to make diagnosis/disinfection more daunting to novice users -->
-			<!--Windows shell hijack and modifications-->
-			<TargetObject condition="contains">Classes\*\</TargetObject> <!--Windows:Explorer: [ http://www.silentrunners.org/launchpoints.html ] -->
-			<TargetObject condition="contains">Classes\AllFilesystemObjects\</TargetObject> <!--Windows:Explorer: [ http://www.silentrunners.org/launchpoints.html ] -->
-			<TargetObject condition="contains">Classes\Directory\</TargetObject> <!--Windows:Explorer: [ https://stackoverflow.com/questions/1323663/windows-shell-context-menu-option ] -->
-			<TargetObject condition="contains">Classes\Drive\</TargetObject> <!--Windows:Explorer: [ https://stackoverflow.com/questions/1323663/windows-shell-context-menu-option ] -->
-			<TargetObject condition="contains">Classes\Folder\</TargetObject> <!--Windows:Explorer: ContextMenuHandlers, DragDropHandlers, CopyHookHandlers, [ https://stackoverflow.com/questions/1323663/windows-shell-context-menu-option ] -->
-			<TargetObject condition="contains">Classes\PROTOCOLS\</TargetObject> <!--Windows:Explorer: Protocol handlers-->
-			<TargetObject condition="contains">ContextMenuHandlers\</TargetObject> <!--Windows: [ http://oalabs.openanalysis.net/2015/06/04/malware-persistence-hkey_current_user-shell-extension-handlers/ ] -->
-			<TargetObject condition="contains">CurrentVersion\Shell</TargetObject> <!--Windows: Shell Folders, ShellExecuteHooks, ShellIconOverloadIdentifers, ShellServiceObjects, ShellServiceObjectDelayLoad [ http://oalabs.openanalysis.net/2015/06/04/malware-persistence-hkey_current_user-shell-extension-handlers/ ] -->
-			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks</TargetObject> <!--Windows: ShellExecuteHooks-->
-			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellServiceObjectDelayLoad</TargetObject> <!--Windows: ShellExecuteHooks-->
-			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellIconOverlayIdentifiers</TargetObject> <!--Windows: ShellExecuteHooks-->
-			<!--AppPaths hijacking-->
-			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\</TargetObject> <!--Windows: Credit to @Hexacorn [ http://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/ ] -->
-			<!--Terminal service boobytrap-->
-			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram</TargetObject> <!--Windows:RDP: Note other Terminal Server run keys are handled by another wildcard already-->
-			<!--Group Policy integrity-->
-			<TargetObject name="T1484" condition="begin with">HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\</TargetObject> <!--Windows: Group Policy internally uses a plug-in architecture that nothing should be modifying-->
-			<!--Winsock and Winsock2-->
-			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Services\WinSock</TargetObject> <!--Windows: Wildcard, includes Winsock and Winsock2-->
-			<TargetObject condition="end with">\ProxyServer</TargetObject> <!--Windows: System and user proxy server-->
-			<!--Credential providers-->
-			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider</TargetObject> <!--Wildcard, includes Credential Providers and Credential Provider Filters-->
-			<TargetObject name="T1101" condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\</TargetObject> <!-- [ https://attack.mitre.org/wiki/Technique/T1131 ] [ https://attack.mitre.org/wiki/Technique/T1101 ] -->
-			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\</TargetObject> <!--Windows: Changes to WDigest-UseLogonCredential for password scraping [ https://www.trustedsec.com/april-2015/dumping-wdigest-creds-with-meterpreter-mimikatzkiwi-in-windows-8-1/ ] -->
-			<TargetObject condition="begin with">HKLM\Software\Microsoft\Netsh</TargetObject> <!--Windows: Netsh helper DLL [ https://attack.mitre.org/wiki/Technique/T1128 ] -->
-			<TargetObject condition="contains">Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable</TargetObject> <!--Windows: Malware often disables a web proxy for 2nd stage downloads -->
-			<!--Networking-->
-			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\</TargetObject> <!--Windows: Order of network providers that are checked to connect to destination [ https://www.malwarearchaeology.com/cheat-sheets ] -->
-			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles</TargetObject> <!--Windows: | Credit @ion-storm -->
-			<TargetObject name="T1089" condition="end with">\EnableFirewall</TargetObject> <!--Windows: Monitor for firewall disablement, all firewall profiles [ https://attack.mitre.org/wiki/Technique/T1089 ] -->
-			<TargetObject name="T1089" condition="end with">\DoNotAllowExceptions</TargetObject> <!--Windows: Monitor for firewall disablement, all firewall profiles [ https://attack.mitre.org/wiki/Technique/T1089 ] -->
-			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List</TargetObject> <!--Windows Firewall authorized applications for all networks| Credit @ion-storm -->
-			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List</TargetObject> <!--Windows Firewall authorized applications for domain networks -->
-			<!--DLLs that get injected into every process at launch-->
-			<TargetObject name="T1103" condition="begin with">HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\</TargetObject> <!--Windows: Feature disabled by default [ https://attack.mitre.org/wiki/Technique/T1103 ] -->
-			<TargetObject name="T1103" condition="begin with">HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\</TargetObject> <!--Windows: Feature disabled by default [ https://attack.mitre.org/wiki/Technique/T1103 ] -->
-			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\</TargetObject> <!--Windows: Credit to @Hexacorn [ http://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/ ] [ https://blog.comodo.com/malware/trojware-win32-trojanspy-volisk-a/ ] -->
-			<!--Office-->
-			<TargetObject name="T1137" condition="contains">Microsoft\Office\Outlook\Addins\</TargetObject> <!--Microsoft:Office: Outlook add-ins, access to sensitive data and often cause issues-->
-			<TargetObject name="T1137" condition="contains">Office Test\</TargetObject> <!-- Microsoft:Office: Persistence method [ http://www.hexacorn.com/blog/2014/04/16/beyond-good-ol-run-key-part-10/ ] | Credit @Hexacorn -->
-			<TargetObject name="Suspicious,ChangedURLOutlook" condition="contains all">\Software\Microsoft\Office\;\Outlook\WebView\;URL</TargetObject> <!-- The URL shouldn't be changed all that often and could enable persistance for hackers | @humpelpum [ https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=70 ]-->
-			<TargetObject name="Context,ProtectedModeExitOrMacrosUsed" condition="contains">Security\Trusted Documents\TrustRecords</TargetObject> <!--Microsoft:Office: Monitor when "Enable editing" or "Enable macros" is used | Credit @OutflankNL | [ https://outflank.nl/blog/2018/01/16/hunting-for-evil-detect-macros-being-executed/ ] -->
-			<!--IE-->
-			<TargetObject name="T1176" condition="contains">Internet Explorer\Toolbar\</TargetObject> <!--Microsoft:InternetExplorer: Machine and user [ Example: https://www.exterminate-it.com/malpedia/remove-mywebsearch ] -->
-			<TargetObject name="T1176" condition="contains">Internet Explorer\Extensions\</TargetObject> <!--Microsoft:InternetExplorer: Machine and user [ Example: https://www.exterminate-it.com/malpedia/remove-mywebsearch ] -->
-			<TargetObject name="T1176" condition="contains">Browser Helper Objects\</TargetObject> <!--Microsoft:InternetExplorer: Machine and user [ https://msdn.microsoft.com/en-us/library/bb250436(v=vs.85).aspx ] -->
-			<TargetObject condition="end with">\DisableSecuritySettingsCheck</TargetObject>
-			<TargetObject condition="end with">\3\1206</TargetObject> <!--Microsoft:InternetExplorer: Malware sometimes assures scripting is on in Internet Zone [ https://support.microsoft.com/en-us/help/182569/internet-explorer-security-zones-registry-entries-for-advanced-users ] -->
-			<TargetObject condition="end with">\3\2500</TargetObject> <!--Microsoft:InternetExplorer: Malware sometimes disables Protected Mode in Internet Zone [ https://blog.avast.com/2013/08/12/your-documents-are-corrupted-from-image-to-an-information-stealing-trojan/ ] -->
-			<TargetObject condition="end with">\3\1809</TargetObject> <!--Microsoft:InternetExplorer: Malware sometimes disables Pop-up Blocker in Internet Zone [ https://support.microsoft.com/en-us/help/182569/internet-explorer-security-zones-registry-entries-for-advanced-users ] -->
-			<!--Magic registry keys-->
-			<TargetObject condition="begin with">HKLM\Software\Classes\CLSID\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}\</TargetObject> <!--Windows: Thumbnail cache autostart [ http://blog.trendmicro.com/trendlabs-security-intelligence/poweliks-levels-up-with-new-autostart-mechanism/ ] -->
-			<TargetObject condition="begin with">HKLM\Software\Classes\WOW6432Node\CLSID\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}\</TargetObject> <!--Windows: Thumbnail cache autostart [ http://blog.trendmicro.com/trendlabs-security-intelligence/poweliks-levels-up-with-new-autostart-mechanism/ ] -->
-			<TargetObject condition="begin with">HKLM\Software\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\</TargetObject> <!--Windows: DirectX instances-->
-			<TargetObject condition="begin with">HKLM\Software\Classes\WOW6432Node\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\</TargetObject> <!--Windows: DirectX instances-->
-			<!--Install/Run artifacts-->
-			<TargetObject condition="end with">\UrlUpdateInfo</TargetObject> <!--Microsoft:ClickOnce: Source URL is stored in this value [ https://subt0x10.blogspot.com/2016/12/mimikatz-delivery-via-clickonce-with.html ] -->
-			<TargetObject condition="end with">\InstallSource</TargetObject> <!--Windows: Source folder for certain program and component installations-->
-			<TargetObject name="Alert,Sysinternals Tool Used" condition="end with">\EulaAccepted</TargetObject> <!--Sysinternals tool launched. Lots of useful abilities for attackers -->
-			<!--Antivirus tampering-->
-			<TargetObject name="T1089,Tamper-Defender" condition="end with">\DisableAntiSpyware</TargetObject> <!--Windows:Defender: State modified via registry-->
-			<TargetObject name="T1089,Tamper-Defender" condition="end with">\DisableAntiVirus</TargetObject> <!--Windows:Defender: State modified via registry-->
-			<TargetObject name="T1089,Tamper-Defender" condition="end with">\SpynetReporting</TargetObject> <!--Windows:Defender: State modified via registry-->
-			<TargetObject name="T1089,Tamper-Defender" condition="end with">DisableRealtimeMonitoring</TargetObject> <!--Windows:Defender: State modified via registry-->
-			<TargetObject name="T1089,Tamper-Defender" condition="end with">\SubmitSamplesConsent</TargetObject> <!--Windows:Defender: State modified via registry-->
-			<TargetObject name="T1089,Tamper-Defender" condition="begin with">HKLM\Software\Microsoft\Windows Defender\Exclusions</TargetObject> <!--Windows:Defender: State modified via registry-->
-			<!--Windows UAC tampering-->
-			<TargetObject name="T1088" condition="end with">HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA</TargetObject> <!--Detect: UAC Tampering | Credit @ion-storm -->
-			<TargetObject name="T1088" condition="end with">HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy</TargetObject> <!--Detect: UAC Tampering | Credit @ion-storm -->
-			<!--Microsoft Security Center tampering | Credit @ion-storm -->
-			<TargetObject name="T1089,Tamper-SecCenter" condition="end with">HKLM\Software\Microsoft\Security Center\</TargetObject> <!-- [ https://attack.mitre.org/wiki/Technique/T1089 ] -->
-			<TargetObject name="T1089,Tamper-SecCenter" condition="end with">SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth</TargetObject> <!--Windows:Security Center: Malware sometimes disables [ https://blog.avast.com/2013/08/12/your-documents-are-corrupted-from-image-to-an-information-stealing-trojan/ ] -->
-			<!--Windows application compatibility-->
-			<TargetObject name="T1138,AppCompatShim" condition="begin with">HKLM\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom</TargetObject> <!--Windows: AppCompat [ https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html ] -->
-			<TargetObject name="T1138,AppCompatShim" condition="begin with">HKLM\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB</TargetObject> <!--Windows: AppCompat [ https://attack.mitre.org/wiki/Technique/T1138 ] -->
-			<TargetObject condition="contains">VirtualStore</TargetObject> <!--Windows: Registry virtualization, something's wrong if it's in use [ https://msdn.microsoft.com/en-us/library/windows/desktop/aa965884(v=vs.85).aspx ] -->
-			<!--Windows internals integrity monitoring-->
-			<TargetObject name="T1183,IFEO" condition="begin with">HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\</TargetObject> <!--Windows: Malware likes changing IFEO, like adding Debugger to disable antivirus EXE-->
-			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\WINEVT\</TargetObject> <!--Windows: Event log system integrity and ACLs-->
-			<TargetObject name="Tamper-Safemode" condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Safeboot\</TargetObject> <!--Windows: Services approved to load in safe mode. Almost nothing should ever modify this.-->
-			<TargetObject name="Tamper-Winlogon" condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\</TargetObject> <!--Windows: Providers notified by WinLogon-->
-			<TargetObject name="Context,DeviceConnectedOrUpdated" condition="end with">\FriendlyName</TargetObject> <!--Windows: New devices connected and remembered-->
-			<TargetObject name="Context,MsiInstallerStarted" condition="is">HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default)</TargetObject> <!--Windows: See when WindowsInstaller is engaged, useful for timeline matching with other events-->
-			<TargetObject name="Tamper-Tracing" condition="begin with">HKLM\Software\Microsoft\Tracing\RASAPI32</TargetObject> <!--Windows: Malware sometimes disables tracing to obfuscate tracks-->
-			<TargetObject name="Context,ProcessAccessedPrivateResource" condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\</TargetObject> <!-- Windows: Win10 tracks when and what process uses webcam/microphone/location etc [ https://medium.com/@7a616368/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072 ] -->
-			<!--Windows inventory events-->
-			<TargetObject name="InvDB-Path" condition="end with">\LowerCaseLongPath</TargetObject> <!-- [ https://binaryforay.blogspot.com/2017/10/amcache-still-rules-everything-around.html ] -->
-			<TargetObject name="InvDB-Pub" condition="end with">\Publisher</TargetObject> <!-- [ https://binaryforay.blogspot.com/2017/10/amcache-still-rules-everything-around.html ] -->
-			<TargetObject name="InvDB-Ver" condition="end with">\BinProductVersion</TargetObject> <!-- [ https://docs.microsoft.com/en-us/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709 ] -->
-			<TargetObject name="InvDB-DriverVer" condition="end with">\DriverVersion</TargetObject> <!-- [ https://df-stream.com/2015/02/leveraging-devicecontainers-key/ ] -->
-			<TargetObject name="InvDB-DriverVer" condition="end with">\DriverVerVersion</TargetObject> <!-- [ https://df-stream.com/2015/02/leveraging-devicecontainers-key/ ] -->
-			<TargetObject name="InvDB-CompileTimeClaim" condition="end with">\LinkDate</TargetObject> <!-- Compile time of EXE, may not be reliable [ https://en.wikipedia.org/wiki/Link_time ] -->
-			<TargetObject name="InvDB" condition="contains">Compatibility Assistant\Store\</TargetObject> <!-- Inventory -->
-			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports</TargetObject> <!--Microsoft:Windows: Printer port changes as used in CVE-2020-1048 [ https://windows-internals.com/printdemon-cve-2020-1048/ ] -->
-			<TargetObject condition="contains">\Keyboard Layout\Preload</TargetObject> <!--Microsoft:Windows: Keyboard layout loaded into user session [ https://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index ] -->
-			<TargetObject condition="contains">\Keyboard Layout\Substitutes</TargetObject> <!--Microsoft:Windows: Keyboard layout loaded into user session [ https://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index ] -->
-			<!--Suspicious sources-->
-			<Image name="Suspicious,ImageBeginWithBackslash" condition="end with">regedit.exe</Image> <!--Users and helpdesk staff making system modifications -->
-			<Image name="Suspicious,ImageBeginWithBackslash" condition="begin with">\</Image> <!--Devices and VSC shouldn't be executing changes | Credit: @SBousseaden @ionstorm @neu5ron @PerchedSystems [ https://twitter.com/SwiftOnSecurity/status/1133167323991486464 ] -->
-			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\</TargetObject> <!--Microsoft:Windows:UAC: Detect malware changes to UAC prompt level-->
-			<TargetObject condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\</TargetObject> <!--Microsoft:Defender: Detect changes to Defender administrative settings to monitor for disablement-->
-			<!--Windows trust architecture monitoring | Credit: @mattifestation-->
-			<!--ADDITIONAL REFERENCE: https://specterops.io/assets/resources/SpecterOps_Subverting_Trust_in_Windows.pdf-->
-			<TargetObject condition="contains">Microsoft\Cryptography\OID\</TargetObject> <!-- Important trust registry values to monitor -->
-			<TargetObject condition="contains">WOW6432Node\Microsoft\Cryptography\OID\</TargetObject> <!-- Important trust registry values to monitor -->
-			<TargetObject condition="contains">Microsoft\Cryptography\Providers\Trust\</TargetObject> <!-- Important trust registry values to monitor -->
-			<TargetObject condition="contains">WOW6432Node\Microsoft\Cryptography\Providers\Trust\</TargetObject> <!-- Important trust registry values to monitor -->
-			<TargetObject condition="contains">Control\Print\Environments\Windows x64\Drivers</TargetObject> <!-- PrinterNightmare coverage -->
-		</RegistryEvent>
-	</RuleGroup>
+
 
 	<RuleGroup name="" groupRelation="or">
 		<RegistryEvent onmatch="exclude">

From ca54b563654572672078defb5599b3c1e483a6c2 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Sat, 24 Jul 2021 10:10:31 +0200
Subject: [PATCH 008/149] fix: accidental removal of section

---
 sysmonconfig-export.xml | 161 +++++++++++++++++++++++++++++++++++++++-
 1 file changed, 159 insertions(+), 2 deletions(-)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 47fdb8e2..21933331 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -357,7 +357,6 @@
 			<DestinationPort name="WinRM" condition="is">5985</DestinationPort> <!-- WinRM protocol used for remote connections to execute commands -->
 			<DestinationPort name="WinRM over HTTPS" condition="is">5986</DestinationPort> <!-- WinRM over HTTPS when set up in an environment can be used for remote connections to execute commands -->
 			<DestinationPort name="Alert,Metasploit" condition="is">4444</DestinationPort> <!-- Default Metasploit port -->
-			<User name="EFSRPC" condition="contains">NT AUTHOR</User> <!-- Default EFSRPC port -->
 			<!--Ports: Proxy-->
 			<DestinationPort name="Proxy" condition="is">1080</DestinationPort> <!--Socks proxy port | Credit @ion-storm-->
 			<DestinationPort name="Proxy" condition="is">3128</DestinationPort> <!--Socks proxy port | Credit @ion-storm-->
@@ -600,7 +599,165 @@
 								For example, most COM hijacking in CLSID's across the registry is covered by a single rule monitoring a InProcServer32 wildcard-->
 
 		<!--DATA: EventType, UtcTime, ProcessGuid, ProcessId, Image, TargetObject, Details (can't filter on), NewName (can't filter on)-->
-
+	<RuleGroup name="" groupRelation="or">
+		<RegistryEvent onmatch="include">
+			<!--Autorun or Startups-->
+				<!--ADDITIONAL REFERENCE: [ http://www.ghacks.net/2016/06/04/windows-automatic-startup-locations/ ] -->
+				<!--ADDITIONAL REFERENCE: [ https://view.officeapps.live.com/op/view.aspx?src=https://arsenalrecon.com/downloads/resources/Registry_Keys_Related_to_Autorun.ods ] -->
+				<!--ADDITIONAL REFERENCE: [ http://www.silentrunners.org/launchpoints.html ] -->
+				<!--ADDITIONAL REFERENCE: [ https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2 ] -->
+				<!--ADDITIONAL REFERENCE: [ https://web.archive.org/web/20200116001643/http://scholarworks.rit.edu/cgi/viewcontent.cgi?article=1533&context=theses | Understanding malware autostart techniques - Matthew Gottlieb ] -->
+			<TargetObject name="T1562.002" condition="end with">\MiniNT</TargetObject> <!--Windows: Disable eventlog by acting like WinPE [https://twitter.com/0gtweet/status/1182516740955226112]  -->
+			<TargetObject name="T1060,RunKey" condition="contains">CurrentVersion\Run</TargetObject> <!--Windows: Wildcard for Run keys, including RunOnce, RunOnceEx, RunServices, RunServicesOnce [Also covers terminal server] -->
+			<TargetObject name="T1060,RunPolicy" condition="contains">Policies\Explorer\Run</TargetObject> <!--Windows: Alternate runs keys | Credit @ion-storm-->
+			<TargetObject name="T1484" condition="contains">Group Policy\Scripts</TargetObject> <!--Windows: Group policy scripts-->
+			<TargetObject name="T1484" condition="contains">Windows\System\Scripts</TargetObject> <!--Windows: Wildcard for Logon, Loggoff, Shutdown-->
+			<TargetObject name="T1060" condition="contains">CurrentVersion\Windows\Load</TargetObject> <!--Windows: [ https://msdn.microsoft.com/en-us/library/jj874148.aspx ] -->
+			<TargetObject name="T1060" condition="contains">CurrentVersion\Windows\Run</TargetObject> <!--Windows: [ https://msdn.microsoft.com/en-us/library/jj874148.aspx ] -->
+			<TargetObject name="T1060" condition="contains">CurrentVersion\Winlogon\Shell</TargetObject> <!--Windows: [ https://msdn.microsoft.com/en-us/library/ms838576(v=winembedded.5).aspx ] -->
+			<TargetObject name="T1060" condition="contains">CurrentVersion\Winlogon\System</TargetObject> <!--Windows [ https://www.exterminate-it.com/malpedia/regvals/zlob-dns-changer/118 ] -->
+			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify</TargetObject> <!--Windows: Autorun location [ https://attack.mitre.org/wiki/Technique/T1004 ] [ https://www.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order ] -->
+			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell</TargetObject> <!--Windows: [ https://technet.microsoft.com/en-us/library/ee851671.aspx ] -->
+			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit</TargetObject> <!--Windows: Autorun location [ https://www.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order ] -->
+			<TargetObject condition="begin with">HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32</TargetObject> <!--Windows: Legacy driver loading | Credit @ion-storm -->
+			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute</TargetObject> <!--Windows: Autorun | Credit @ion-storm | [ https://www.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order ] -->
+			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug</TargetObject> <!--Windows: Automatic program crash debug program [ https://www.symantec.com/security_response/writeup.jsp?docid=2007-050712-5453-99&tabid=2 ] -->
+			<TargetObject condition="contains">UserInitMprLogonScript</TargetObject> <!--Windows: Legacy logon script environment variable [ http://www.hexacorn.com/blog/2014/11/14/beyond-good-ol-run-key-part-18/ ] -->
+			<TargetObject name="T1112,ChangeStartupFolderPath" condition="end with">user shell folders\startup</TargetObject> <!--Monitor changes to Startup folder location for monitoring evasion | Credit @SBousseaden-->
+			<!--Services-->
+			<TargetObject name="T1031,T1050" condition="end with">\ServiceDll</TargetObject> <!--Windows: Points to a service's DLL [ https://blog.cylance.com/windows-registry-persistence-part-1-introduction-attack-phases-and-windows-services ] -->
+			<TargetObject name="T1031,T1050" condition="end with">\ServiceManifest</TargetObject> <!--Windows: Manifest pointing to service's DLL [ https://www.geoffchappell.com/studies/windows/win32/services/svchost/index.htm ] -->
+			<TargetObject name="T1031,T1050" condition="end with">\ImagePath</TargetObject> <!--Windows: Points to a service's EXE [ https://attack.mitre.org/wiki/Technique/T1050 ] -->
+			<TargetObject name="T1031,T1050" condition="end with">\Start</TargetObject> <!--Windows: Services start mode changes (Disabled, Automatically, Manual)-->
+			<!--RDP-->
+			<TargetObject name="RDP port change" condition="end with">Control\Terminal Server\WinStations\RDP-Tcp\PortNumber</TargetObject> <!--Windows: RDP port change under Control [ https://blog.menasec.net/2019/02/of-rdp-hijacking-part1-remote-desktop.html ]-->
+			<TargetObject name="RDP port change" condition="end with">Control\Terminal Server\fSingleSessionPerUser</TargetObject> <!--Windows: Allow same user to have mutliple RDP sessions, to hide from admin being impersonated-->
+			<TargetObject name="ModifyRemoteDesktopState" condition="end with">fDenyTSConnections</TargetObject> <!--Windows: Attacker turning on RDP-->
+			<TargetObject condition="end with">LastLoggedOnUser</TargetObject> <!--Windows: Changing last-logged in user-->
+			<TargetObject name="ModifyRemoteDesktopPort" condition="end with">RDP-tcp\PortNumber</TargetObject> <!--Windows: Changing RDP port to evade IDS-->
+			<TargetObject condition="end with">Services\PortProxy\v4tov4</TargetObject> <!--Windows: Changing RDP port to evade IDS-->
+			<!--CLSID launch commands and Default File Association changes-->
+			<TargetObject name="T1042" condition="contains">\command\</TargetObject> <!--Windows: Sensitive sub-key under file associations and CLSID that map to launch command-->
+			<TargetObject name="T1122" condition="contains">\ddeexec\</TargetObject> <!--Windows: Sensitive sub-key under file associations and CLSID that map to launch command-->
+			<TargetObject name="T1122" condition="contains">{86C86720-42A0-1069-A2E8-08002B30309D}</TargetObject> <!--Windows: Tooltip handler-->
+			<TargetObject name="T1042" condition="contains">exefile</TargetObject> <!--Windows Executable handler, to log any changes not already monitored-->
+			<!--Windows COM-->
+			<TargetObject name="T1122" condition="end with">\InprocServer32\(Default)</TargetObject> <!--Windows:COM Object Hijacking [ https://blog.gdatasoftware.com/2014/10/23941-com-object-hijacking-the-discreet-way-of-persistence ] | Credit @ion-storm -->
+			<!--Windows shell visual modifications used by malware-->
+			<TargetObject name="T1158" condition="end with">\Hidden</TargetObject> <!--Windows:Explorer: Some types of malware try to hide their hidden system files from the user, good signal event -->
+			<TargetObject name="T1158" condition="end with">\ShowSuperHidden</TargetObject> <!--Windows:Explorer: Some types of malware try to hide their hidden system files from the user, good signal event [ Example: https://www.symantec.com/security_response/writeup.jsp?docid=2007-061811-4341-99&tabid=2 ] -->
+			<TargetObject name="T1158" condition="end with">\HideFileExt</TargetObject> <!--Windows:Explorer: Some malware hides file extensions to make diagnosis/disinfection more daunting to novice users -->
+			<!--Windows shell hijack and modifications-->
+			<TargetObject condition="contains">Classes\*\</TargetObject> <!--Windows:Explorer: [ http://www.silentrunners.org/launchpoints.html ] -->
+			<TargetObject condition="contains">Classes\AllFilesystemObjects\</TargetObject> <!--Windows:Explorer: [ http://www.silentrunners.org/launchpoints.html ] -->
+			<TargetObject condition="contains">Classes\Directory\</TargetObject> <!--Windows:Explorer: [ https://stackoverflow.com/questions/1323663/windows-shell-context-menu-option ] -->
+			<TargetObject condition="contains">Classes\Drive\</TargetObject> <!--Windows:Explorer: [ https://stackoverflow.com/questions/1323663/windows-shell-context-menu-option ] -->
+			<TargetObject condition="contains">Classes\Folder\</TargetObject> <!--Windows:Explorer: ContextMenuHandlers, DragDropHandlers, CopyHookHandlers, [ https://stackoverflow.com/questions/1323663/windows-shell-context-menu-option ] -->
+			<TargetObject condition="contains">Classes\PROTOCOLS\</TargetObject> <!--Windows:Explorer: Protocol handlers-->
+			<TargetObject condition="contains">ContextMenuHandlers\</TargetObject> <!--Windows: [ http://oalabs.openanalysis.net/2015/06/04/malware-persistence-hkey_current_user-shell-extension-handlers/ ] -->
+			<TargetObject condition="contains">CurrentVersion\Shell</TargetObject> <!--Windows: Shell Folders, ShellExecuteHooks, ShellIconOverloadIdentifers, ShellServiceObjects, ShellServiceObjectDelayLoad [ http://oalabs.openanalysis.net/2015/06/04/malware-persistence-hkey_current_user-shell-extension-handlers/ ] -->
+			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks</TargetObject> <!--Windows: ShellExecuteHooks-->
+			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellServiceObjectDelayLoad</TargetObject> <!--Windows: ShellExecuteHooks-->
+			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellIconOverlayIdentifiers</TargetObject> <!--Windows: ShellExecuteHooks-->
+			<!--AppPaths hijacking-->
+			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\</TargetObject> <!--Windows: Credit to @Hexacorn [ http://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/ ] -->
+			<!--Terminal service boobytrap-->
+			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram</TargetObject> <!--Windows:RDP: Note other Terminal Server run keys are handled by another wildcard already-->
+			<!--Group Policy integrity-->
+			<TargetObject name="T1484" condition="begin with">HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\</TargetObject> <!--Windows: Group Policy internally uses a plug-in architecture that nothing should be modifying-->
+			<!--Winsock and Winsock2-->
+			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Services\WinSock</TargetObject> <!--Windows: Wildcard, includes Winsock and Winsock2-->
+			<TargetObject condition="end with">\ProxyServer</TargetObject> <!--Windows: System and user proxy server-->
+			<!--Credential providers-->
+			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider</TargetObject> <!--Wildcard, includes Credential Providers and Credential Provider Filters-->
+			<TargetObject name="T1101" condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\</TargetObject> <!-- [ https://attack.mitre.org/wiki/Technique/T1131 ] [ https://attack.mitre.org/wiki/Technique/T1101 ] -->
+			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\</TargetObject> <!--Windows: Changes to WDigest-UseLogonCredential for password scraping [ https://www.trustedsec.com/april-2015/dumping-wdigest-creds-with-meterpreter-mimikatzkiwi-in-windows-8-1/ ] -->
+			<TargetObject condition="begin with">HKLM\Software\Microsoft\Netsh</TargetObject> <!--Windows: Netsh helper DLL [ https://attack.mitre.org/wiki/Technique/T1128 ] -->
+			<TargetObject condition="contains">Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable</TargetObject> <!--Windows: Malware often disables a web proxy for 2nd stage downloads -->
+			<!--Networking-->
+			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\</TargetObject> <!--Windows: Order of network providers that are checked to connect to destination [ https://www.malwarearchaeology.com/cheat-sheets ] -->
+			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles</TargetObject> <!--Windows: | Credit @ion-storm -->
+			<TargetObject name="T1089" condition="end with">\EnableFirewall</TargetObject> <!--Windows: Monitor for firewall disablement, all firewall profiles [ https://attack.mitre.org/wiki/Technique/T1089 ] -->
+			<TargetObject name="T1089" condition="end with">\DoNotAllowExceptions</TargetObject> <!--Windows: Monitor for firewall disablement, all firewall profiles [ https://attack.mitre.org/wiki/Technique/T1089 ] -->
+			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List</TargetObject> <!--Windows Firewall authorized applications for all networks| Credit @ion-storm -->
+			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List</TargetObject> <!--Windows Firewall authorized applications for domain networks -->
+			<!--DLLs that get injected into every process at launch-->
+			<TargetObject name="T1103" condition="begin with">HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\</TargetObject> <!--Windows: Feature disabled by default [ https://attack.mitre.org/wiki/Technique/T1103 ] -->
+			<TargetObject name="T1103" condition="begin with">HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\</TargetObject> <!--Windows: Feature disabled by default [ https://attack.mitre.org/wiki/Technique/T1103 ] -->
+			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\</TargetObject> <!--Windows: Credit to @Hexacorn [ http://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/ ] [ https://blog.comodo.com/malware/trojware-win32-trojanspy-volisk-a/ ] -->
+			<!--Office-->
+			<TargetObject name="T1137" condition="contains">Microsoft\Office\Outlook\Addins\</TargetObject> <!--Microsoft:Office: Outlook add-ins, access to sensitive data and often cause issues-->
+			<TargetObject name="T1137" condition="contains">Office Test\</TargetObject> <!-- Microsoft:Office: Persistence method [ http://www.hexacorn.com/blog/2014/04/16/beyond-good-ol-run-key-part-10/ ] | Credit @Hexacorn -->
+			<TargetObject name="Suspicious,ChangedURLOutlook" condition="contains all">\Software\Microsoft\Office\;\Outlook\WebView\;URL</TargetObject> <!-- The URL shouldn't be changed all that often and could enable persistance for hackers | @humpelpum [ https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=70 ]-->
+			<TargetObject name="Context,ProtectedModeExitOrMacrosUsed" condition="contains">Security\Trusted Documents\TrustRecords</TargetObject> <!--Microsoft:Office: Monitor when "Enable editing" or "Enable macros" is used | Credit @OutflankNL | [ https://outflank.nl/blog/2018/01/16/hunting-for-evil-detect-macros-being-executed/ ] -->
+			<!--IE-->
+			<TargetObject name="T1176" condition="contains">Internet Explorer\Toolbar\</TargetObject> <!--Microsoft:InternetExplorer: Machine and user [ Example: https://www.exterminate-it.com/malpedia/remove-mywebsearch ] -->
+			<TargetObject name="T1176" condition="contains">Internet Explorer\Extensions\</TargetObject> <!--Microsoft:InternetExplorer: Machine and user [ Example: https://www.exterminate-it.com/malpedia/remove-mywebsearch ] -->
+			<TargetObject name="T1176" condition="contains">Browser Helper Objects\</TargetObject> <!--Microsoft:InternetExplorer: Machine and user [ https://msdn.microsoft.com/en-us/library/bb250436(v=vs.85).aspx ] -->
+			<TargetObject condition="end with">\DisableSecuritySettingsCheck</TargetObject>
+			<TargetObject condition="end with">\3\1206</TargetObject> <!--Microsoft:InternetExplorer: Malware sometimes assures scripting is on in Internet Zone [ https://support.microsoft.com/en-us/help/182569/internet-explorer-security-zones-registry-entries-for-advanced-users ] -->
+			<TargetObject condition="end with">\3\2500</TargetObject> <!--Microsoft:InternetExplorer: Malware sometimes disables Protected Mode in Internet Zone [ https://blog.avast.com/2013/08/12/your-documents-are-corrupted-from-image-to-an-information-stealing-trojan/ ] -->
+			<TargetObject condition="end with">\3\1809</TargetObject> <!--Microsoft:InternetExplorer: Malware sometimes disables Pop-up Blocker in Internet Zone [ https://support.microsoft.com/en-us/help/182569/internet-explorer-security-zones-registry-entries-for-advanced-users ] -->
+			<!--Magic registry keys-->
+			<TargetObject condition="begin with">HKLM\Software\Classes\CLSID\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}\</TargetObject> <!--Windows: Thumbnail cache autostart [ http://blog.trendmicro.com/trendlabs-security-intelligence/poweliks-levels-up-with-new-autostart-mechanism/ ] -->
+			<TargetObject condition="begin with">HKLM\Software\Classes\WOW6432Node\CLSID\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}\</TargetObject> <!--Windows: Thumbnail cache autostart [ http://blog.trendmicro.com/trendlabs-security-intelligence/poweliks-levels-up-with-new-autostart-mechanism/ ] -->
+			<TargetObject condition="begin with">HKLM\Software\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\</TargetObject> <!--Windows: DirectX instances-->
+			<TargetObject condition="begin with">HKLM\Software\Classes\WOW6432Node\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\</TargetObject> <!--Windows: DirectX instances-->
+			<!--Install/Run artifacts-->
+			<TargetObject condition="end with">\UrlUpdateInfo</TargetObject> <!--Microsoft:ClickOnce: Source URL is stored in this value [ https://subt0x10.blogspot.com/2016/12/mimikatz-delivery-via-clickonce-with.html ] -->
+			<TargetObject condition="end with">\InstallSource</TargetObject> <!--Windows: Source folder for certain program and component installations-->
+			<TargetObject name="Alert,Sysinternals Tool Used" condition="end with">\EulaAccepted</TargetObject> <!--Sysinternals tool launched. Lots of useful abilities for attackers -->
+			<!--Antivirus tampering-->
+			<TargetObject name="T1089,Tamper-Defender" condition="end with">\DisableAntiSpyware</TargetObject> <!--Windows:Defender: State modified via registry-->
+			<TargetObject name="T1089,Tamper-Defender" condition="end with">\DisableAntiVirus</TargetObject> <!--Windows:Defender: State modified via registry-->
+			<TargetObject name="T1089,Tamper-Defender" condition="end with">\SpynetReporting</TargetObject> <!--Windows:Defender: State modified via registry-->
+			<TargetObject name="T1089,Tamper-Defender" condition="end with">DisableRealtimeMonitoring</TargetObject> <!--Windows:Defender: State modified via registry-->
+			<TargetObject name="T1089,Tamper-Defender" condition="end with">\SubmitSamplesConsent</TargetObject> <!--Windows:Defender: State modified via registry-->
+			<TargetObject name="T1089,Tamper-Defender" condition="begin with">HKLM\Software\Microsoft\Windows Defender\Exclusions</TargetObject> <!--Windows:Defender: State modified via registry-->
+			<!--Windows UAC tampering-->
+			<TargetObject name="T1088" condition="end with">HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA</TargetObject> <!--Detect: UAC Tampering | Credit @ion-storm -->
+			<TargetObject name="T1088" condition="end with">HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy</TargetObject> <!--Detect: UAC Tampering | Credit @ion-storm -->
+			<!--Microsoft Security Center tampering | Credit @ion-storm -->
+			<TargetObject name="T1089,Tamper-SecCenter" condition="end with">HKLM\Software\Microsoft\Security Center\</TargetObject> <!-- [ https://attack.mitre.org/wiki/Technique/T1089 ] -->
+			<TargetObject name="T1089,Tamper-SecCenter" condition="end with">SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth</TargetObject> <!--Windows:Security Center: Malware sometimes disables [ https://blog.avast.com/2013/08/12/your-documents-are-corrupted-from-image-to-an-information-stealing-trojan/ ] -->
+			<!--Windows application compatibility-->
+			<TargetObject name="T1138,AppCompatShim" condition="begin with">HKLM\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom</TargetObject> <!--Windows: AppCompat [ https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html ] -->
+			<TargetObject name="T1138,AppCompatShim" condition="begin with">HKLM\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB</TargetObject> <!--Windows: AppCompat [ https://attack.mitre.org/wiki/Technique/T1138 ] -->
+			<TargetObject condition="contains">VirtualStore</TargetObject> <!--Windows: Registry virtualization, something's wrong if it's in use [ https://msdn.microsoft.com/en-us/library/windows/desktop/aa965884(v=vs.85).aspx ] -->
+			<!--Windows internals integrity monitoring-->
+			<TargetObject name="T1183,IFEO" condition="begin with">HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\</TargetObject> <!--Windows: Malware likes changing IFEO, like adding Debugger to disable antivirus EXE-->
+			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\WINEVT\</TargetObject> <!--Windows: Event log system integrity and ACLs-->
+			<TargetObject name="Tamper-Safemode" condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Safeboot\</TargetObject> <!--Windows: Services approved to load in safe mode. Almost nothing should ever modify this.-->
+			<TargetObject name="Tamper-Winlogon" condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\</TargetObject> <!--Windows: Providers notified by WinLogon-->
+			<TargetObject name="Context,DeviceConnectedOrUpdated" condition="end with">\FriendlyName</TargetObject> <!--Windows: New devices connected and remembered-->
+			<TargetObject name="Context,MsiInstallerStarted" condition="is">HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default)</TargetObject> <!--Windows: See when WindowsInstaller is engaged, useful for timeline matching with other events-->
+			<TargetObject name="Tamper-Tracing" condition="begin with">HKLM\Software\Microsoft\Tracing\RASAPI32</TargetObject> <!--Windows: Malware sometimes disables tracing to obfuscate tracks-->
+			<TargetObject name="Context,ProcessAccessedPrivateResource" condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\</TargetObject> <!-- Windows: Win10 tracks when and what process uses webcam/microphone/location etc [ https://medium.com/@7a616368/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072 ] -->
+			<!--Windows inventory events-->
+			<TargetObject name="InvDB-Path" condition="end with">\LowerCaseLongPath</TargetObject> <!-- [ https://binaryforay.blogspot.com/2017/10/amcache-still-rules-everything-around.html ] -->
+			<TargetObject name="InvDB-Pub" condition="end with">\Publisher</TargetObject> <!-- [ https://binaryforay.blogspot.com/2017/10/amcache-still-rules-everything-around.html ] -->
+			<TargetObject name="InvDB-Ver" condition="end with">\BinProductVersion</TargetObject> <!-- [ https://docs.microsoft.com/en-us/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709 ] -->
+			<TargetObject name="InvDB-DriverVer" condition="end with">\DriverVersion</TargetObject> <!-- [ https://df-stream.com/2015/02/leveraging-devicecontainers-key/ ] -->
+			<TargetObject name="InvDB-DriverVer" condition="end with">\DriverVerVersion</TargetObject> <!-- [ https://df-stream.com/2015/02/leveraging-devicecontainers-key/ ] -->
+			<TargetObject name="InvDB-CompileTimeClaim" condition="end with">\LinkDate</TargetObject> <!-- Compile time of EXE, may not be reliable [ https://en.wikipedia.org/wiki/Link_time ] -->
+			<TargetObject name="InvDB" condition="contains">Compatibility Assistant\Store\</TargetObject> <!-- Inventory -->
+			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports</TargetObject> <!--Microsoft:Windows: Printer port changes as used in CVE-2020-1048 [ https://windows-internals.com/printdemon-cve-2020-1048/ ] -->
+			<TargetObject condition="contains">\Keyboard Layout\Preload</TargetObject> <!--Microsoft:Windows: Keyboard layout loaded into user session [ https://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index ] -->
+			<TargetObject condition="contains">\Keyboard Layout\Substitutes</TargetObject> <!--Microsoft:Windows: Keyboard layout loaded into user session [ https://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index ] -->
+			<!--Suspicious sources-->
+			<Image name="Suspicious,ImageBeginWithBackslash" condition="end with">regedit.exe</Image> <!--Users and helpdesk staff making system modifications -->
+			<Image name="Suspicious,ImageBeginWithBackslash" condition="begin with">\</Image> <!--Devices and VSC shouldn't be executing changes | Credit: @SBousseaden @ionstorm @neu5ron @PerchedSystems [ https://twitter.com/SwiftOnSecurity/status/1133167323991486464 ] -->
+			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\</TargetObject> <!--Microsoft:Windows:UAC: Detect malware changes to UAC prompt level-->
+			<TargetObject condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\</TargetObject> <!--Microsoft:Defender: Detect changes to Defender administrative settings to monitor for disablement-->
+			<!--Windows trust architecture monitoring | Credit: @mattifestation-->
+			<!--ADDITIONAL REFERENCE: https://specterops.io/assets/resources/SpecterOps_Subverting_Trust_in_Windows.pdf-->
+			<TargetObject condition="contains">Microsoft\Cryptography\OID\</TargetObject> <!-- Important trust registry values to monitor -->
+			<TargetObject condition="contains">WOW6432Node\Microsoft\Cryptography\OID\</TargetObject> <!-- Important trust registry values to monitor -->
+			<TargetObject condition="contains">Microsoft\Cryptography\Providers\Trust\</TargetObject> <!-- Important trust registry values to monitor -->
+			<TargetObject condition="contains">WOW6432Node\Microsoft\Cryptography\Providers\Trust\</TargetObject> <!-- Important trust registry values to monitor -->
+			<TargetObject condition="contains">Control\Print\Environments\Windows x64\Drivers</TargetObject> <!-- PrinterNightmare coverage -->
+		</RegistryEvent>
+	</RuleGroup>
 
 	<RuleGroup name="" groupRelation="or">
 		<RegistryEvent onmatch="exclude">

From 876166b3ebd77ca76b55f2f74c9a98b92e644f1e Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Sat, 24 Jul 2021 10:15:01 +0200
Subject: [PATCH 009/149] filter: OneDrive

---
 sysmonconfig-export.xml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 21933331..229902f4 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -383,6 +383,8 @@
 			<!--Section: Loopback Addresses-->
 			<DestinationIp condition="is">127.0.0.1</DestinationIp> <!--Credit @ITProPaul-->
 			<DestinationIp condition="begin with">fe80:0:0:0</DestinationIp> <!--Credit @ITProPaul-->
+			<!-- OneDrive -->
+			<Image condition="end with">\AppData\Local\Microsoft\OneDrive\OneDrive.exe</Image> <!--Microsoft: OneDrive-->
 		</NetworkConnect>
 	</RuleGroup>
 

From 4aa2ad4f7fcd100c5f6f1d9f21a4af11e7e01c75 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Sat, 24 Jul 2021 16:13:52 +0200
Subject: [PATCH 010/149] SeriousSAM CS Pattern

---
 sysmonconfig-export.xml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 229902f4..8922dd80 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -555,6 +555,7 @@
 			<TargetFilename condition="contains">\SAM-haxx</TargetFilename> <!-- Default output of HiveNightmare / SeriousSAM tools -->
 			<TargetFilename condition="contains">\Sam.save</TargetFilename> <!-- Default output of HiveNightmare / SeriousSAM tools -->
 			<TargetFilename condition="contains">\hive_sam_</TargetFilename> <!-- Default output of HiveNightmare / SeriousSAM tools -->
+			<TargetFilename condition="is">C:\windows\temp\sam</TargetFilename> <!-- Default output of HiveNightmare / SeriousSAM tools -->
 			<TargetFilename condition="begin with">C:\Windows\System32\spool\drivers\x64</TargetFilename> <!-- PrinterNight -->
 		</FileCreate>
 	</RuleGroup>

From fd602c9fe17c11a3cb9de7db1f66744df2b194e7 Mon Sep 17 00:00:00 2001
From: humpalum <humpalum@users.noreply.github.com>
Date: Mon, 26 Jul 2021 09:33:39 +0200
Subject: [PATCH 011/149] First CI workflow draft

Added a workflow that installs sysmon with the config and fails when sysmon has an error
---
 .github/workflows/main.yml | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 .github/workflows/main.yml

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
new file mode 100644
index 00000000..e6c5dadf
--- /dev/null
+++ b/.github/workflows/main.yml
@@ -0,0 +1,27 @@
+name: CI
+
+on:
+  # Trigger the workflow on push or pull requests, but only for the
+  # main branch
+  push:
+    branches:
+    - main
+  pull_request:
+    branches:
+    - main
+  workflow_dispatch:
+  
+jobs:
+  msbuild:
+    runs-on: 'windows-latest'
+    steps:
+    - name: Checkout open-sysmon-conf
+      uses: actions/checkout@v2
+    
+    - name: Download Sysmon 
+      run: Invoke-WebRequest http://live.sysinternals.com/tools/sysmon.exe -OutFile .\sysmon.exe
+      shell: powershell
+    
+    - name: Run Sysmon 
+      run: .\sysmon.exe -accepteula -i sysmonconfig-export.xml
+      shell: powershell

From 7b98675d16c1c4363f13f0dc22ef69ba047acf30 Mon Sep 17 00:00:00 2001
From: humpalum <humpalum@users.noreply.github.com>
Date: Mon, 26 Jul 2021 09:35:09 +0200
Subject: [PATCH 012/149] fix: renamed main to master

---
 .github/workflows/main.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index e6c5dadf..b7b1db16 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -5,10 +5,10 @@ on:
   # main branch
   push:
     branches:
-    - main
+    - master
   pull_request:
     branches:
-    - main
+    - master
   workflow_dispatch:
   
 jobs:

From fdb53963ed13e03c7b9dbbdb4ecfabffbc84de42 Mon Sep 17 00:00:00 2001
From: humpalum <humpalum@users.noreply.github.com>
Date: Mon, 26 Jul 2021 14:08:04 +0200
Subject: [PATCH 013/149] chore: Added Eventcount Check Job

---
 .github/workflows/main.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index b7b1db16..cb0e672d 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -25,3 +25,7 @@ jobs:
     - name: Run Sysmon 
       run: .\sysmon.exe -accepteula -i sysmonconfig-export.xml
       shell: powershell
+      
+    - name: Check Eventcount
+      run:  '$EventCount = 0 ;Get-WinEvent -ListLog * | where {$_.RecordCount -gt 0} | foreach{$_;$EventCount = $EventCount + $_.RecordCount}|Out-Null;"Eventcount: "+$EventCount; if ($EventCount -gt 56000){ Write-Output "Too many events"; $host.SetShouldExit(1)}'
+      shell: powershell

From 97b006c3b96aa83b7b1cc58d4f062700ac12970f Mon Sep 17 00:00:00 2001
From: humpalum <humpalum@users.noreply.github.com>
Date: Mon, 26 Jul 2021 16:02:04 +0200
Subject: [PATCH 014/149] chore: Added a simulated busy system

Also changed the numbers to allow up to about 5% of more events
---
 .github/workflows/main.yml | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index cb0e672d..9bc76fee 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -5,10 +5,10 @@ on:
   # main branch
   push:
     branches:
-    - master
+    - main
   pull_request:
     branches:
-    - master
+    - main
   workflow_dispatch:
   
 jobs:
@@ -27,5 +27,22 @@ jobs:
       shell: powershell
       
     - name: Check Eventcount
-      run:  '$EventCount = 0 ;Get-WinEvent -ListLog * | where {$_.RecordCount -gt 0} | foreach{$_;$EventCount = $EventCount + $_.RecordCount}|Out-Null;"Eventcount: "+$EventCount; if ($EventCount -gt 56000){ Write-Output "Too many events"; $host.SetShouldExit(1)}'
+      run:  '$EventCount = 0 ;Get-WinEvent -ListLog * | where {$_.RecordCount -gt 0} | foreach{$_;$EventCount = $EventCount + $_.RecordCount}|Out-Null;"Eventcount: "+$EventCount; if ($EventCount -gt 52500){ Write-Output "Too many events"; $host.SetShouldExit(1)}'
+      shell: powershell
+      
+  busySystem:
+    runs-on: 'windows-latest'
+    steps:
+    - name: Checkout open-sysmon-conf
+      uses: actions/checkout@v2
+    
+    - name: Download Sysmon 
+      run: Invoke-WebRequest http://live.sysinternals.com/tools/sysmon.exe -OutFile .\sysmon.exe
+      shell: powershell
+      
+    - name: Install some Choco Packages
+      run: choco install ninja adobereader googlechrome firefox jre8 notepadplusplus.install vlc python3 dotnetfx openssh winrar nodejs.install foxitreader autohotkey.portable putty.install skype ccleaner winlogbeat gimp
+    
+    - name: Check Eventcount Post Choco
+      run:  '$EventCount = 0 ;Get-WinEvent -ListLog * | where {$_.RecordCount -gt 0} | foreach{$_;$EventCount = $EventCount + $_.RecordCount}|Out-Null;"Eventcount: "+$EventCount; if ($EventCount -gt 54000){ Write-Output "Too many events"; $host.SetShouldExit(1)}'
       shell: powershell

From 3530138a5bfbd87207782cc8ea90e280f11f33d1 Mon Sep 17 00:00:00 2001
From: humpalum <humpalum@users.noreply.github.com>
Date: Mon, 26 Jul 2021 16:04:23 +0200
Subject: [PATCH 015/149] chore: Fixed Branchnames

---
 .github/workflows/main.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 9bc76fee..0696fa77 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -5,10 +5,10 @@ on:
   # main branch
   push:
     branches:
-    - main
+    - master
   pull_request:
     branches:
-    - main
+    - master
   workflow_dispatch:
   
 jobs:

From df4e131286e0e11d344a2854800e716f787d2310 Mon Sep 17 00:00:00 2001
From: humpalum <humpalum@users.noreply.github.com>
Date: Tue, 27 Jul 2021 14:44:46 +0200
Subject: [PATCH 016/149] chore: Limiting Eventcount to Sysmon Events

---
 .github/workflows/main.yml | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 0696fa77..c95e1cd0 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -27,7 +27,7 @@ jobs:
       shell: powershell
       
     - name: Check Eventcount
-      run:  '$EventCount = 0 ;Get-WinEvent -ListLog * | where {$_.RecordCount -gt 0} | foreach{$_;$EventCount = $EventCount + $_.RecordCount}|Out-Null;"Eventcount: "+$EventCount; if ($EventCount -gt 52500){ Write-Output "Too many events"; $host.SetShouldExit(1)}'
+      run:  '$EventCount = 0 ;Get-WinEvent -ListLog Microsoft-Windows-Sysmon* | where {$_.RecordCount -gt 0} | foreach{$_;$EventCount = $EventCount + $_.RecordCount}|Out-Null;"Eventcount: "+$EventCount; if ($EventCount -gt 50){ Write-Output "Too many events"; $host.SetShouldExit(1)}'
       shell: powershell
       
   busySystem:
@@ -40,9 +40,16 @@ jobs:
       run: Invoke-WebRequest http://live.sysinternals.com/tools/sysmon.exe -OutFile .\sysmon.exe
       shell: powershell
       
+    - name: Run Sysmon 
+      run: .\sysmon.exe -accepteula -i sysmonconfig-export.xml
+      shell: powershell
+      
+    - name: Print Eventcount
+      run: Get-WinEvent -ListLog Microsoft-Windows-Sysmon*
+      
     - name: Install some Choco Packages
       run: choco install ninja adobereader googlechrome firefox jre8 notepadplusplus.install vlc python3 dotnetfx openssh winrar nodejs.install foxitreader autohotkey.portable putty.install skype ccleaner winlogbeat gimp
     
-    - name: Check Eventcount Post Choco
-      run:  '$EventCount = 0 ;Get-WinEvent -ListLog * | where {$_.RecordCount -gt 0} | foreach{$_;$EventCount = $EventCount + $_.RecordCount}|Out-Null;"Eventcount: "+$EventCount; if ($EventCount -gt 54000){ Write-Output "Too many events"; $host.SetShouldExit(1)}'
+    - name: Check Eventcount
+      run:  '$EventCount = 0 ;Get-WinEvent -ListLog Microsoft-Windows-Sysmon* | where {$_.RecordCount -gt 0} | foreach{$_;$EventCount = $EventCount + $_.RecordCount}|Out-Null;"Eventcount: "+$EventCount; if ($EventCount -gt 10000){ Write-Output "Too many events"; $host.SetShouldExit(1)}'
       shell: powershell

From 94d37c3c8ef4ff3eb7dbb8cc68e6dddd3a1d4cab Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Tue, 27 Jul 2021 15:05:49 +0200
Subject: [PATCH 017/149] docs: add maintainers

---
 README.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/README.md b/README.md
index d363ce72..0587f4c8 100644
--- a/README.md
+++ b/README.md
@@ -4,6 +4,12 @@ This is a forked and modified version of @SwiftOnSecurity's [sysmon config](http
 
 Currently it is simply a copy with most of the 30+ open pull requests of the original repository merged. Thus we have fixed many of the issues that are still present in the original version and extended the coverage by important new extensions that have been provided over the last year.
 
+## Maintainers of this Fork
+
+- Florian Roth @Neo23x0
+- Tobias Michalski @humpalum
+- Christian Burkard @phantinuss
+
 ## Additional coverage includes
 
 - Cobalt Strike named pipes

From 77d3adb7c456336b1e9d81d1c990a2b47ae1b22a Mon Sep 17 00:00:00 2001
From: phantinuss <phantinuss@posteo.org>
Date: Wed, 28 Jul 2021 13:21:49 +0200
Subject: [PATCH 018/149] ProcessAccess using CobaltStrike BOF NtOpenProcess

---
 sysmonconfig-export.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 8922dd80..f4e20a51 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -472,13 +472,13 @@
 
 	<!--SYSMON EVENT ID 10 : INTER-PROCESS ACCESS [ProcessAccess]-->
 		<!--EVENT 10: "Process accessed"-->
-		<!--COMMENT:	Can cause high system load, disabled by default.-->
+		<!--COMMENT:	Can cause high system load.-->
 		<!--COMMENT:	Monitor for processes accessing other process' memory.-->
 
 		<!--DATA: UtcTime, SourceProcessGuid, SourceProcessId, SourceThreadId, SourceImage, TargetProcessGuid, TargetProcessId, TargetImage, GrantedAccess, CallTrace-->
 	<RuleGroup name="" groupRelation="or">
 		<ProcessAccess onmatch="include">
-			<!--NOTE: Using "include" with no rules means nothing in this section will be logged-->
+            <CallTrace condition="begin with">UNKNOWN</CallTrace> <!-- CobaltStrike BOF using NtOpenProcess Ref: https://medium.com/falconforce/falconfriday-direct-system-calls-and-cobalt-strike-bofs-0xff14-741fa8e1bdd6 -->
 		</ProcessAccess>
 	</RuleGroup>
 

From 0c24d1d5f9c2e6fb6bf8d00f80b975adbb9b3bb3 Mon Sep 17 00:00:00 2001
From: phantinuss <phantinuss@posteo.org>
Date: Wed, 28 Jul 2021 13:31:24 +0200
Subject: [PATCH 019/149] lsass process access with relevant access rights

---
 sysmonconfig-export.xml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index f4e20a51..f09fcc16 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -479,6 +479,10 @@
 	<RuleGroup name="" groupRelation="or">
 		<ProcessAccess onmatch="include">
             <CallTrace condition="begin with">UNKNOWN</CallTrace> <!-- CobaltStrike BOF using NtOpenProcess Ref: https://medium.com/falconforce/falconfriday-direct-system-calls-and-cobalt-strike-bofs-0xff14-741fa8e1bdd6 -->
+            <Rule groupRelation="and">
+                <TargetImage name="lsass.exe access" condition="end with">lsass.exe</TargetImage>
+                <GrantedAccess condition="contains any">0x40,0x1000,0x1010,0x1038,0x1410,0x1418,0x1438,0x143a,0x100000,0x1f0fff,0x1f1fff,0x1f2fff,0x1f3fff,0x1fffff</GrantedAccess> <!--0x1400 too noisy-->
+            </Rule>
 		</ProcessAccess>
 	</RuleGroup>
 

From def0883ad6323c00f947456274bee97f32cd0aa5 Mon Sep 17 00:00:00 2001
From: phantinuss <phantinuss@posteo.org>
Date: Wed, 28 Jul 2021 13:49:32 +0200
Subject: [PATCH 020/149] fix: use tab instead of space characters for
 indentation

---
 sysmonconfig-export.xml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index f09fcc16..48e2ec8e 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -478,11 +478,11 @@
 		<!--DATA: UtcTime, SourceProcessGuid, SourceProcessId, SourceThreadId, SourceImage, TargetProcessGuid, TargetProcessId, TargetImage, GrantedAccess, CallTrace-->
 	<RuleGroup name="" groupRelation="or">
 		<ProcessAccess onmatch="include">
-            <CallTrace condition="begin with">UNKNOWN</CallTrace> <!-- CobaltStrike BOF using NtOpenProcess Ref: https://medium.com/falconforce/falconfriday-direct-system-calls-and-cobalt-strike-bofs-0xff14-741fa8e1bdd6 -->
-            <Rule groupRelation="and">
-                <TargetImage name="lsass.exe access" condition="end with">lsass.exe</TargetImage>
-                <GrantedAccess condition="contains any">0x40,0x1000,0x1010,0x1038,0x1410,0x1418,0x1438,0x143a,0x100000,0x1f0fff,0x1f1fff,0x1f2fff,0x1f3fff,0x1fffff</GrantedAccess> <!--0x1400 too noisy-->
-            </Rule>
+			<CallTrace condition="begin with">UNKNOWN</CallTrace> <!-- CobaltStrike BOF using NtOpenProcess Ref: https://medium.com/falconforce/falconfriday-direct-system-calls-and-cobalt-strike-bofs-0xff14-741fa8e1bdd6 -->
+			<Rule groupRelation="and">
+				<TargetImage name="lsass.exe access" condition="end with">lsass.exe</TargetImage>
+				<GrantedAccess condition="contains any">0x40,0x1000,0x1010,0x1038,0x1410,0x1418,0x1438,0x143a,0x100000,0x1f0fff,0x1f1fff,0x1f2fff,0x1f3fff,0x1fffff</GrantedAccess> <!--0x1400 too noisy-->
+			</Rule>
 		</ProcessAccess>
 	</RuleGroup>
 

From a2531840a433466d0b51a6c2fcfb4d788c24e965 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Thu, 29 Jul 2021 17:42:44 +0200
Subject: [PATCH 021/149] docs: update README

---
 README.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 0587f4c8..02964ba9 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,7 @@
 
 This is a forked and modified version of @SwiftOnSecurity's [sysmon config](https://github.com/SwiftOnSecurity/sysmon-config).
 
-Currently it is simply a copy with most of the 30+ open pull requests of the original repository merged. Thus we have fixed many of the issues that are still present in the original version and extended the coverage by important new extensions that have been provided over the last year.
+It started as a is simply copy of the original repository. We merged most of the 30+ open pull requests. Thus we have fixed many of the issues that are still present in the original version and extended the coverage with important new extensions.
 
 ## Maintainers of this Fork
 
@@ -18,7 +18,7 @@ Currently it is simply a copy with most of the 30+ open pull requests of the ori
 
 ## Testing
 
-This configuration is focused on detection coverage. We have only one rather small testing environment to avoid problematic expressions that trigger too often. It is recommended to test the downloaded configuration on a small set of systems in your environment in any case. 
+This configuration is focused on detection coverage. We have only one rather small testing environment to avoid problematic expressions that trigger too often. It is recommended to test the downloaded configuration on a small set of systems in your environment in any case.
 
 ## Feedback
 

From 5370dcf1e1560b65a837d1996dd9d3d53083fc81 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Thu, 29 Jul 2021 17:43:02 +0200
Subject: [PATCH 022/149] chore: full fledged sysmon config

---
 .gitignore | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.gitignore b/.gitignore
index 1edf8fea..22547a1a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,3 +4,4 @@ sysmon.exe
 *.exe
 *.cfg
 *.zip
+sysmon-log-all.xml

From df67cdcf74f3491de9a4aebf9bba9ab7f979f6b7 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Fri, 30 Jul 2021 07:34:19 +0200
Subject: [PATCH 023/149] chore: ignore .vscode

---
 .gitignore | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.gitignore b/.gitignore
index 22547a1a..ee3ab9cc 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,3 +5,4 @@ sysmon.exe
 *.cfg
 *.zip
 sysmon-log-all.xml
+.vscode/

From 2618b3758ee1385fc051aefd6b0863e1ada16cc1 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Fri, 30 Jul 2021 07:35:02 +0200
Subject: [PATCH 024/149] new CobaltStrike NamedPipe patterns

---
 sysmonconfig-export.xml | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 48e2ec8e..d54f12ec 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -897,6 +897,30 @@
 				<PipeName condition="begin with">\postex_ssh_</PipeName>
 				<PipeName condition="begin with">\status_</PipeName>
 				<PipeName condition="begin with">\msagent_</PipeName>
+				<!-- Malleable C2 profiles https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 -->
+				<!-- some of these are not exact matches, but the corresponding Sigma rules use Regexp to match exactly -->
+				<PipeName condition="begin with">\mojo.5688.8052.183894939787088877</PipeName>
+				<PipeName condition="begin with">\mojo.5688.8052.35780273329370473</PipeName>
+				<PipeName condition="begin with">\DserNamePipe</PipeName>
+				<PipeName condition="begin with">\mypipe-f</PipeName>
+				<PipeName condition="begin with">\mypipe-h</PipeName>
+				<PipeName condition="begin with">\windows.update.manager</PipeName>
+				<PipeName condition="begin with">\ntsvcs_</PipeName>
+				<PipeName condition="begin with">\scerpc_</PipeName>
+				<!-- these are standard pipes that appear frequently but the Sigma rules use RE to match exactly -->
+				<PipeName condition="begin with">\scerpc</PipeName>
+				<PipeName condition="begin with">\ntsvcs</PipeName>
+				<PipeName condition="begin with">\wkssvc</PipeName>
+			</PipeEvent>
+		</RuleGroup>
+		<!-- we skip the connect pipe event since they could be to noisy and a CreatePipe event should come before these -->
+		<RuleGroup name="" groupRelation="or">
+			<PipeEvent onmatch="exclude">
+				<EventType condition="is">ConnectPipe</EventType>
+				<!-- the standard named pipes used by Windows services (we want only the ones that begin with these names)-->
+				<PipeName condition="is">\scerpc</PipeName>
+				<PipeName condition="is">\ntsvcs</PipeName>
+				<PipeName condition="is">\wkssvc</PipeName>
 			</PipeEvent>
 		</RuleGroup>
 

From 743a054f5c7a1973517f9a6df537f1e6449d2bfe Mon Sep 17 00:00:00 2001
From: Dusty Miller <dusty.miller109@gmail.com>
Date: Fri, 30 Jul 2021 08:40:55 -0400
Subject: [PATCH 025/149] Add Splunk exclusions per sysmon-modular

---
 sysmonconfig-export.xml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index f4acf26c..310eb99d 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -224,6 +224,18 @@
 			<!--SECTION: Google-->
 			<CommandLine condition="begin with">"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=</CommandLine> <!--Google:Chrome: massive command-line arguments-->
 			<CommandLine condition="begin with">"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=</CommandLine> <!--Google:Chrome: massive command-line arguments-->
+			<Image condition="begin with">C:\Program Files\Splunk\bin\</Image> <!--Splunk: Very noisy if using Universal Forwarders-->
+			<ParentImage condition="is">C:\Program Files\Splunk\bin\splunkd.exe</ParentImage> <!--Splunk: Very noisy if using Universal Forwarders-->
+			<ParentImage condition="is">C:\Program Files\Splunk\bin\splunk.exe</ParentImage> <!--Splunk: Very noisy if using Universal Forwarders-->
+			<Image condition="begin with">D:\Program Files\Splunk\bin\</Image> <!--Splunk: Very noisy if using Universal Forwarders-->
+			<ParentImage condition="is">D:\Program Files\Splunk\bin\splunkd.exe</ParentImage> <!--Splunk: Very noisy if using Universal Forwarders-->
+			<ParentImage condition="is">D:\Program Files\Splunk\bin\splunk.exe</ParentImage> <!--Splunk: Very noisy if using Universal Forwarders-->
+			<Image condition="begin with">C:\Program Files\SplunkUniversalForwarder\bin\</Image> <!--Splunk: Very noisy if using Universal Forwarders-->
+			<ParentImage condition="is">C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe</ParentImage> <!--Splunk: Very noisy if using Universal Forwarders-->
+			<ParentImage condition="is">C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe</ParentImage> <!--Splunk: Very noisy if using Universal Forwarders-->
+			<Image condition="begin with">D:\Program Files\SplunkUniversalForwarder\bin\</Image> <!--Splunk: Very noisy if using Universal Forwarders-->
+			<ParentImage condition="is">D:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe</ParentImage> <!--Splunk: Very noisy if using Universal Forwarders-->
+			<ParentImage condition="is">D:\Program Files\SplunkUniversalForwarder\bin\splunk.exe</ParentImage> <!--Splunk: Very noisy if using Universal Forwarders-->
 		</ProcessCreate>
 	</RuleGroup>
 	

From e77d1e0d00384ffdf5741b4187501e67393725c8 Mon Sep 17 00:00:00 2001
From: Tobias Michalski <humpalum@users.noreply.github.com>
Date: Fri, 30 Jul 2021 16:27:52 +0200
Subject: [PATCH 026/149] fix: Added Section comment line

---
 sysmonconfig-export.xml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index c398550c..965e3a78 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -226,6 +226,7 @@
 			<!--SECTION: Google-->
 			<CommandLine condition="begin with">"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=</CommandLine> <!--Google:Chrome: massive command-line arguments-->
 			<CommandLine condition="begin with">"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=</CommandLine> <!--Google:Chrome: massive command-line arguments-->
+			<!--SECTION: Splunk-->
 			<Image condition="begin with">C:\Program Files\Splunk\bin\</Image> <!--Splunk: Very noisy if using Universal Forwarders-->
 			<ParentImage condition="is">C:\Program Files\Splunk\bin\splunkd.exe</ParentImage> <!--Splunk: Very noisy if using Universal Forwarders-->
 			<ParentImage condition="is">C:\Program Files\Splunk\bin\splunk.exe</ParentImage> <!--Splunk: Very noisy if using Universal Forwarders-->

From c56d1abc3d7793a1fb4c2901ff5c38ef01d83365 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Fri, 30 Jul 2021 16:41:27 +0200
Subject: [PATCH 027/149] refactor: simplified expressions

---
 sysmonconfig-export.xml | 18 ++++++------------
 1 file changed, 6 insertions(+), 12 deletions(-)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 965e3a78..1a312bd5 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -227,18 +227,12 @@
 			<CommandLine condition="begin with">"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=</CommandLine> <!--Google:Chrome: massive command-line arguments-->
 			<CommandLine condition="begin with">"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=</CommandLine> <!--Google:Chrome: massive command-line arguments-->
 			<!--SECTION: Splunk-->
-			<Image condition="begin with">C:\Program Files\Splunk\bin\</Image> <!--Splunk: Very noisy if using Universal Forwarders-->
-			<ParentImage condition="is">C:\Program Files\Splunk\bin\splunkd.exe</ParentImage> <!--Splunk: Very noisy if using Universal Forwarders-->
-			<ParentImage condition="is">C:\Program Files\Splunk\bin\splunk.exe</ParentImage> <!--Splunk: Very noisy if using Universal Forwarders-->
-			<Image condition="begin with">D:\Program Files\Splunk\bin\</Image> <!--Splunk: Very noisy if using Universal Forwarders-->
-			<ParentImage condition="is">D:\Program Files\Splunk\bin\splunkd.exe</ParentImage> <!--Splunk: Very noisy if using Universal Forwarders-->
-			<ParentImage condition="is">D:\Program Files\Splunk\bin\splunk.exe</ParentImage> <!--Splunk: Very noisy if using Universal Forwarders-->
-			<Image condition="begin with">C:\Program Files\SplunkUniversalForwarder\bin\</Image> <!--Splunk: Very noisy if using Universal Forwarders-->
-			<ParentImage condition="is">C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe</ParentImage> <!--Splunk: Very noisy if using Universal Forwarders-->
-			<ParentImage condition="is">C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe</ParentImage> <!--Splunk: Very noisy if using Universal Forwarders-->
-			<Image condition="begin with">D:\Program Files\SplunkUniversalForwarder\bin\</Image> <!--Splunk: Very noisy if using Universal Forwarders-->
-			<ParentImage condition="is">D:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe</ParentImage> <!--Splunk: Very noisy if using Universal Forwarders-->
-			<ParentImage condition="is">D:\Program Files\SplunkUniversalForwarder\bin\splunk.exe</ParentImage> <!--Splunk: Very noisy if using Universal Forwarders-->
+			<Image condition="contains">:\Program Files\Splunk\bin\</Image> <!--Splunk: Very noisy if using Universal Forwarders-->
+			<ParentImage condition="end with">:\Program Files\Splunk\bin\splunkd.exe</ParentImage> <!--Splunk: Very noisy if using Universal Forwarders-->
+			<ParentImage condition="end with">:\Program Files\Splunk\bin\splunk.exe</ParentImage> <!--Splunk: Very noisy if using Universal Forwarders-->
+			<Image condition="contains">:\Program Files\SplunkUniversalForwarder\bin\</Image> <!--Splunk: Very noisy if using Universal Forwarders-->
+			<ParentImage condition="end with">:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe</ParentImage> <!--Splunk: Very noisy if using Universal Forwarders-->
+			<ParentImage condition="end with">:\Program Files\SplunkUniversalForwarder\bin\splunk.exe</ParentImage> <!--Splunk: Very noisy if using Universal Forwarders-->
 		</ProcessCreate>
 	</RuleGroup>
 

From cb817453ba8fc1d25def43a7ab10f8274e30240a Mon Sep 17 00:00:00 2001
From: phantinuss <phantinuss@posteo.org>
Date: Tue, 3 Aug 2021 12:10:18 +0200
Subject: [PATCH 028/149] introduce new conditions to config and make use of
 'not begin with' in ProcessAccess

---
 sysmonconfig-export.xml | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 1a312bd5..a4c1815e 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -50,7 +50,7 @@
   - "Image" is a technical term for a compiled binary file like an EXE or DLL. Also, it can match just the filename, or entire path.
   - "ProcessGuid" and "LoginGuid" are not random, they contain some embedded information. https://gist.github.com/mattifestation/0102042160c9a60b2b847378c0ef70b4
 
-  FILTERING: Filter conditions available for use are: is,is not,contains,contains any,contains all,excludes,excludes any,excludes all,begin with,end with,less than,more than,image
+  FILTERING: Filter conditions available for use are: is,is any,is not,contains,contains any,contains all,excludes,excludes any,excludes all,begin with,end with,not begin with,not end with,less than,more than,image
   - The "image" filter is usable on any field. Same as "is" but can either match entire string, or only the text after last "\". Credit: @mattifestation
 
 -->
@@ -485,14 +485,27 @@
 		<!--DATA: UtcTime, SourceProcessGuid, SourceProcessId, SourceThreadId, SourceImage, TargetProcessGuid, TargetProcessId, TargetImage, GrantedAccess, CallTrace-->
 	<RuleGroup name="" groupRelation="or">
 		<ProcessAccess onmatch="include">
-			<CallTrace condition="begin with">UNKNOWN</CallTrace> <!-- CobaltStrike BOF using NtOpenProcess Ref: https://medium.com/falconforce/falconfriday-direct-system-calls-and-cobalt-strike-bofs-0xff14-741fa8e1bdd6 -->
+			<!-- CobaltStrike BOF using OpenProcess/NtOpenProcess Ref: https://medium.com/falconforce/falconfriday-direct-system-calls-and-cobalt-strike-bofs-0xff14-741fa8e1bdd6 -->
 			<Rule groupRelation="and">
-				<TargetImage name="lsass.exe access" condition="end with">lsass.exe</TargetImage>
+				<CallTrace condition="not begin with">C:\Windows\SYSTEM32\ntdll.dll</CallTrace>
+				<CallTrace condition="not begin with">C:\Windows\SYSTEM32\win32u.dll</CallTrace>
+				<CallTrace condition="not begin with">C:\Windows\SYSTEM32\wow64win.dll</CallTrace>
+			</Rule>
+			<CallTrace condition="begin with">UNKNOWN</CallTrace>
+			<!-- lsass.exe access with critical permission -->
+			<Rule groupRelation="and">
+				<TargetImage condition="end with">lsass.exe</TargetImage>
 				<GrantedAccess condition="contains any">0x40,0x1000,0x1010,0x1038,0x1410,0x1418,0x1438,0x143a,0x100000,0x1f0fff,0x1f1fff,0x1f2fff,0x1f3fff,0x1fffff</GrantedAccess> <!--0x1400 too noisy-->
 			</Rule>
 		</ProcessAccess>
 	</RuleGroup>
 
+	<RuleGroup name="" groupRelation="or">
+		<ProcessAccess onmatch="exclude">
+			<!-- NOTE: Potentially noisy PorcessAccess Events in your environment can be excluded here -->
+		</ProcessAccess>
+	</RuleGroup>
+
 	<!--SYSMON EVENT ID 11 : FILE CREATED [FileCreate]-->
 		<!--EVENT 11: "File created"-->
 		<!--NOTE:	Other filesystem "minifilters" can make it appear to Sysmon that some files are being written twice. This is not a Sysmon issue, per Mark Russinovich.-->

From 5e9e9d34166a0ea471e7afec4744a2f0f319dd3a Mon Sep 17 00:00:00 2001
From: Tobias Michalski <humpalum@users.noreply.github.com>
Date: Wed, 4 Aug 2021 07:09:20 +0200
Subject: [PATCH 029/149] chore: User simulation in workflow

---
 .github/workflows/main.yml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index c95e1cd0..146d56c2 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -48,7 +48,13 @@ jobs:
       run: Get-WinEvent -ListLog Microsoft-Windows-Sysmon*
       
     - name: Install some Choco Packages
-      run: choco install ninja adobereader googlechrome firefox jre8 notepadplusplus.install vlc python3 dotnetfx openssh winrar nodejs.install foxitreader autohotkey.portable putty.install skype ccleaner winlogbeat gimp
+      run: choco install ninja adobereader googlechrome firefox python3
+      
+    - name: Download User Sim
+      run: git clone https://github.com/humpalum/sim-user.git
+      
+    - name: Run User Sim
+      run: sim-user\5minuser.exe
     
     - name: Check Eventcount
       run:  '$EventCount = 0 ;Get-WinEvent -ListLog Microsoft-Windows-Sysmon* | where {$_.RecordCount -gt 0} | foreach{$_;$EventCount = $EventCount + $_.RecordCount}|Out-Null;"Eventcount: "+$EventCount; if ($EventCount -gt 10000){ Write-Output "Too many events"; $host.SetShouldExit(1)}'

From 40bdcfccd6f27caeac9c1ddd692dbd432aab0ec8 Mon Sep 17 00:00:00 2001
From: phantinuss <phantinuss@posteo.org>
Date: Wed, 4 Aug 2021 08:53:20 +0200
Subject: [PATCH 030/149] Add Rule for CobaltStrike BOF Injected AMSI Bypass

---
 sysmonconfig-export.xml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index a4c1815e..dbdaf547 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -492,6 +492,11 @@
 				<CallTrace condition="not begin with">C:\Windows\SYSTEM32\wow64win.dll</CallTrace>
 			</Rule>
 			<CallTrace condition="begin with">UNKNOWN</CallTrace>
+			<!-- Inject AMSI Bypass via CobaltStrike BOF Ref: https://github.com/boku7/injectAmsiBypass -->
+			<Rule groupRelation="and">
+				<CallTrace condition="contains">UNKNOWN</CallTrace>
+				<GrantedAccess condition="contains any">0x1028</GrantedAccess>
+			</Rule>
 			<!-- lsass.exe access with critical permission -->
 			<Rule groupRelation="and">
 				<TargetImage condition="end with">lsass.exe</TargetImage>

From e5f3ed3faea3c3ab33d730e480619d830ab6b243 Mon Sep 17 00:00:00 2001
From: phantinuss <phantinuss@posteo.org>
Date: Wed, 4 Aug 2021 09:06:56 +0200
Subject: [PATCH 031/149] replace spaces with tabs or duplicate spaces where
 needed

---
 sysmonconfig-export.xml | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index dbdaf547..452b3ffc 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -129,7 +129,7 @@
 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k LocalService -p -s BthAvctpSvc</CommandLine>
 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localService -s nsi</CommandLine>
 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localService -s w32Time</CommandLine>
-      <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation</CommandLine> <!--Windows: Network services-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation</CommandLine> <!--Windows: Network services-->
 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation -p</CommandLine> <!--Windows: Network services-->
 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s Dhcp</CommandLine> <!--Windows: Network services-->
 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s EventLog</CommandLine>
@@ -342,7 +342,7 @@
 			<Image condition="image">nc64.exe</Image> <!-- 64-bit version of nc that can be used on 64-bit Windows Architectures https://github.com/DarrenRainey/netcat-->
 			<Image condition="image">ncat.exe</Image> <!-- Nmap's modern version of netcat [ https://nmap.org/ncat/guide/index.html#ncat-overview ] [ https://securityblog.gr/1517/create-backdoor-in-windows-with-ncat/ ] -->
 			<Image condition="image">procdump.exe</Image> <!-- Sysinternals Suite client side that can be used to dump clear text passwords from memory -->
-   			<Image condition="image">procdump64.exe</Image> <!-- Sysinternals Suite client side 64-bit version that can be used to dump clear text passwords from memory -->
+			<Image condition="image">procdump64.exe</Image> <!-- Sysinternals Suite client side 64-bit version that can be used to dump clear text passwords from memory -->
 			<Image condition="image">psexec.exe</Image> <!--Sysinternals:PsExec client side | Credit @Cyb3rOps -->
 			<Image condition="image">psexec64.exe</Image> <!-- Sysinernals:PsExec64 client side | 64-bit version of psexec.exe -->
 			<Image condition="image">psexesvc.exe</Image> <!--Sysinternals:PsExec server side | Credit @Cyb3rOps -->
@@ -534,7 +534,7 @@
 			<TargetFilename condition="end with">.docm</TargetFilename> <!--Microsoft:Office:Word: Macro-->
 			<TargetFilename name="DLL" condition="end with">.dll</TargetFilename> <!--Microsoft:Office:Word: Macro-->
 			<TargetFilename name="EXE" condition="end with">.exe</TargetFilename> <!--Executable-->
-			<TargetFilename name="ProcessHostingdotNETCode" condition="end with">.exe.log</TargetFilename> <!-- [ https://github.com/bitsadmin/nopowershell ] | Credit: @SBousseaden [ https://twitter.com/SBousseaden/status/1137493597769687040 ]  -->
+			<TargetFilename name="ProcessHostingdotNETCode" condition="end with">.exe.log</TargetFilename> <!-- [ https://github.com/bitsadmin/nopowershell ] | Credit: @SBousseaden [ https://twitter.com/SBousseaden/status/1137493597769687040 ] -->
 			<TargetFilename condition="end with">.jar</TargetFilename> <!--Java applets-->
 			<TargetFilename condition="end with">.jnlp</TargetFilename> <!--Java applets-->
 			<TargetFilename condition="end with">.jse</TargetFilename> <!--Scripting [ Example: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Mal~Phires-C/detailed-analysis.aspx ] -->
@@ -639,7 +639,7 @@
 				<!--ADDITIONAL REFERENCE: [ http://www.silentrunners.org/launchpoints.html ] -->
 				<!--ADDITIONAL REFERENCE: [ https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2 ] -->
 				<!--ADDITIONAL REFERENCE: [ https://web.archive.org/web/20200116001643/http://scholarworks.rit.edu/cgi/viewcontent.cgi?article=1533&context=theses | Understanding malware autostart techniques - Matthew Gottlieb ] -->
-			<TargetObject name="T1562.002" condition="end with">\MiniNT</TargetObject> <!--Windows: Disable eventlog by acting like WinPE [https://twitter.com/0gtweet/status/1182516740955226112]  -->
+			<TargetObject name="T1562.002" condition="end with">\MiniNT</TargetObject> <!--Windows: Disable eventlog by acting like WinPE [https://twitter.com/0gtweet/status/1182516740955226112] -->
 			<TargetObject name="T1060,RunKey" condition="contains">CurrentVersion\Run</TargetObject> <!--Windows: Wildcard for Run keys, including RunOnce, RunOnceEx, RunServices, RunServicesOnce [Also covers terminal server] -->
 			<TargetObject name="T1060,RunPolicy" condition="contains">Policies\Explorer\Run</TargetObject> <!--Windows: Alternate runs keys | Credit @ion-storm-->
 			<TargetObject name="T1484" condition="contains">Group Policy\Scripts</TargetObject> <!--Windows: Group policy scripts-->
@@ -1230,7 +1230,7 @@
 	<!--SYSMON EVENT ID 23 : FILE DELETE [FileDelete]-->
 		<!--EVENT 23: "File Delete"-->
 		<!--COMMENT:	Sandbox usage. When a program signals to Windows a file should be deleted or wiped, Sysmon may be able to capture it.
-		    Tries to save a copy of the deleted file in the archivedirectory which defaults to C:\Sysmon (to view uncheck "Hide protected
+			Tries to save a copy of the deleted file in the archivedirectory which defaults to C:\Sysmon (to view uncheck "Hide protected
 			operating system files (Recommended)" from Folder Options). Can quickly fill the available drive space with copies of files.
 			Use EVENT ID 26 if a copy is not needed.
 			[ https://isc.sans.edu/forums/diary/Sysmon+and+File+Deletion/26084/ ]
@@ -1247,8 +1247,8 @@
 
 	<!--SYSMON EVENT ID 24 : CLIPBOARD EVENT MONITORING [ClipboardChange]-->
 		<!--EVENT 24: "Clipboard changed"-->
-		<!--COMMENT:	Sandbox usage.  Sysmon can capture the contents of clipboard events.
-			An  example of what could be a production usage on restricted desktops is provided below, but it is commented-out. -->
+		<!--COMMENT:	Sandbox usage. Sysmon can capture the contents of clipboard events.
+			An example of what could be a production usage on restricted desktops is provided below, but it is commented-out. -->
 
 		<!--DATA: EventType, UtcTime, ProcessGuid, ProcessId, Image, Session, ClientInfo, Hashes, Archived -->
 
@@ -1282,7 +1282,7 @@
 	<!--SYSMON EVENT ID 26 : FILE DELETE LOGGED [FileDeleteDetected]-->
 		<!--EVENT 26: "File Delete logged"-->
 		<!--COMMENT:	This event is generated when a program signals to Windows a file should be deleted or wiped, Sysmon may be able to capture it.
-		    Unlike event ID 23 it does not archive a copy of the file deleted allowing for more widespread use outside of a sandbox or IR triage without
+			Unlike event ID 23 it does not archive a copy of the file deleted allowing for more widespread use outside of a sandbox or IR triage without
 			risk of filling up the storage space with deleted archives.
 			[ https://medium.com/falconforce/sysmon-13-10-filedeletedetected-fe2475cb419e ]
 		-->

From 20025a06de24234c4deefbdef336c1e573ce6602 Mon Sep 17 00:00:00 2001
From: phantinuss <phantinuss@posteo.org>
Date: Wed, 4 Aug 2021 09:18:10 +0200
Subject: [PATCH 032/149] switch from spaces to tabs for the whole file

---
 sysmonconfig-export.xml | 106 ++++++++++++++++++++--------------------
 1 file changed, 53 insertions(+), 53 deletions(-)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 452b3ffc..17ad2e1b 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -1,57 +1,57 @@
 <!--
-  sysmon-config | A Sysmon configuration focused on default high-quality event tracing and easy customization by the community
-  Source version:	73 | Date: 2021-02-16
-  Source project:	https://github.com/SwiftOnSecurity/sysmon-config
-  Source license:	Creative Commons Attribution 4.0 | You may privatize, fork, edit, teach, publish, or deploy for commercial use - with attribution in the text.
-
-  REQUIRED: Sysmon version 13 or higher (due to changes in syntax and bug-fixes)
-	https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
-
-  NOTE: To collect Sysmon logs centrally for free, see https://aka.ms/WEF | Command to allow log access to the Network Service:
-	wevtutil.exe sl Microsoft-Windows-Sysmon/Operational /ca:O:BAG:SYD:(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;S-1-5-32-573)(A;;0x1;;;NS)
-
-  NOTE: Do not let the size and complexity of this configuration discourage you from customizing it or building your own.
-	This configuration is based around known, high-signal event tracing, and thus appears complicated, but it is only very
-	detailed. Significant effort over years has been invested in front-loading as much filtering as possible onto the
-	client. This is to make analysis of intrusions possible by hand, and to try to surface anomalous activity as quickly
-	as possible to technicians armed only with Event Viewer. Its purpose is to democratize system monitoring for all organizations.
-
-  NOTE: Sysmon is NOT a whitelist solution or HIDS correlation engine, it is a computer change logging tool.
-	Do NOT ignore everything possible. Sysmon's purpose is providing context during a threat or problem investigation. Legitimate
-	processes are routinely used by threats - do not blindly exclude them. Additionally, be mindful of process-hollowing / imitation.
-
-  NOTE: By default this monitors DNS, which is extremely noisy. If you are starting out on your monitoring journey, just remove that section.
-	You can remove DNS events from Event Viewer screen by applying a 'Filter Current View' for event IDs of: -22
-	Additionally, if you want to monitor DNS, you should deploy client-side adblocking to reduce lookups. See the DNS section for info.
-
-  NOTE: This configuration is designed for PER-MACHINE installs of Chrome and OneDrive. That moves their binaries out of user-controlled folders.
-	Otherwise, attackers could imitate these common applications, and bypass your logging. Below are silent upgrades you can do, no user impact:
-	- https://docs.microsoft.com/en-us/onedrive/per-machine-installation
-	- https://cloud.google.com/chrome-enterprise/browser/download/
-	- As of 2021-02-16 there is no machine-level version of Microsoft Teams. The one provided copies itself to the user profile.
-
-  NOTE: Sysmon is not hardened against an attacker with admin rights. Additionally, this configuration offers an attacker, willing
-	to study it, limited ways to evade some of the logging. If you are in a very high-threat environment, you should consider a broader,
-	log-most approach. However, in the vast majority of cases, an attacker will bumble through multiple behavioral traps which
-	this configuration monitors, especially in the first minutes.
-
-  NOTE: If you encounter unexplainable event inclusion/exclusion, you may have a second Sysmon instance installed under a different exe filename.
-	To clear this, try downloading the latest version and uninstalling with -u force. If it hangs, kill the processes and run it again to cleanup.
-
-  TECHNICAL:
-  - Run sysmon.exe -? for a briefing on Sysmon configuration.
-  - Sysmon XML cannot use the AMPERSAND sign. Replace it with this: &amp;
-  - Sysmon 8+ can track which rule caused an event to be logged through the "RuleName" field.
-  - If you only specify exclude for a filtering subsection, everything in that subsection is logged by default.
-  - Some Sysmon monitoring abilities are not meant for widely deployed general-purpose use due to performance impact. Depends on environment.
-  - Duplicate or overlapping "Include" rules do not result in duplicate events being logged.
-  - All characters enclosed by XML tags are always interpreted literally. Sysmon does not support wildcards (*), alternate characters, or RegEx.
-  - In registry events, the value name is appended to the full key path with a "\" delimiter. Default key values are named "\(Default)"
-  - "Image" is a technical term for a compiled binary file like an EXE or DLL. Also, it can match just the filename, or entire path.
-  - "ProcessGuid" and "LoginGuid" are not random, they contain some embedded information. https://gist.github.com/mattifestation/0102042160c9a60b2b847378c0ef70b4
-
-  FILTERING: Filter conditions available for use are: is,is any,is not,contains,contains any,contains all,excludes,excludes any,excludes all,begin with,end with,not begin with,not end with,less than,more than,image
-  - The "image" filter is usable on any field. Same as "is" but can either match entire string, or only the text after last "\". Credit: @mattifestation
+	sysmon-config | A Sysmon configuration focused on default high-quality event tracing and easy customization by the community
+	Source version:	73 | Date: 2021-02-16
+	Source project:	https://github.com/SwiftOnSecurity/sysmon-config
+	Source license:	Creative Commons Attribution 4.0 | You may privatize, fork, edit, teach, publish, or deploy for commercial use - with attribution in the text.
+
+	REQUIRED: Sysmon version 13 or higher (due to changes in syntax and bug-fixes)
+		https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
+
+	NOTE: To collect Sysmon logs centrally for free, see https://aka.ms/WEF | Command to allow log access to the Network Service:
+		wevtutil.exe sl Microsoft-Windows-Sysmon/Operational /ca:O:BAG:SYD:(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;S-1-5-32-573)(A;;0x1;;;NS)
+
+	NOTE: Do not let the size and complexity of this configuration discourage you from customizing it or building your own.
+		This configuration is based around known, high-signal event tracing, and thus appears complicated, but it is only very
+		detailed. Significant effort over years has been invested in front-loading as much filtering as possible onto the
+		client. This is to make analysis of intrusions possible by hand, and to try to surface anomalous activity as quickly
+		as possible to technicians armed only with Event Viewer. Its purpose is to democratize system monitoring for all organizations.
+
+	NOTE: Sysmon is NOT a whitelist solution or HIDS correlation engine, it is a computer change logging tool.
+		Do NOT ignore everything possible. Sysmon's purpose is providing context during a threat or problem investigation. Legitimate
+		processes are routinely used by threats - do not blindly exclude them. Additionally, be mindful of process-hollowing / imitation.
+
+	NOTE: By default this monitors DNS, which is extremely noisy. If you are starting out on your monitoring journey, just remove that section.
+		You can remove DNS events from Event Viewer screen by applying a 'Filter Current View' for event IDs of: -22
+		Additionally, if you want to monitor DNS, you should deploy client-side adblocking to reduce lookups. See the DNS section for info.
+
+	NOTE: This configuration is designed for PER-MACHINE installs of Chrome and OneDrive. That moves their binaries out of user-controlled folders.
+		Otherwise, attackers could imitate these common applications, and bypass your logging. Below are silent upgrades you can do, no user impact:
+		- https://docs.microsoft.com/en-us/onedrive/per-machine-installation
+		- https://cloud.google.com/chrome-enterprise/browser/download/
+		- As of 2021-02-16 there is no machine-level version of Microsoft Teams. The one provided copies itself to the user profile.
+
+	NOTE: Sysmon is not hardened against an attacker with admin rights. Additionally, this configuration offers an attacker, willing
+		to study it, limited ways to evade some of the logging. If you are in a very high-threat environment, you should consider a broader,
+		log-most approach. However, in the vast majority of cases, an attacker will bumble through multiple behavioral traps which
+		this configuration monitors, especially in the first minutes.
+
+	NOTE: If you encounter unexplainable event inclusion/exclusion, you may have a second Sysmon instance installed under a different exe filename.
+		To clear this, try downloading the latest version and uninstalling with -u force. If it hangs, kill the processes and run it again to cleanup.
+
+	TECHNICAL:
+	- Run sysmon.exe -? for a briefing on Sysmon configuration.
+	- Sysmon XML cannot use the AMPERSAND sign. Replace it with this: &amp;
+	- Sysmon 8+ can track which rule caused an event to be logged through the "RuleName" field.
+	- If you only specify exclude for a filtering subsection, everything in that subsection is logged by default.
+	- Some Sysmon monitoring abilities are not meant for widely deployed general-purpose use due to performance impact. Depends on environment.
+	- Duplicate or overlapping "Include" rules do not result in duplicate events being logged.
+	- All characters enclosed by XML tags are always interpreted literally. Sysmon does not support wildcards (*), alternate characters, or RegEx.
+	- In registry events, the value name is appended to the full key path with a "\" delimiter. Default key values are named "\(Default)"
+	- "Image" is a technical term for a compiled binary file like an EXE or DLL. Also, it can match just the filename, or entire path.
+	- "ProcessGuid" and "LoginGuid" are not random, they contain some embedded information. https://gist.github.com/mattifestation/0102042160c9a60b2b847378c0ef70b4
+
+	FILTERING: Filter conditions available for use are: is,is any,is not,contains,contains any,contains all,excludes,excludes any,excludes all,begin with,end with,not begin with,not end with,less than,more than,image
+	- The "image" filter is usable on any field. Same as "is" but can either match entire string, or only the text after last "\". Credit: @mattifestation
 
 -->
 

From 035297af021482ef492ce84a71feed3a8558168a Mon Sep 17 00:00:00 2001
From: Tobias Michalski <humpalum@users.noreply.github.com>
Date: Wed, 4 Aug 2021 11:39:11 +0200
Subject: [PATCH 033/149] chore: Removed Push Trigger from master

Removed push trigger since pushing directly to master isn't possible anyways. Tests will be run on Pull requests and are required there.
Avoids duplicate test runs
---
 .github/workflows/main.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 146d56c2..9d7a3ed9 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -3,9 +3,9 @@ name: CI
 on:
   # Trigger the workflow on push or pull requests, but only for the
   # main branch
-  push:
-    branches:
-    - master
+  #push:
+  #  branches:
+  #  - master
   pull_request:
     branches:
     - master

From 166d4e14f92caac6d6577b94882581fc1911f1c1 Mon Sep 17 00:00:00 2001
From: phantinuss <phantinuss@posteo.org>
Date: Fri, 6 Aug 2021 12:57:07 +0200
Subject: [PATCH 034/149] Collect LittleCorporal ProcessAccess events

---
 sysmonconfig-export.xml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index fc77678b..1286c349 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -502,6 +502,12 @@
 				<TargetImage condition="end with">lsass.exe</TargetImage>
 				<GrantedAccess condition="contains any">0x40,0x1000,0x1010,0x1038,0x1410,0x1418,0x1438,0x143a,0x100000,0x1f0fff,0x1f1fff,0x1f2fff,0x1f3fff,0x1fffff</GrantedAccess> <!--0x1400 too noisy-->
 			</Rule>
+			<!-- LittleCorporal generated MalDoc Ref: https://github.com/connormcgarr/LittleCorporal -->
+			<Rule groupRelation="and">
+				<SourceImage condition="contains">winword.exe</SourceImage>
+				<CallTrace condition="contains">:\Windows\Microsoft.NET\Framework64\v2.</CallTrace>
+				<CallTrace condition="contains">UNKNOWN</CallTrace>
+			</Rule>
 		</ProcessAccess>
 	</RuleGroup>
 

From a75e733b19c74c70fb48321f2d93c44c2ba8f8d0 Mon Sep 17 00:00:00 2001
From: Tobias Michalski <humpalum@users.noreply.github.com>
Date: Thu, 12 Aug 2021 09:47:02 +0200
Subject: [PATCH 035/149] chore: Changed UserSim Download Path

---
 .github/workflows/main.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 9d7a3ed9..21c5dbc8 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -51,10 +51,10 @@ jobs:
       run: choco install ninja adobereader googlechrome firefox python3
       
     - name: Download User Sim
-      run: git clone https://github.com/humpalum/sim-user.git
+      run: Invoke-WebRequest https://github.com/humpalum/sim-user/releases/download/latest/5minuser.exe  -OutFile 5minuser.exe
       
     - name: Run User Sim
-      run: sim-user\5minuser.exe
+      run: 5minuser.exe
     
     - name: Check Eventcount
       run:  '$EventCount = 0 ;Get-WinEvent -ListLog Microsoft-Windows-Sysmon* | where {$_.RecordCount -gt 0} | foreach{$_;$EventCount = $EventCount + $_.RecordCount}|Out-Null;"Eventcount: "+$EventCount; if ($EventCount -gt 10000){ Write-Output "Too many events"; $host.SetShouldExit(1)}'

From edc0509b6f6eba381ce7eb4fbf2bfcb3f7261a4e Mon Sep 17 00:00:00 2001
From: Tobias Michalski <humpalum@users.noreply.github.com>
Date: Thu, 12 Aug 2021 10:26:21 +0200
Subject: [PATCH 036/149] chore: Fix User-Sim execute

---
 .github/workflows/main.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 21c5dbc8..3407183b 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -51,10 +51,10 @@ jobs:
       run: choco install ninja adobereader googlechrome firefox python3
       
     - name: Download User Sim
-      run: Invoke-WebRequest https://github.com/humpalum/sim-user/releases/download/latest/5minuser.exe  -OutFile 5minuser.exe
+      run: Invoke-WebRequest https://github.com/humpalum/sim-user/releases/download/latest/5minuser.exe  -OutFile .\5minuser.exe
       
     - name: Run User Sim
-      run: 5minuser.exe
+      run: .\5minuser.exe
     
     - name: Check Eventcount
       run:  '$EventCount = 0 ;Get-WinEvent -ListLog Microsoft-Windows-Sysmon* | where {$_.RecordCount -gt 0} | foreach{$_;$EventCount = $EventCount + $_.RecordCount}|Out-Null;"Eventcount: "+$EventCount; if ($EventCount -gt 10000){ Write-Output "Too many events"; $host.SetShouldExit(1)}'

From fadf537d392957c89112e53723f44926cb96654c Mon Sep 17 00:00:00 2001
From: phantinuss <phantinuss@posteo.org>
Date: Thu, 12 Aug 2021 11:51:23 +0200
Subject: [PATCH 037/149] fix: revert to schema version 4.50. Newer schema
 versions are put on an other branch until adaption of newer sysmon version
 should be higher

---
 sysmonconfig-export.xml | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 1286c349..fbb7db21 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -50,12 +50,12 @@
 	- "Image" is a technical term for a compiled binary file like an EXE or DLL. Also, it can match just the filename, or entire path.
 	- "ProcessGuid" and "LoginGuid" are not random, they contain some embedded information. https://gist.github.com/mattifestation/0102042160c9a60b2b847378c0ef70b4
 
-	FILTERING: Filter conditions available for use are: is,is any,is not,contains,contains any,contains all,excludes,excludes any,excludes all,begin with,end with,not begin with,not end with,less than,more than,image
+	FILTERING: Filter conditions available for use are: is,is not,contains,contains any,contains all,excludes,excludes any,excludes all,begin with,end with,less than,more than,image
 	- The "image" filter is usable on any field. Same as "is" but can either match entire string, or only the text after last "\". Credit: @mattifestation
 
 -->
 
-<Sysmon schemaversion="4.70">
+<Sysmon schemaversion="4.50">
 	<!--SYSMON META CONFIG-->
 	<HashAlgorithms>md5,sha256,IMPHASH</HashAlgorithms> <!-- Both MD5 and SHA256 are the industry-standard algorithms. Remove IMPHASH if you do not use DLL import fingerprinting. -->
 	<CheckRevocation/> <!-- Check loaded drivers, log if their code-signing certificate has been revoked, in case malware stole one to sign a kernel driver -->
@@ -486,11 +486,6 @@
 	<RuleGroup name="" groupRelation="or">
 		<ProcessAccess onmatch="include">
 			<!-- CobaltStrike BOF using OpenProcess/NtOpenProcess Ref: https://medium.com/falconforce/falconfriday-direct-system-calls-and-cobalt-strike-bofs-0xff14-741fa8e1bdd6 -->
-			<Rule groupRelation="and">
-				<CallTrace condition="not begin with">C:\Windows\SYSTEM32\ntdll.dll</CallTrace>
-				<CallTrace condition="not begin with">C:\Windows\SYSTEM32\win32u.dll</CallTrace>
-				<CallTrace condition="not begin with">C:\Windows\SYSTEM32\wow64win.dll</CallTrace>
-			</Rule>
 			<CallTrace condition="begin with">UNKNOWN</CallTrace>
 			<!-- Inject AMSI Bypass via CobaltStrike BOF Ref: https://github.com/boku7/injectAmsiBypass -->
 			<Rule groupRelation="and">

From be79a158db5c7897b5fe3e7e29377423931f5440 Mon Sep 17 00:00:00 2001
From: phantinuss <phantinuss@posteo.org>
Date: Fri, 13 Aug 2021 12:55:16 +0200
Subject: [PATCH 038/149] fix: use correct list separator ;

---
 sysmonconfig-export.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index fbb7db21..338a0dd2 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -495,7 +495,7 @@
 			<!-- lsass.exe access with critical permission -->
 			<Rule groupRelation="and">
 				<TargetImage condition="end with">lsass.exe</TargetImage>
-				<GrantedAccess condition="contains any">0x40,0x1000,0x1010,0x1038,0x1410,0x1418,0x1438,0x143a,0x100000,0x1f0fff,0x1f1fff,0x1f2fff,0x1f3fff,0x1fffff</GrantedAccess> <!--0x1400 too noisy-->
+				<GrantedAccess condition="contains any">0x40;0x1000;0x1010;0x1038;0x1410;0x1418;0x1438;0x143a;0x100000;0x1f0fff;0x1f1fff;0x1f2fff;0x1f3fff;0x1fffff</GrantedAccess> <!--0x1400 too noisy-->
 			</Rule>
 			<!-- LittleCorporal generated MalDoc Ref: https://github.com/connormcgarr/LittleCorporal -->
 			<Rule groupRelation="and">

From 86397d25e419c13b99566fa32fd993d2f293200c Mon Sep 17 00:00:00 2001
From: phantinuss <phantinuss@posteo.org>
Date: Fri, 13 Aug 2021 12:56:57 +0200
Subject: [PATCH 039/149] generalise CobaltStrike BOF ProcessAccess Pattern

---
 sysmonconfig-export.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 338a0dd2..ff68fd95 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -487,10 +487,10 @@
 		<ProcessAccess onmatch="include">
 			<!-- CobaltStrike BOF using OpenProcess/NtOpenProcess Ref: https://medium.com/falconforce/falconfriday-direct-system-calls-and-cobalt-strike-bofs-0xff14-741fa8e1bdd6 -->
 			<CallTrace condition="begin with">UNKNOWN</CallTrace>
-			<!-- Inject AMSI Bypass via CobaltStrike BOF Ref: https://github.com/boku7/injectAmsiBypass -->
+			<!-- Typical ProcessAccess Pattern of CobaltStrike BOF Ref: e.g. https://github.com/boku7/injectAmsiBypass -->
 			<Rule groupRelation="and">
 				<CallTrace condition="contains">UNKNOWN</CallTrace>
-				<GrantedAccess condition="contains any">0x1028</GrantedAccess>
+				<GrantedAccess condition="contains any">0x1028;0x1fffff</GrantedAccess>
 			</Rule>
 			<!-- lsass.exe access with critical permission -->
 			<Rule groupRelation="and">

From 254932da8a3c18e681ddcb6211bfbc7cb1e6d4cc Mon Sep 17 00:00:00 2001
From: Florian Roth <venom14@gmail.com>
Date: Mon, 23 Aug 2021 08:35:40 +0200
Subject: [PATCH 040/149] feat: efspotato named pipe

---
 sysmonconfig-export.xml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index d54f12ec..6ff7b92b 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -891,6 +891,7 @@
 				<!-- Malware -->
 				<PipeName condition="contains any">\isapi_http;\isapi_dg;\isapi_dg2;\sdlrpc;\ahexec;\winsession;\lsassw;\46a676ab7f179e511e30dd2dc41bd388;\9f81f59bc58452127884ce513865ed20;\e710f28d59aa529d6792ca6ff0ca1b34;\rpchlp_3;\NamePipe_MoreWindows;\pcheap_reuse;\gruntsvc;\583da945-62af-10e8-4902-a8f205c72b2e;\bizkaz;\svcctl;\Posh;\jaccdpqnvbrrxlaf;\csexecsvc</PipeName>
 				<PipeName condition="contains any">\atctl;\userpipe;\iehelper;\sdlrpc;\comnap</PipeName>
+				<PipeName condition="contains">\pipe\</PipeName> <!-- EfsPotato https://twitter.com/SBousseaden/status/1429530155291193354?s=20 -->
 				<!-- Cobalt Strike Pipe Names -->
 				<PipeName condition="contains all">MSSE-;-server</PipeName>
 				<PipeName condition="begin with">\postex_</PipeName>

From 8f3500134acba31e3385edbb2a6e821dd6879390 Mon Sep 17 00:00:00 2001
From: Florian Roth <venom14@gmail.com>
Date: Mon, 23 Aug 2021 10:41:19 +0200
Subject: [PATCH 041/149] fix: limit too low

---
 .github/workflows/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index c95e1cd0..c6faf012 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -27,7 +27,7 @@ jobs:
       shell: powershell
       
     - name: Check Eventcount
-      run:  '$EventCount = 0 ;Get-WinEvent -ListLog Microsoft-Windows-Sysmon* | where {$_.RecordCount -gt 0} | foreach{$_;$EventCount = $EventCount + $_.RecordCount}|Out-Null;"Eventcount: "+$EventCount; if ($EventCount -gt 50){ Write-Output "Too many events"; $host.SetShouldExit(1)}'
+      run:  '$EventCount = 0 ;Get-WinEvent -ListLog Microsoft-Windows-Sysmon* | where {$_.RecordCount -gt 0} | foreach{$_;$EventCount = $EventCount + $_.RecordCount}|Out-Null;"Eventcount: "+$EventCount; if ($EventCount -gt 100){ Write-Output "Too many events"; $host.SetShouldExit(1)}'
       shell: powershell
       
   busySystem:

From 569e839be22e138312dc70b117d3496cd3cef0b4 Mon Sep 17 00:00:00 2001
From: phantinuss <79651203+phantinuss@users.noreply.github.com>
Date: Thu, 26 Aug 2021 12:43:00 +0200
Subject: [PATCH 042/149] feat: more CobaltStrike malleable C2 profiles

---
 sysmonconfig-export.xml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index b8ec979c..22cea6c9 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -935,6 +935,23 @@
 				<PipeName condition="begin with">\windows.update.manager</PipeName>
 				<PipeName condition="begin with">\ntsvcs_</PipeName>
 				<PipeName condition="begin with">\scerpc_</PipeName>
+				<!-- Malleable C2 profiles https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752 -->
+				<PipeName condition="begin with">\demoagent_</PipeName>
+				<PipeName condition="begin with">\PGMessagePipe</PipeName>
+				<PipeName condition="begin with">\MsFteWds</PipeName>
+				<PipeName condition="begin with">\f4c3</PipeName>
+				<PipeName condition="begin with">\fullduplex_</PipeName>
+				<PipeName condition="begin with">\msrpc_</PipeName>
+				<PipeName condition="begin with">\win\msrpc_</PipeName>
+				<PipeName condition="begin with">\f53f</PipeName>
+				<PipeName condition="begin with">\rpc_</PipeName>
+				<PipeName condition="begin with">\spoolss_</PipeName>
+				<PipeName condition="begin with">\win_svc</PipeName>
+				<PipeName condition="begin with">\SearchTextHarvester</PipeName>
+				<Rule groupRelation="and"> <!-- would be noisy otherwise as \Winsock2\CatalogchangeListener-???-0 is a legitimate pipe name -->
+					<PipeName condition="begin with">\Winsock2\CatalogChangeListener-</PipeName>
+					<PipeName condition="end with">-0,</PipeName>
+				</Rule>
 				<!-- these are standard pipes that appear frequently but the Sigma rules use RE to match exactly -->
 				<PipeName condition="begin with">\scerpc</PipeName>
 				<PipeName condition="begin with">\ntsvcs</PipeName>

From ac2cc4814c7b2b59fa7c8747e872e16e7f09b123 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Wed, 1 Sep 2021 13:53:47 +0200
Subject: [PATCH 043/149] Liquid Snake Named Pipe

---
 sysmonconfig-export.xml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 6ff7b92b..9db2c9f1 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -912,6 +912,8 @@
 				<PipeName condition="begin with">\scerpc</PipeName>
 				<PipeName condition="begin with">\ntsvcs</PipeName>
 				<PipeName condition="begin with">\wkssvc</PipeName>
+				<!-- Other specific named pipes -->
+				<PipeName condition="contains">6e7645c4-32c5-4fe3-aabf-e94c2f4370e7</PipeName> <!-- LiquidSnake hacktool https://github.com/RiccardoAncarani/LiquidSnake -->
 			</PipeEvent>
 		</RuleGroup>
 		<!-- we skip the connect pipe event since they could be to noisy and a CreatePipe event should come before these -->

From d3dbadd0b18fa6c7f84fa29a93275585939a949d Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Wed, 1 Sep 2021 13:59:43 +0200
Subject: [PATCH 044/149] suspicious WMI Event Consumer creates named pipe

---
 sysmonconfig-export.xml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index bd2baece..be2e69bd 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -958,6 +958,7 @@
 				<PipeName condition="begin with">\wkssvc</PipeName>
 				<!-- Other specific named pipes -->
 				<PipeName condition="contains">6e7645c4-32c5-4fe3-aabf-e94c2f4370e7</PipeName> <!-- LiquidSnake hacktool https://github.com/RiccardoAncarani/LiquidSnake -->
+				<Image condition="end with">\scrcons.exe</Image> <!-- Susupicious WMI Event Consumer creating a named pipe -->
 			</PipeEvent>
 		</RuleGroup>
 		<!-- we skip the connect pipe event since they could be to noisy and a CreatePipe event should come before these -->

From 169d3006487eb98e9b3fdfdbe9a1a4a010a07f8c Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Wed, 1 Sep 2021 14:01:59 +0200
Subject: [PATCH 045/149] docs: rule development note - sysmon config for lab

---
 README.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/README.md b/README.md
index 02964ba9..2b6cc9b7 100644
--- a/README.md
+++ b/README.md
@@ -56,6 +56,10 @@ Run with administrator rights
 sysmon.exe -u
 ```
 
+## Rule Development
+
+For rule development we use a very extensive [Sysmon config](https://github.com/OTRF/Blacksmith/blob/master/resources/configs/sysmon/sysmon.xml) provided by @Cyb3rWarD0g in our lab that logs almost any event on an end system.
+
 ## Credits
 
 Since we wanted to be able to receive new pull requests this repository, we had to squash all open(!) pull requests of the original reposiory into a single commit on this one.

From a05925bf97de945b73a00c8521362e6217ac5b18 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Fri, 10 Sep 2021 08:21:23 +0200
Subject: [PATCH 046/149] CVE-2021-40444 traces in registry

---
 sysmonconfig-export.xml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index be2e69bd..c3cc70ba 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -790,6 +790,7 @@
 			<TargetObject condition="contains">Microsoft\Cryptography\Providers\Trust\</TargetObject> <!-- Important trust registry values to monitor -->
 			<TargetObject condition="contains">WOW6432Node\Microsoft\Cryptography\Providers\Trust\</TargetObject> <!-- Important trust registry values to monitor -->
 			<TargetObject condition="contains">Control\Print\Environments\Windows x64\Drivers</TargetObject> <!-- PrinterNightmare coverage -->
+			<TargetObject name="Context,ContactedDomain" condition="end with">\EnableBHO</TargetObject> <!--Microsoft:Office: Contacted domains stored here 'HKEY_CURRENT_USER\<SID>\SOFTWARE\Microsoft\Office\16.0\Common\Internet\Server Cache\<domain>\EnableBHO' -->
 		</RegistryEvent>
 	</RuleGroup>
 

From d852990583d7e2af401165f3583d41d74836900c Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Fri, 10 Sep 2021 18:05:43 +0200
Subject: [PATCH 047/149] Winword writes .cab / .inf files : CVE-2021-40444
 detection

---
 sysmonconfig-export.xml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index c3cc70ba..523a6a60 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -587,6 +587,10 @@
 			<TargetFilename condition="contains">\hive_sam_</TargetFilename> <!-- Default output of HiveNightmare / SeriousSAM tools -->
 			<TargetFilename condition="is">C:\windows\temp\sam</TargetFilename> <!-- Default output of HiveNightmare / SeriousSAM tools -->
 			<TargetFilename condition="begin with">C:\Windows\System32\spool\drivers\x64</TargetFilename> <!-- PrinterNight -->
+			<Rule groupRelation="and"> <!-- CVE-2021-40444 https://twitter.com/RonnyTNL/status/1436334640617373699 -->
+				<Image condition="end with">\WINWORD.EXE</Image>
+				<TargetFilename condition="contains any">.cab;.inf</TargetFilename>
+			</Rule>
 		</FileCreate>
 	</RuleGroup>
 

From 29c61dc5a2a69f21566f9aac1fd783af130cad5d Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Mon, 4 Oct 2021 12:11:57 +0200
Subject: [PATCH 048/149] new ADS stream creation expressions

---
 sysmonconfig-export.xml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 523a6a60..33a46846 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -892,6 +892,9 @@
 			<TargetFilename condition="end with">.vb</TargetFilename> <!--VisualBasicScripting files-->
 			<TargetFilename condition="end with">.vbe</TargetFilename> <!--VisualBasicScripting files-->
 			<TargetFilename condition="end with">.vbs</TargetFilename> <!--VisualBasicScripting files-->
+			<TargetFilename condition="end with">:Zone.Identifier</TargetFilename> <!-- Track Zone.Identifiers regardless of their download location -->
+			<TargetFilename condition="end with">:newads</TargetFilename> <!-- CobaltStrike BOF https://github.com/EspressoCake/Self_Deletion_BOF/blob/main/src/main.c -->
+
 		</FileCreateStreamHash>
 
 	<RuleGroup name="" groupRelation="or">

From a23727f7a6cd9f33c9906ed01bc23507afd25334 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Mon, 11 Oct 2021 12:35:48 +0200
Subject: [PATCH 049/149] ConnectPipe for \MICROSOFT##WID\tsql\query

---
 sysmonconfig-export.xml | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 33a46846..177350b5 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -960,7 +960,7 @@
 					<PipeName condition="begin with">\Winsock2\CatalogChangeListener-</PipeName>
 					<PipeName condition="end with">-0,</PipeName>
 				</Rule>
-				<!-- these are standard pipes that appear frequently but the Sigma rules use RE to match exactly -->
+				<!-- these are standard pipes that appear frequently but the Sigma rules use RE to match on malicious pipes that use the common names as a prefix -->
 				<PipeName condition="begin with">\scerpc</PipeName>
 				<PipeName condition="begin with">\ntsvcs</PipeName>
 				<PipeName condition="begin with">\wkssvc</PipeName>
@@ -969,16 +969,23 @@
 				<Image condition="end with">\scrcons.exe</Image> <!-- Susupicious WMI Event Consumer creating a named pipe -->
 			</PipeEvent>
 		</RuleGroup>
-		<!-- we skip the connect pipe event since they could be to noisy and a CreatePipe event should come before these -->
-		<RuleGroup name="" groupRelation="or">
+		<!-- Common Pipe Names to would appear very often in -->
+		<RuleGroup name="CommonPipes" groupRelation="or">
 			<PipeEvent onmatch="exclude">
-				<EventType condition="is">ConnectPipe</EventType>
-				<!-- the standard named pipes used by Windows services (we want only the ones that begin with these names)-->
+				<!-- the standard named pipes used by Windows services (we want only the ones that begin with these names) -->
 				<PipeName condition="is">\scerpc</PipeName>
 				<PipeName condition="is">\ntsvcs</PipeName>
 				<PipeName condition="is">\wkssvc</PipeName>
 			</PipeEvent>
 		</RuleGroup>
+		<!-- ConnectPipe Events -->
+		<!-- Some interesting ConnectPipe events that we want to include -->
+		<RuleGroup name="InterestingConnectPipe" groupRelation="and">
+			<PipeEvent onmatch="include">
+				<EventType condition="is">ConnectPipe</EventType>
+				<PipeName condition="is">\MICROSOFT##WID\tsql\query</PipeName> <!-- https://github.com/SigmaHQ/sigma/pull/2128 -->
+			</PipeEvent>
+		</RuleGroup>
 
 	<!--SYSMON EVENT ID 19 & 20 & 21 : WMI EVENT MONITORING [WmiEvent]-->
 		<!--EVENT 19: "WmiEventFilter activity detected"-->

From 3c249b997af27d231a3c550ec83e90033d2f914b Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Tue, 12 Oct 2021 09:07:56 +0200
Subject: [PATCH 050/149] refactor: moved section to bigger "include" block

---
 sysmonconfig-export.xml | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 177350b5..e9c85937 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -967,6 +967,11 @@
 				<!-- Other specific named pipes -->
 				<PipeName condition="contains">6e7645c4-32c5-4fe3-aabf-e94c2f4370e7</PipeName> <!-- LiquidSnake hacktool https://github.com/RiccardoAncarani/LiquidSnake -->
 				<Image condition="end with">\scrcons.exe</Image> <!-- Susupicious WMI Event Consumer creating a named pipe -->
+				<!-- Some interesting ConnectPipe events that we want to include -->
+				<PipeEvent onmatch="include">
+					<EventType condition="is">ConnectPipe</EventType>
+					<PipeName condition="is">\MICROSOFT##WID\tsql\query</PipeName> <!-- https://github.com/SigmaHQ/sigma/pull/2128 -->
+				</PipeEvent>
 			</PipeEvent>
 		</RuleGroup>
 		<!-- Common Pipe Names to would appear very often in -->
@@ -978,14 +983,6 @@
 				<PipeName condition="is">\wkssvc</PipeName>
 			</PipeEvent>
 		</RuleGroup>
-		<!-- ConnectPipe Events -->
-		<!-- Some interesting ConnectPipe events that we want to include -->
-		<RuleGroup name="InterestingConnectPipe" groupRelation="and">
-			<PipeEvent onmatch="include">
-				<EventType condition="is">ConnectPipe</EventType>
-				<PipeName condition="is">\MICROSOFT##WID\tsql\query</PipeName> <!-- https://github.com/SigmaHQ/sigma/pull/2128 -->
-			</PipeEvent>
-		</RuleGroup>
 
 	<!--SYSMON EVENT ID 19 & 20 & 21 : WMI EVENT MONITORING [WmiEvent]-->
 		<!--EVENT 19: "WmiEventFilter activity detected"-->

From 3b1f32380f881c8e2412636dd1047414dd7dcd1a Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Tue, 12 Oct 2021 10:06:06 +0200
Subject: [PATCH 051/149] fix: position of PipeEvent

---
 sysmonconfig-export.xml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index e9c85937..2fac2019 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -967,11 +967,11 @@
 				<!-- Other specific named pipes -->
 				<PipeName condition="contains">6e7645c4-32c5-4fe3-aabf-e94c2f4370e7</PipeName> <!-- LiquidSnake hacktool https://github.com/RiccardoAncarani/LiquidSnake -->
 				<Image condition="end with">\scrcons.exe</Image> <!-- Susupicious WMI Event Consumer creating a named pipe -->
-				<!-- Some interesting ConnectPipe events that we want to include -->
-				<PipeEvent onmatch="include">
-					<EventType condition="is">ConnectPipe</EventType>
-					<PipeName condition="is">\MICROSOFT##WID\tsql\query</PipeName> <!-- https://github.com/SigmaHQ/sigma/pull/2128 -->
-				</PipeEvent>
+			</PipeEvent>
+			<!-- Some interesting ConnectPipe events that we want to include -->
+			<PipeEvent onmatch="include">
+				<EventType condition="is">ConnectPipe</EventType>
+				<PipeName condition="is">\MICROSOFT##WID\tsql\query</PipeName> <!-- https://github.com/SigmaHQ/sigma/pull/2128 -->
 			</PipeEvent>
 		</RuleGroup>
 		<!-- Common Pipe Names to would appear very often in -->

From 0681c2339ba9543c76b90b3efef7bdf8e08efcb3 Mon Sep 17 00:00:00 2001
From: phantinuss <79651203+phantinuss@users.noreply.github.com>
Date: Tue, 12 Oct 2021 11:11:25 +0200
Subject: [PATCH 052/149] Update sysmonconfig-export.xml

---
 sysmonconfig-export.xml | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 2fac2019..04f7fd24 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -967,11 +967,10 @@
 				<!-- Other specific named pipes -->
 				<PipeName condition="contains">6e7645c4-32c5-4fe3-aabf-e94c2f4370e7</PipeName> <!-- LiquidSnake hacktool https://github.com/RiccardoAncarani/LiquidSnake -->
 				<Image condition="end with">\scrcons.exe</Image> <!-- Susupicious WMI Event Consumer creating a named pipe -->
-			</PipeEvent>
-			<!-- Some interesting ConnectPipe events that we want to include -->
-			<PipeEvent onmatch="include">
-				<EventType condition="is">ConnectPipe</EventType>
-				<PipeName condition="is">\MICROSOFT##WID\tsql\query</PipeName> <!-- https://github.com/SigmaHQ/sigma/pull/2128 -->
+				<Rule groupRelation="and"> <!-- Some interesting ConnectPipe events that we want to include -->
+					<EventType condition="is">ConnectPipe</EventType>
+					<PipeName condition="is">\MICROSOFT##WID\tsql\query</PipeName> <!-- https://github.com/SigmaHQ/sigma/pull/2128 -->
+				</Rule>
 			</PipeEvent>
 		</RuleGroup>
 		<!-- Common Pipe Names to would appear very often in -->

From 716621879604802b1f13f8a4229e0741b404135d Mon Sep 17 00:00:00 2001
From: Tran Trung Hieu <hieutt35@fpt.com.vn>
Date: Mon, 18 Oct 2021 09:25:22 +0400
Subject: [PATCH 053/149] Update the Antivirus Tampering configuration, using
 broader condition

---
 sysmonconfig-export.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 028d3738..0fdf3e85 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -301,7 +301,7 @@
 			<Image condition="image">net1.exe</Image> <!--Windows: Launched by "net.exe", but it may not detect connections either -->
 			<Image condition="image">notepad.exe</Image> <!--Windows: [ https://secrary.com/ReversingMalware/CoinMiner/ ] [ https://blog.cobaltstrike.com/2013/08/08/why-is-notepad-exe-connecting-to-the-internet/ ] -->
 			<Image condition="image">nslookup.exe</Image> <!--Windows: Retrieve data over DNS -->
-			<Image condition="image">powershell.exe</Image> <!--Windows: PowerShell interface-->
+			<Image condition="image">powershell.exe</Image> <!--Windows: PowerShell interface-->
 			<Image condition="image">powershell_ise.exe</Image> <!--Windows: PowerShell interface-->
 			<Image condition="image">qprocess.exe</Image> <!--Windows: [ https://www.first.org/resources/papers/conf2017/APT-Log-Analysis-Tracking-Attack-Tools-by-Audit-Policy-and-Sysmon.pdf ] -->
 			<Image condition="image">qwinsta.exe</Image> <!--Windows: Query remote sessions | Credit @ion-storm -->
@@ -694,7 +694,7 @@
 			<TargetObject name="T1089,Tamper-Defender" condition="end with">\SpynetReporting</TargetObject> <!--Windows:Defender: State modified via registry-->
 			<TargetObject name="T1089,Tamper-Defender" condition="end with">DisableRealtimeMonitoring</TargetObject> <!--Windows:Defender: State modified via registry-->
 			<TargetObject name="T1089,Tamper-Defender" condition="end with">\SubmitSamplesConsent</TargetObject> <!--Windows:Defender: State modified via registry-->
-			<TargetObject name="T1562,Tamper-Defender" condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\</TargetObject> <!--Windows:Defender: Exclusions in policy key-->
+			<TargetObject name="T1562,Tamper-Defender" condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender</TargetObject> <!--Windows:Defender: Monitor any modified via registry-->
 			<!--Windows UAC tampering-->
 			<TargetObject name="T1088" condition="end with">HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA</TargetObject> <!--Detect: UAC Tampering | Credit @ion-storm -->
 			<TargetObject name="T1088" condition="end with">HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy</TargetObject> <!--Detect: UAC Tampering | Credit @ion-storm -->

From 9f2e1820cda50b97ee8b21c4ec3934ddf4803f3f Mon Sep 17 00:00:00 2001
From: phantinuss <79651203+phantinuss@users.noreply.github.com>
Date: Mon, 30 Aug 2021 12:33:57 +0200
Subject: [PATCH 054/149] fix: typo

---
 sysmonconfig-export.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 04f7fd24..f5bc788c 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -508,7 +508,7 @@
 
 	<RuleGroup name="" groupRelation="or">
 		<ProcessAccess onmatch="exclude">
-			<!-- NOTE: Potentially noisy PorcessAccess Events in your environment can be excluded here -->
+			<!-- NOTE: Potentially noisy ProcessAccess Events in your environment can be excluded here -->
 		</ProcessAccess>
 	</RuleGroup>
 

From 7c0dc56224c4b97e5a15af29a12b5714daf462c3 Mon Sep 17 00:00:00 2001
From: phantinuss <79651203+phantinuss@users.noreply.github.com>
Date: Tue, 19 Oct 2021 18:32:43 +0200
Subject: [PATCH 055/149] feat: mstsc connection history registry

---
 sysmonconfig-export.xml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index f5bc788c..ad46d59d 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -673,6 +673,8 @@
 			<TargetObject condition="end with">LastLoggedOnUser</TargetObject> <!--Windows: Changing last-logged in user-->
 			<TargetObject name="ModifyRemoteDesktopPort" condition="end with">RDP-tcp\PortNumber</TargetObject> <!--Windows: Changing RDP port to evade IDS-->
 			<TargetObject condition="end with">Services\PortProxy\v4tov4</TargetObject> <!--Windows: Changing RDP port to evade IDS-->
+			<TargetObject condition="contains">\Microsoft\Terminal Server Client\Default\MRU</TargetObject> <!-- MSTSC Connection History -->
+			<TargetObject condition="contains">\Microsoft\Terminal Server Client\Servers\</TargetObject> <!-- MSTSC Connection History -->
 			<!--CLSID launch commands and Default File Association changes-->
 			<TargetObject name="T1042" condition="contains">\command\</TargetObject> <!--Windows: Sensitive sub-key under file associations and CLSID that map to launch command-->
 			<TargetObject name="T1122" condition="contains">\ddeexec\</TargetObject> <!--Windows: Sensitive sub-key under file associations and CLSID that map to launch command-->

From df8a9dc0693d765b5099c4451f6d818ae2493b0a Mon Sep 17 00:00:00 2001
From: Michel de CREVOISIER <52909656+mdecrevoisier@users.noreply.github.com>
Date: Wed, 20 Oct 2021 11:06:06 +0200
Subject: [PATCH 056/149] Add T1003 file creation when using Mimikatz SSP

Mimikatz "misc::ssp" module allows to load a Security Module (SSP) into the LSA process in order to dump passwords into a file in clear text.
---
 sysmonconfig-export.xml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index ad46d59d..64f2a337 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -557,6 +557,8 @@
 			<TargetFilename name="DefaultUserModified" condition="begin with">C:\Users\Default</TargetFilename> <!--Windows: Changes to default user profile-->
 			<TargetFilename condition="begin with">C:\Windows\system32\Drivers</TargetFilename> <!--Microsoft: Drivers dropped here-->
 			<TargetFilename condition="begin with">C:\Windows\SysWOW64\Drivers</TargetFilename> <!--Microsoft: Drivers dropped here-->
+			<TargetFilename name="T1003" condition="end with">\Windows\System32\mimilsa.log</TargetFilename> <!--Detects usage of Mimikatz Security Package (mimilib.dll) to dump security passwords in clear text https://pentestlab.blog/2019/10/21/persistence-security-support-provider/ -->
+                        <TargetFilename name="T1003" condition="end with">\Windows\System32\kiwissp.log</TargetFilename> <!--Detects usage of old Mimikatz Security Package (mimilib.dll) to dump security passwords in clear text https://pentestlab.blog/2019/10/21/persistence-security-support-provider/ -->
 			<TargetFilename name="T1037,T1484" condition="begin with">C:\Windows\system32\GroupPolicy\Machine\Scripts</TargetFilename> <!--Group policy [ More information: http://www.hexacorn.com/blog/2017/01/07/beyond-good-ol-run-key-part-52/ ] -->
 			<TargetFilename name="T1037,T1484" condition="begin with">C:\Windows\system32\GroupPolicy\User\Scripts</TargetFilename> <!--Group policy [ More information: http://www.hexacorn.com/blog/2017/01/07/beyond-good-ol-run-key-part-52/ ] -->
 			<TargetFilename condition="begin with">C:\Windows\system32\Wbem</TargetFilename> <!--Microsoft:WMI: [ More information: http://2014.hackitoergosum.org/slides/day1_WMI_Shell_Andrei_Dumitrescu.pdf ] -->

From 09044be6102554834c6e2d045960e94b6e05a18f Mon Sep 17 00:00:00 2001
From: Tobias Michalski <humpalum@users.noreply.github.com>
Date: Fri, 22 Oct 2021 09:17:02 +0200
Subject: [PATCH 057/149] Fixed indentation

---
 sysmonconfig-export.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 64f2a337..7710d64f 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -558,7 +558,7 @@
 			<TargetFilename condition="begin with">C:\Windows\system32\Drivers</TargetFilename> <!--Microsoft: Drivers dropped here-->
 			<TargetFilename condition="begin with">C:\Windows\SysWOW64\Drivers</TargetFilename> <!--Microsoft: Drivers dropped here-->
 			<TargetFilename name="T1003" condition="end with">\Windows\System32\mimilsa.log</TargetFilename> <!--Detects usage of Mimikatz Security Package (mimilib.dll) to dump security passwords in clear text https://pentestlab.blog/2019/10/21/persistence-security-support-provider/ -->
-                        <TargetFilename name="T1003" condition="end with">\Windows\System32\kiwissp.log</TargetFilename> <!--Detects usage of old Mimikatz Security Package (mimilib.dll) to dump security passwords in clear text https://pentestlab.blog/2019/10/21/persistence-security-support-provider/ -->
+			<TargetFilename name="T1003" condition="end with">\Windows\System32\kiwissp.log</TargetFilename> <!--Detects usage of old Mimikatz Security Package (mimilib.dll) to dump security passwords in clear text https://pentestlab.blog/2019/10/21/persistence-security-support-provider/ -->
 			<TargetFilename name="T1037,T1484" condition="begin with">C:\Windows\system32\GroupPolicy\Machine\Scripts</TargetFilename> <!--Group policy [ More information: http://www.hexacorn.com/blog/2017/01/07/beyond-good-ol-run-key-part-52/ ] -->
 			<TargetFilename name="T1037,T1484" condition="begin with">C:\Windows\system32\GroupPolicy\User\Scripts</TargetFilename> <!--Group policy [ More information: http://www.hexacorn.com/blog/2017/01/07/beyond-good-ol-run-key-part-52/ ] -->
 			<TargetFilename condition="begin with">C:\Windows\system32\Wbem</TargetFilename> <!--Microsoft:WMI: [ More information: http://2014.hackitoergosum.org/slides/day1_WMI_Shell_Andrei_Dumitrescu.pdf ] -->

From 423ddf1f4b3a0f086fbf76aa82af0c51005b4ee5 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Fri, 29 Oct 2021 17:04:34 +0200
Subject: [PATCH 058/149] more malicious named pipe names

https://github.com/SigmaHQ/sigma/pull/2214
---
 sysmonconfig-export.xml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 04f7fd24..fa5dac33 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -956,6 +956,11 @@
 				<PipeName condition="begin with">\spoolss_</PipeName>
 				<PipeName condition="begin with">\win_svc</PipeName>
 				<PipeName condition="begin with">\SearchTextHarvester</PipeName>
+				<PipeName condition="begin with">\adschemerpc</PipeName> <!-- Turla HyperStack - https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity -->
+				<PipeName condition="begin with">\AnonymousPipe</PipeName> <!-- Hidden Cobra Hoplight - https://us-cert.cisa.gov/ncas/analysis-reports/ar19-304a -->
+				<PipeName condition="begin with">\bc367</PipeName> <!-- Pacifier - https://download.bitdefender.com/resources/files/News/CaseStudies/study/115/Bitdefender-Whitepaper-PAC-A4-en-EN1.pdf -->
+				<PipeName condition="begin with">\bc31a7</PipeName> <!-- Pacifier - https://download.bitdefender.com/resources/files/News/CaseStudies/study/115/Bitdefender-Whitepaper-PAC-A4-en-EN1.pdf -->
+				<PipeName condition="begin with">\testPipe</PipeName> <!-- Emissary Panda Hyerbri - https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/ -->
 				<Rule groupRelation="and"> <!-- would be noisy otherwise as \Winsock2\CatalogchangeListener-???-0 is a legitimate pipe name -->
 					<PipeName condition="begin with">\Winsock2\CatalogChangeListener-</PipeName>
 					<PipeName condition="end with">-0,</PipeName>

From 13cabb9256554fec2e3365da24fa775fdd3cf2e6 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Mon, 8 Nov 2021 11:21:05 +0100
Subject: [PATCH 059/149] Kirbi file creation

---
 sysmonconfig-export.xml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index fa5dac33..c112e1be 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -551,6 +551,7 @@
 			<TargetFilename condition="end with">.vbs</TargetFilename> <!--VisualBasicScripting-->
 			<TargetFilename condition="end with">.xlsm</TargetFilename> <!--Microsoft:Office:Word: Macro-->
 			<TargetFilename condition="end with">.ocx</TargetFilename> <!--Microsoft:ActiveX-->
+			<TargetFilename condition="end with">.kirbi</TargetFilename> <!--Mimikatz Kerberos Ticket Files-->
 			<TargetFilename condition="end with">proj</TargetFilename><!--Microsoft:MSBuild:Script: [ https://twitter.com/subTee/status/885919612969394177 ] -->
 			<TargetFilename condition="end with">.sln</TargetFilename><!--Microsoft:MSBuild:Script: [ https://twitter.com/subTee/status/885919612969394177 ] -->
 			<TargetFilename condition="end with">.xls</TargetFilename><!--Microsoft [ https://medium.com/@threathuntingteam/msxsl-exe-and-wmic-exe-a-way-to-proxy-code-execution-8d524f642b75 ] -->

From b7f060538eb5ab80f2cfd6385f90d61c73f11707 Mon Sep 17 00:00:00 2001
From: Alexander Sennhauser <as@conitrade.com>
Date: Thu, 7 Apr 2022 20:54:20 +0200
Subject: [PATCH 060/149] fix command line

---
 sysmonconfig-export.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 8ec89abb..0768492d 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -80,7 +80,7 @@
 			<ParentCommandLine condition="is">"C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe" -Embedding</ParentCommandLine> <!-- SECTION: Azure OMS/MMA Agent -->
 			<CommandLine condition="contains">\Machine\Scripts\Startup\ipamprovisioning.ps1</CommandLine> <!-- Windows IP Address Management (IPAM) -->
 			<!--SECTION: Microsoft Windows-->
-			<CommandLine condition="is">C:\Windows\system32\cscript.exe" /nologo "MonitorKnowledgeDiscovery.vbs</CommandLine>
+			<CommandLine condition="is">"C:\Windows\system32\cscript.exe" /nologo "MonitorKnowledgeDiscovery.vbs"</CommandLine>
 			<CommandLine condition="begin with"> "C:\Windows\system32\wermgr.exe" "-queuereporting_svc" </CommandLine> <!--Windows:Windows error reporting/telemetry-->
 			<CommandLine condition="begin with">C:\Windows\system32\DllHost.exe /Processid</CommandLine> <!--Windows-->
 			<CommandLine condition="begin with">C:\Windows\system32\wbem\wmiprvse.exe -Embedding</CommandLine> <!--Windows: WMI provider host-->

From fadf11d3dd469ba81bfb408b1503a9b21c48df6a Mon Sep 17 00:00:00 2001
From: Alexander Sennhauser <as@conitrade.com>
Date: Thu, 7 Apr 2022 21:03:26 +0200
Subject: [PATCH 061/149] update Azure OMS/MMA Agent exclusions

---
 sysmonconfig-export.xml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 0768492d..fc1f2157 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -77,7 +77,6 @@
 		<!--DATA: UtcTime, ProcessGuid, ProcessID, Image, FileVersion, Description, Product, Company, CommandLine, CurrentDirectory, User, LogonGuid, LogonId, TerminalSessionId, IntegrityLevel, Hashes, ParentProcessGuid, ParentProcessId, ParentImage, ParentCommandLine, RuleName-->
 	<RuleGroup name="" groupRelation="or">
 		<ProcessCreate onmatch="exclude">
-			<ParentCommandLine condition="is">"C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe" -Embedding</ParentCommandLine> <!-- SECTION: Azure OMS/MMA Agent -->
 			<CommandLine condition="contains">\Machine\Scripts\Startup\ipamprovisioning.ps1</CommandLine> <!-- Windows IP Address Management (IPAM) -->
 			<!--SECTION: Microsoft Windows-->
 			<CommandLine condition="is">"C:\Windows\system32\cscript.exe" /nologo "MonitorKnowledgeDiscovery.vbs"</CommandLine>
@@ -233,6 +232,10 @@
 			<Image condition="contains">:\Program Files\SplunkUniversalForwarder\bin\</Image> <!--Splunk: Very noisy if using Universal Forwarders-->
 			<ParentImage condition="end with">:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe</ParentImage> <!--Splunk: Very noisy if using Universal Forwarders-->
 			<ParentImage condition="end with">:\Program Files\SplunkUniversalForwarder\bin\splunk.exe</ParentImage> <!--Splunk: Very noisy if using Universal Forwarders-->
+			<!-- SECTION: Azure OMS/MMA Agent -->
+			<Image condition="begin with">C:\Program Files\Microsoft Monitoring Agent\</Image>
+			<ParentImage condition="is">C:\Program Files\Microsoft Monitoring Agent\MonitoringHost.exe</ParentImage>
+			<ParentImage condition="is">C:\Program Files\Microsoft Monitoring Agent\Agent\HealthService.exe</ParentImage>
 		</ProcessCreate>
 	</RuleGroup>
 
@@ -392,6 +395,9 @@
 			<DestinationIp condition="begin with">fe80:0:0:0</DestinationIp> <!--Credit @ITProPaul-->
 			<!-- OneDrive -->
 			<Image condition="end with">\AppData\Local\Microsoft\OneDrive\OneDrive.exe</Image> <!--Microsoft: OneDrive-->
+			<!-- SECTION: Azure OMS/MMA Agent -->
+			<Image condition="begin with">C:\Program Files\Microsoft Monitoring Agent\</Image>
+			<Image condition="begin with">C:\Program Files\OMS Gateway\</Image>
 		</NetworkConnect>
 	</RuleGroup>
 

From 439ff66fd962e5ca4a0d56ee7fa928ec081dc7cf Mon Sep 17 00:00:00 2001
From: Alexander Sennhauser <as@conitrade.com>
Date: Thu, 7 Apr 2022 21:04:10 +0200
Subject: [PATCH 062/149] add PRTG exclusions

---
 sysmonconfig-export.xml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index fc1f2157..aa15f0ec 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -398,6 +398,8 @@
 			<!-- SECTION: Azure OMS/MMA Agent -->
 			<Image condition="begin with">C:\Program Files\Microsoft Monitoring Agent\</Image>
 			<Image condition="begin with">C:\Program Files\OMS Gateway\</Image>
+			<!-- SECTION: PRTG -->
+			<Image condition="is">C:\Program Files (x86)\PRTG Network Monitor\PRTG Probe.exe</Image>
 		</NetworkConnect>
 	</RuleGroup>
 
@@ -1283,6 +1285,8 @@
 			<QueryName condition="is">status.rapidssl.com</QueryName>
 			<QueryName condition="is">status.thawte.com</QueryName>
 			<QueryName condition="is">ocsp.int-x3.letsencrypt.org</QueryName>
+			<!-- SECTION: PRTG -->
+			<Image condition="is">C:\Program Files (x86)\PRTG Network Monitor\PRTG Probe.exe</Image>
 		</DnsQuery>
 	</RuleGroup>
 

From 04bf25b4d8dc654e42bcf8c4983be347dc6d70df Mon Sep 17 00:00:00 2001
From: Florian Roth <venom14@gmail.com>
Date: Wed, 17 Aug 2022 12:31:55 +0200
Subject: [PATCH 063/149] Update README.md

---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index 2b6cc9b7..81945ea2 100644
--- a/README.md
+++ b/README.md
@@ -9,6 +9,7 @@ It started as a is simply copy of the original repository. We merged most of the
 - Florian Roth @Neo23x0
 - Tobias Michalski @humpalum
 - Christian Burkard @phantinuss
+- Nasreddine Bencherchali @nas_bench
 
 ## Additional coverage includes
 

From 23d19f0d1ad4e615233d142c68809d454fe24afb Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Wed, 17 Aug 2022 12:43:06 +0200
Subject: [PATCH 064/149] feat: new sysmon configs - trace, block

---
 .gitignore                    |    1 -
 sysmonconfig-export-block.xml | 1332 +++++++++++++++++++++++++++++++++
 sysmonconfig-trace.xml        |  282 +++++++
 3 files changed, 1614 insertions(+), 1 deletion(-)
 create mode 100644 sysmonconfig-export-block.xml
 create mode 100644 sysmonconfig-trace.xml

diff --git a/.gitignore b/.gitignore
index ee3ab9cc..309508a9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,5 +4,4 @@ sysmon.exe
 *.exe
 *.cfg
 *.zip
-sysmon-log-all.xml
 .vscode/
diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
new file mode 100644
index 00000000..f7db4203
--- /dev/null
+++ b/sysmonconfig-export-block.xml
@@ -0,0 +1,1332 @@
+<!--
+	sysmon-config | A Sysmon configuration focused on default high-quality event tracing and easy customization by the community
+	Source project:	https://github.com/SwiftOnSecurity/sysmon-config
+	Source license:	Creative Commons Attribution 4.0 | You may privatize, fork, edit, teach, publish, or deploy for commercial use - with attribution in the text.
+
+	REQUIRED: Sysmon version 14 or higher (due to changes in syntax and bug-fixes)
+		https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
+-->
+
+<Sysmon schemaversion="4.82">
+	<!--SYSMON META CONFIG-->
+	<HashAlgorithms>md5,sha256,IMPHASH</HashAlgorithms> <!-- Both MD5 and SHA256 are the industry-standard algorithms. Remove IMPHASH if you do not use DLL import fingerprinting. -->
+	<CheckRevocation/> <!-- Check loaded drivers, log if their code-signing certificate has been revoked, in case malware stole one to sign a kernel driver -->
+
+	<!-- <ImageLoad/> --> <!-- Would manually force-on ImageLoad monitoring, even without configuration below. Included only documentation. -->
+	<!-- <ProcessAccessConfig/> --> <!-- Would manually force-on ProcessAccess monitoring, even without configuration below. Included only documentation. -->
+	<!-- <PipeMonitoringConfig/> --> <!-- Would manually force-on PipeCreated / PipeConnected events, even without configuration below. Included only documentation. -->
+	<!-- <ArchiveDirectory> -->
+
+	<EventFiltering>
+
+	<!--SYSMON EVENT ID 1 : PROCESS CREATION [ProcessCreate]-->
+		<!--COMMENT:	All processes launched will be logged, except for what matches a rule below. It's best to be as specific as possible,
+			to avoid user-mode executables imitating other process names to avoid logging, or if malware drops files in an existing directory.
+			Ultimately, you must weigh CPU time checking many detailed rules, against the risk of malware exploiting the blindness created.
+			Beware of Masquerading, where attackers imitate the names and paths of legitimate tools. Ideally, you'd use both file path and
+			code signatures to validate, but Sysmon does not support that. Look into AppLocker/WindowsDeviceGuard for whitelisting support. -->
+
+		<!--DATA: UtcTime, ProcessGuid, ProcessID, Image, FileVersion, Description, Product, Company, CommandLine, CurrentDirectory, User, LogonGuid, LogonId, TerminalSessionId, IntegrityLevel, Hashes, ParentProcessGuid, ParentProcessId, ParentImage, ParentCommandLine, RuleName-->
+	<RuleGroup name="" groupRelation="or">
+		<ProcessCreate onmatch="exclude">
+			<CommandLine condition="contains">\Machine\Scripts\Startup\ipamprovisioning.ps1</CommandLine> <!-- Windows IP Address Management (IPAM) -->
+			<!--SECTION: Microsoft Windows-->
+			<CommandLine condition="is">"C:\Windows\system32\cscript.exe" /nologo "MonitorKnowledgeDiscovery.vbs"</CommandLine>
+			<CommandLine condition="begin with"> "C:\Windows\system32\wermgr.exe" "-queuereporting_svc" </CommandLine> <!--Windows:Windows error reporting/telemetry-->
+			<CommandLine condition="begin with">C:\Windows\system32\DllHost.exe /Processid</CommandLine> <!--Windows-->
+			<CommandLine condition="begin with">C:\Windows\system32\wbem\wmiprvse.exe -Embedding</CommandLine> <!--Windows: WMI provider host-->
+			<CommandLine condition="begin with">C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding</CommandLine> <!--Windows: WMI provider host-->
+			<CommandLine condition="is">C:\Windows\system32\wermgr.exe -upload</CommandLine> <!--Windows:Windows error reporting/telemetry-->
+			<CommandLine condition="is">C:\Windows\system32\SearchIndexer.exe /Embedding</CommandLine> <!--Windows: Search Indexer-->
+			<CommandLine condition="is">C:\windows\system32\wermgr.exe -queuereporting</CommandLine> <!--Windows:Windows error reporting/telemetry-->
+			<CommandLine condition="is">\??\C:\Windows\system32\autochk.exe *</CommandLine> <!--Microsoft:Bootup: Auto Check Utility-->
+			<CommandLine condition="is">\SystemRoot\System32\smss.exe</CommandLine> <!--Microsoft:Bootup: Windows Session Manager-->
+			<CommandLine condition="is">C:\Windows\System32\RuntimeBroker.exe -Embedding</CommandLine> <!--Windows:Apps permissions [ https://fossbytes.com/runtime-broker-process-windows-10/ ] -->
+			<Image condition="is">C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe</Image> <!--Windows: Touch Keyboard and Handwriting Panel Helper-->
+			<Image condition="is">C:\Windows\System32\TokenBrokerCookies.exe</Image> <!--Windows: SSO sign-in assistant for MicrosoftOnline.com-->
+			<Image condition="is">C:\Windows\System32\plasrv.exe</Image> <!--Windows: Performance Logs and Alerts DCOM Server-->
+			<Image condition="is">C:\Windows\System32\wifitask.exe</Image> <!--Windows: Wireless Background Task-->
+			<Image condition="is">C:\Windows\system32\CompatTelRunner.exe</Image> <!--Windows: Customer Experience Improvement-->
+			<Image condition="is">C:\Windows\system32\PrintIsolationHost.exe</Image> <!--Windows: Printing-->
+			<Image condition="is">C:\Windows\system32\SppExtComObj.Exe</Image> <!--Windows: KMS activation-->
+			<Image condition="is">C:\Windows\system32\audiodg.exe</Image> <!--Windows: Launched constantly-->
+			<Image condition="is">C:\Windows\system32\conhost.exe</Image> <!--Windows: Command line interface host process-->
+			<Image condition="is">C:\Windows\system32\mobsync.exe</Image> <!--Windows: Network file syncing-->
+			<Image condition="is">C:\Windows\system32\musNotification.exe</Image> <!--Windows: Update pop-ups-->
+			<Image condition="is">C:\Windows\system32\musNotificationUx.exe</Image> <!--Windows: Update pop-ups-->
+			<Image condition="is">C:\Windows\system32\powercfg.exe</Image> <!--Microsoft:Power configuration management-->
+			<Image condition="is">C:\Windows\system32\sndVol.exe</Image> <!--Windows: Volume control-->
+			<Image condition="is">C:\Windows\system32\sppsvc.exe</Image> <!--Windows: Software Protection Service-->
+			<Image condition="is">C:\Windows\system32\wbem\WmiApSrv.exe</Image> <!--Windows: WMI performance adapter host process-->
+			<IntegrityLevel condition="is">AppContainer</IntegrityLevel> <!--Windows: Don't care about sandboxed processes right now. Will need to revisit this decision.-->
+			<ParentCommandLine condition="begin with">%%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows</ParentCommandLine> <!--Windows:CommandShell: Triggered when programs use the command shell, but doesn't provide attribution for what caused it-->
+			<ParentCommandLine condition="is">C:\windows\system32\wermgr.exe -queuereporting</ParentCommandLine> <!--Windows:Windows error reporting/telemetry-->
+			<CommandLine condition="is">C:\WINDOWS\system32\devicecensus.exe UserCxt</CommandLine>
+			<CommandLine condition="is">C:\Windows\System32\usocoreworker.exe -Embedding</CommandLine>
+			<ParentImage condition="is">C:\Windows\system32\SearchIndexer.exe</ParentImage> <!--Windows:Search: Launches many uninteresting sub-processes-->
+			<!--SECTION: Windows:svchost-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k appmodel -s StateRepository</CommandLine>
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc</CommandLine>
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k appmodel</CommandLine> <!--Windows 10-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k appmodel -p -s tiledatamodelsvc</CommandLine>
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k camera -s FrameServer</CommandLine>
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k dcomlaunch -s LSM</CommandLine>
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k dcomlaunch -s PlugPlay</CommandLine>
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k defragsvc</CommandLine> <!--Windows defragmentation-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k devicesflow -s DevicesFlowUserSvc</CommandLine>
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k imgsvc</CommandLine> <!--Microsoft:The Windows Image Acquisition Service-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localService -s EventSystem</CommandLine>
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localService -s bthserv</CommandLine>
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k LocalService -p -s BthAvctpSvc</CommandLine>
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localService -s nsi</CommandLine>
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localService -s w32Time</CommandLine>
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation</CommandLine> <!--Windows: Network services-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation -p</CommandLine> <!--Windows: Network services-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s Dhcp</CommandLine> <!--Windows: Network services-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s EventLog</CommandLine>
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s TimeBrokerSvc</CommandLine>
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s WFDSConMgrSvc</CommandLine>
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -s BTAGService</CommandLine>
+			<CommandLine condition="is">C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService</CommandLine> <!--Win10:1903:Network Connection Broker-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted</CommandLine> <!--Windows: Network services-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation -s SensrSvc</CommandLine>
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation -p -s SSDPSRV</CommandLine> <!--Windows:SSDP [ https://en.wikipedia.org/wiki/Simple_Service_Discovery_Protocol ] -->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNoNetwork</CommandLine>
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s WPDBusEnum</CommandLine>
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s fhsvc</CommandLine>
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s DeviceAssociationService</CommandLine>
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s NcbService</CommandLine>
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s SensorService</CommandLine>
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s TabletInputService</CommandLine>
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s UmRdpService</CommandLine>
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s WPDBusEnum</CommandLine>
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s NgcSvc</CommandLine> <!--Microsoft:Passport-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -p -s NgcCtnrSvc</CommandLine> <!--Microsoft:Passport Container-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation -s SCardSvr</CommandLine>
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv</CommandLine>
+			<CommandLine condition="is">C:\Windows\System32\svchost.exe -k netsvcs -p -s SessionEnv</CommandLine> <!--Windows:Remote desktop configuration-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s WdiSystemHost</CommandLine> <!--Windows: Diagnostic System Host [ http://www.blackviper.com/windows-services/diagnostic-system-host/ ] -->
+			<CommandLine condition="is">C:\Windows\System32\svchost.exe -k localSystemNetworkRestricted -p -s WdiSystemHost</CommandLine> <!--Windows: Diagnostic System Host [ http://www.blackviper.com/windows-services/diagnostic-system-host/ ] -->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted</CommandLine> <!--Windows-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc</CommandLine> <!--Windows: Windows Live Sign-In Assistant [ https://www.howtogeek.com/howto/30348/what-are-wlidsvc.exe-and-wlidsvcm.exe-and-why-are-they-running/ ] -->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -p -s ncaSvc</CommandLine> <!--Windows: Network Connectivity Assistant [ http://www.blackviper.com/windows-services/network-connectivity-assistant/ ] -->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s BDESVC</CommandLine> <!--Windows:Network: BitLocker Drive Encryption-->
+			<CommandLine condition="is">C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC</CommandLine> <!--Microsoft:Win10:1903:Network: BitLocker Drive Encryption-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -p -s BITS</CommandLine> <!--Windows:Network: Background Intelligent File Transfer (BITS) -->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s BITS</CommandLine> <!--Windows:Network: Background Intelligent File Transfer (BITS) -->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s CertPropSvc</CommandLine>
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc</CommandLine>
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo</CommandLine>
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s Gpsvc</CommandLine> <!--Windows:Network: Group Policy -->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s ProfSvc</CommandLine> <!--Windows: Network services-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s SENS</CommandLine> <!--Windows: Network services-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s SessionEnv</CommandLine> <!--Windows: Network services-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s Themes</CommandLine> <!--Windows: Network services-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s Winmgmt</CommandLine> <!--Windows: Windows Management Instrumentation (WMI) -->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs</CommandLine> <!--Windows: Network services-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkService -p -s DoSvc</CommandLine>
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkService -s Dnscache</CommandLine> <!--Windows:Network: DNS caching, other uses -->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkService -s LanmanWorkstation</CommandLine> <!--Windows:Network: "Workstation" service, used for SMB file-sharing connections and RDP-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkService -s NlaSvc</CommandLine> <!--Windows:Network: Network Location Awareness-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkService -s TermService</CommandLine> <!--Windows:Network: Terminal Services (RDP)-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkService</CommandLine> <!--Windows: Network services-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkService -p</CommandLine> <!--Windows: Network services-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkServiceNetworkRestricted</CommandLine> <!--Windows: Network services-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k rPCSS</CommandLine> <!--Windows Services-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k secsvcs</CommandLine>
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k swprv</CommandLine> <!--Microsoft:Software Shadow Copy Provider-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k unistackSvcGroup</CommandLine> <!--Windows 10-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k utcsvc</CommandLine> <!--Windows Services-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k wbioSvcGroup</CommandLine> <!--Windows Services-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k werSvcGroup</CommandLine> <!--Windows: ErrorReporting-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc</CommandLine> <!--Windows: Update Medic Service [ https://www.thewindowsclub.com/windows-update-medic-service ] -->
+			<CommandLine condition="is">C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC</CommandLine> <!--Windows:Apps: Client License Service-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k wsappx -p -s AppXSvc</CommandLine> <!--Windows:Apps: AppX Deployment Service-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k wsappx -s ClipSVC</CommandLine> <!--Windows:Apps: Client License Service-->
+			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k wsappx</CommandLine> <!--Windows:Apps [ https://www.howtogeek.com/320261/what-is-wsappx-and-why-is-it-running-on-my-pc/ ] -->
+			<ParentCommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs</ParentCommandLine> <!--Windows: Network services: Spawns Consent.exe-->
+			<ParentCommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted</ParentCommandLine> <!--Windows-->
+			<CommandLine condition="is">C:\Windows\system32\deviceenroller.exe /c /AutoEnrollMDM</CommandLine> <!--Windows: AzureAD device enrollment agent-->
+			<!--SECTION: Microsoft:Edge-->
+			<CommandLine condition="begin with">"C:\Program Files (x86)\Microsoft\Edge Dev\Application\msedge.exe" --type=</CommandLine>
+			<!--SECTION: Microsoft:dotNet-->
+			<CommandLine condition="begin with">C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe</CommandLine> <!--Microsoft:DotNet-->
+			<CommandLine condition="begin with">C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\Ngen.exe</CommandLine> <!--Microsoft:DotNet-->
+			<CommandLine condition="begin with">C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe</CommandLine> <!--Microsoft:DotNet-->
+			<CommandLine condition="begin with">C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe</CommandLine> <!--Microsoft:DotNet-->
+			<Image condition="is">C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe</Image> <!--Microsoft:DotNet-->
+			<Image condition="is">C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe</Image> <!--Microsoft:DotNet-->
+			<Image condition="is">C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe</Image> <!--Windows: Font cache service-->
+			<ParentCommandLine condition="begin with">C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe</ParentCommandLine>
+			<ParentImage condition="is">C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe</ParentImage> <!--Microsoft:DotNet-->
+			<ParentImage condition="is">C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe</ParentImage> <!--Microsoft:DotNet-->
+			<ParentImage condition="is">C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe</ParentImage> <!--Microsoft:DotNet-->
+			<ParentImage condition="is">C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe</ParentImage> <!--Microsoft:DotNet: Spawns thousands of ngen.exe processes-->
+			<!--SECTION: Microsoft:Office-->
+			<Image condition="is">C:\Program Files\Microsoft Office\Office16\MSOSYNC.EXE</Image> <!--Microsoft:Office: Background process for SharePoint/Office365 connectivity-->
+			<Image condition="is">C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE</Image> <!--Microsoft:Office: Background process for SharePoint/Office365 connectivity-->
+			<Image condition="is">C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE</Image> <!--Microsoft:Office: Licensing service-->
+			<Image condition="is">C:\Program Files\Microsoft Office\Office16\msoia.exe</Image> <!--Microsoft:Office: Telemetry collector-->
+			<Image condition="is">C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe</Image>
+			<!--SECTION: Microsoft:Office:Click2Run-->
+			<Image condition="is">C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe</Image> <!--Microsoft:Office: Background process-->
+			<ParentImage condition="is">C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe</ParentImage> <!--Microsoft:Office: Background process-->
+			<ParentImage condition="is">C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe</ParentImage> <!--Microsoft:Office: Background process-->
+			<!--SECTION: Windows: Media player-->
+			<Image condition="is">C:\Program Files\Windows Media Player\wmpnscfg.exe</Image> <!--Windows: Windows Media Player Network Sharing Service Configuration Application-->
+			<!--SECTION: Google-->
+			<CommandLine condition="begin with">"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=</CommandLine> <!--Google:Chrome: massive command-line arguments-->
+			<CommandLine condition="begin with">"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=</CommandLine> <!--Google:Chrome: massive command-line arguments-->
+			<!--SECTION: Splunk-->
+			<Image condition="contains">:\Program Files\Splunk\bin\</Image> <!--Splunk: Very noisy if using Universal Forwarders-->
+			<ParentImage condition="end with">:\Program Files\Splunk\bin\splunkd.exe</ParentImage> <!--Splunk: Very noisy if using Universal Forwarders-->
+			<ParentImage condition="end with">:\Program Files\Splunk\bin\splunk.exe</ParentImage> <!--Splunk: Very noisy if using Universal Forwarders-->
+			<Image condition="contains">:\Program Files\SplunkUniversalForwarder\bin\</Image> <!--Splunk: Very noisy if using Universal Forwarders-->
+			<ParentImage condition="end with">:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe</ParentImage> <!--Splunk: Very noisy if using Universal Forwarders-->
+			<ParentImage condition="end with">:\Program Files\SplunkUniversalForwarder\bin\splunk.exe</ParentImage> <!--Splunk: Very noisy if using Universal Forwarders-->
+			<!-- SECTION: Azure OMS/MMA Agent -->
+			<Image condition="begin with">C:\Program Files\Microsoft Monitoring Agent\</Image>
+			<ParentImage condition="is">C:\Program Files\Microsoft Monitoring Agent\MonitoringHost.exe</ParentImage>
+			<ParentImage condition="is">C:\Program Files\Microsoft Monitoring Agent\Agent\HealthService.exe</ParentImage>
+		</ProcessCreate>
+	</RuleGroup>
+
+	<!--SYSMON EVENT ID 2 : FILE CREATION TIME RETROACTIVELY CHANGED IN THE FILESYSTEM [FileCreateTime]-->
+		<!--COMMENT:	[ https://attack.mitre.org/wiki/Technique/T1099 ] -->
+
+		<!--DATA: UtcTime, ProcessGuid, ProcessId, Image, TargetFilename, CreationUtcTime, PreviousCreationUtcTime-->
+	<RuleGroup name="" groupRelation="or">
+		<FileCreateTime onmatch="include">
+			<Image name="T1099" condition="begin with">C:\Users</Image> <!--Look for timestomping in user area, usually nothing should be doing that here-->
+			<TargetFilename name="T1099" condition="end with">.exe</TargetFilename> <!--Look for backdated executables anywhere-->
+			<Image name="T1099" condition="begin with">\Device\HarddiskVolumeShadowCopy</Image> <!--Nothing should be written here | Credit: @SBousseaden [ https://twitter.com/SBousseaden/status/1133030955407630336 ] -->
+		</FileCreateTime>
+	</RuleGroup>
+
+	<RuleGroup name="" groupRelation="or">
+		<FileCreateTime onmatch="exclude">
+			<Image condition="image">OneDrive.exe</Image> <!--OneDrive constantly changes file times-->
+			<Image condition="image">C:\Windows\system32\backgroundTaskHost.exe</Image>
+			<Image condition="contains">setup</Image> <!--Ignore setups-->
+			<Image condition="contains">install</Image> <!--Ignore setups-->
+			<Image condition="contains">Update\</Image> <!--Ignore setups-->
+			<Image condition="end with">redist.exe</Image> <!--Ignore setups-->
+			<Image condition="is">msiexec.exe</Image> <!--Ignore setups-->
+			<Image condition="is">TrustedInstaller.exe</Image> <!--Ignore setups-->
+			<TargetFilename condition="contains">\NVIDIA\NvBackend\ApplicationOntology\</TargetFilename> <!--NVIDIA GeForce Experience Application Ontology, 1000's of events in user profile-->
+		</FileCreateTime>
+	</RuleGroup>
+
+	<!--SYSMON EVENT ID 3 : NETWORK CONNECTION INITIATED [NetworkConnect]-->
+		<!--COMMENT:	By default this configuration takes a very conservative approach to network logging, limited to only extremely high-signal events.-->
+		<!--COMMENT:	[ https://attack.mitre.org/wiki/Command_and_Control ] [ https://attack.mitre.org/wiki/Exfiltration ] [ https://attack.mitre.org/wiki/Lateral_Movement ] -->
+		<!--TECHNICAL:	For the DestinationHostname, Sysmon uses the GetNameInfo API, which will often not have any information, and may just be a CDN. This is NOT reliable for filtering.-->
+		<!--TECHNICAL:	For the DestinationPortName, Sysmon uses the GetNameInfo API for the friendly name of ports you see in logs.-->
+		<!--TECHNICAL:	These exe do not initiate their connections, and thus includes do not work in this section: BITSADMIN NLTEST-->
+
+		<!-- https://www.first.org/resources/papers/conf2017/APT-Log-Analysis-Tracking-Attack-Tools-by-Audit-Policy-and-Sysmon.pdf -->
+
+		<!--DATA: UtcTime, ProcessGuid, ProcessId, Image, User, Protocol, Initiated, SourceIsIpv6, SourceIp, SourceHostname, SourcePort, SourcePortName, DestinationIsIpV6, DestinationIp, DestinationHostname, DestinationPort, DestinationPortName-->
+	<RuleGroup name="" groupRelation="or">
+		<NetworkConnect onmatch="include">
+			<!--Suspicious sources for network-connecting binaries-->
+			<Image name="Usermode" condition="begin with">C:\Users</Image> <!--Tools downloaded by users can use other processes for networking, but this is a very valuable indicator.-->
+			<Image name="Caution" condition="begin with">C:\Recycle</Image> <!--Nothing should operate from the RecycleBin locations.-->
+			<Image condition="begin with">C:\ProgramData</Image> <!--Normally, network communications should be sourced from "Program Files" not from ProgramData, something to look at-->
+			<Image condition="begin with">C:\Windows\Temp</Image> <!--Suspicious anything would communicate from the system-level temp directory-->
+			<Image name="Caution" condition="begin with">\</Image> <!--Devices and VSC shouldn't be executing changes | Credit: @SBousseaden @ionstorm @neu5ron @PerchedSystems [ https://twitter.com/SwiftOnSecurity/status/1133167323991486464 ] -->
+			<Image name="Caution" condition="begin with">C:\perflogs</Image> <!-- Credit @blu3_team [ https://blu3-team.blogspot.com/2019/05/netconn-from-suspicious-directories.html ] -->
+			<Image name="Caution" condition="begin with">C:\intel</Image> <!-- Credit @blu3_team [ https://blu3-team.blogspot.com/2019/05/netconn-from-suspicious-directories.html ] -->
+			<Image name="Caution" condition="begin with">C:\Windows\fonts</Image> <!-- Credit @blu3_team [ https://blu3-team.blogspot.com/2019/05/netconn-from-suspicious-directories.html ] -->
+			<Image name="Caution" condition="begin with">C:\Windows\system32\config</Image> <!-- Credit @blu3_team [ https://blu3-team.blogspot.com/2019/05/netconn-from-suspicious-directories.html ] -->
+			<!--Suspicious Windows tools-->
+			<Image condition="image">at.exe</Image> <!--Windows: Remote task scheduling, removed in Win10 | Credit @ion-storm -->
+			<Image condition="image">certutil.exe</Image> <!--Windows: Certificate tool can contact outbound | Credit @ion-storm @FVT [ https://twitter.com/FVT/status/834433734602530817 ] -->
+			<Image condition="image">cmd.exe</Image> <!--Windows: Remote command prompt-->
+			<Image condition="image">cmstp.exe</Image> <!--Windows: Connection manager profiles can launch executables from WebDAV [ https://twitter.com/NickTyrer/status/958450014111633408 ] | Credit @NickTyrer @Oddvarmoe @KyleHanslovan @subTee -->
+			<Image condition="image">cscript.exe</Image> <!--WindowsScriptingHost: | Credit @Cyb3rOps [ https://gist.github.com/Neo23x0/a4b4af9481e01e749409 ] -->
+			<Image condition="image">driverquery.exe</Image> <!--Windows: Remote recognisance of system configuration, oudated/vulnerable drivers -->
+			<Image condition="image">dsquery.exe</Image> <!--Microsoft: Query Active Directory -->
+			<Image condition="image">hh.exe</Image> <!--Windows: HTML Help Executable, opens CHM files -->
+			<Image condition="image">infDefaultInstall.exe</Image> <!--Microsoft: [ https://github.com/huntresslabs/evading-autoruns ] | Credit @KyleHanslovan -->
+			<Image condition="image">java.exe</Image> <!--Java: Monitor usage of vulnerable application and init from JAR files | Credit @ion-storm -->
+			<Image condition="image">javaw.exe</Image> <!--Java: Monitor usage of vulnerable application and init from JAR files -->
+			<Image condition="image">javaws.exe</Image> <!--Java: Monitor usage of vulnerable application and init from JAR files -->
+			<Image condition="image">mmc.exe</Image> <!--Windows: -->
+			<Image condition="image">msbuild.exe</Image> <!--Windows: [ https://www.hybrid-analysis.com/sample/a314f6106633fba4b70f9d6ddbee452e8f8f44a72117749c21243dc93c7ed3ac?environmentId=100 ] -->
+			<Image condition="image">mshta.exe</Image> <!--Windows: HTML application executes scripts without IE protections | Credit @ion-storm [ https://en.wikipedia.org/wiki/HTML_Application ] -->
+			<Image condition="image">msiexec.exe</Image> <!--Windows: Can install from http:// paths | Credit @vector-sec -->
+			<Image condition="image">nbtstat.exe</Image> <!--Windows: NetBIOS statistics, attackers use to enumerate local network -->
+			<Image condition="image">net.exe</Image> <!--Windows: Note - May not detect anything, net.exe is a front-end to lower APIs | Credit @ion-storm -->
+			<Image condition="image">net1.exe</Image> <!--Windows: Launched by "net.exe", but it may not detect connections either -->
+			<Image condition="image">notepad.exe</Image> <!--Windows: [ https://secrary.com/ReversingMalware/CoinMiner/ ] [ https://blog.cobaltstrike.com/2013/08/08/why-is-notepad-exe-connecting-to-the-internet/ ] -->
+			<Image condition="image">nslookup.exe</Image> <!--Windows: Retrieve data over DNS -->
+			<Image condition="image">powershell.exe</Image> <!--Windows: PowerShell interface-->
+			<Image condition="image">powershell_ise.exe</Image> <!--Windows: PowerShell interface-->
+			<Image condition="image">qprocess.exe</Image> <!--Windows: [ https://www.first.org/resources/papers/conf2017/APT-Log-Analysis-Tracking-Attack-Tools-by-Audit-Policy-and-Sysmon.pdf ] -->
+			<Image condition="image">qwinsta.exe</Image> <!--Windows: Query remote sessions | Credit @ion-storm -->
+			<Image condition="image">qwinsta.exe</Image> <!--Windows: Remotely query login sessions on a server or workstation | Credit @ion-storm -->
+			<Image condition="image">reg.exe</Image> <!--Windows: Remote Registry editing ability | Credit @ion-storm -->
+			<Image condition="image">regsvcs.exe</Image> <!--Windows: [ https://www.hybrid-analysis.com/sample/3f94d7080e6c5b8f59eeecc3d44f7e817b31562caeba21d02ad705a0bfc63d67?environmentId=100 ] -->
+			<Image condition="image">regsvr32.exe</Image> <!--Windows: [ https://subt0x10.blogspot.com/2016/04/bypass-application-whitelisting-script.html ] -->
+			<Image condition="image">rundll32.exe</Image> <!--Windows: [ https://blog.cobaltstrike.com/2016/07/22/why-is-rundll32-exe-connecting-to-the-internet/ ] -->
+			<Image condition="image">rwinsta.exe</Image> <!--Windows: Disconnect remote sessions | Credit @ion-storm -->
+			<Image condition="image">sc.exe</Image> <!--Windows: Remotely change Windows service settings | Credit @ion-storm -->
+			<Image condition="image">schtasks.exe</Image> <!--Windows: Command-line interface to local and remote tasks -->
+			<Image condition="image">taskkill.exe</Image> <!--Windows: Kill processes, has remote ability -->
+			<Image condition="image">tasklist.exe</Image> <!--Windows: List processes, has remote ability -->
+			<Image condition="image">wmic.exe</Image> <!--WindowsManagementInstrumentation: Credit @Cyb3rOps [ https://gist.github.com/Neo23x0/a4b4af9481e01e749409 ] -->
+			<Image condition="image">wscript.exe</Image> <!--WindowsScriptingHost: | Credit @arekfurt -->
+			<!--Live of the Land Binaries and scripts (LOLBAS) -->
+			<Image condition="image">bitsadmin.exe</Image> <!-- Windows: Background Intelligent Transfer Service - Can download from URLs -->
+			<Image condition="image">esentutl.exe</Image> <!-- Windows: Database utilities for the ESE - Can fetch from UNC paths -->
+			<Image condition="image">expand.exe</Image> <!-- Windows: Expands one or more compressed files - Can fetch from UNC paths -->
+			<Image condition="image">extrac32.exe</Image> <!--Windows: Uncompress .cab files - Can fetch from UNC paths -->
+			<Image condition="image">findstr.exe</Image> <!-- Windows: Search for strings - Can fetch from UNC paths -->
+			<Image condition="image">GfxDownloadWrapper.exe</Image> <!-- Intel Graphics Control Panel: Remote file download -->
+			<Image condition="image">ieexec.exe</Image> <!-- Windows: Microsoft .NET Framework application - Download and execute from URLs -->
+			<Image condition="image">makecab.exe</Image> <!-- Windows: Packages existing files into a .cab - Can fetch from UNC paths -->
+			<Image condition="image">replace.exe</Image> <!-- Windows: Used to replace file with another file - Can fetch from UNC paths -->
+			<Image condition="image">Excel.exe</Image> <!-- Windows Office: Excel - Can download from URLs -->
+			<Image condition="image">Powerpnt.exe</Image> <!-- Windows Office: PowerPoint - Can download from URLs -->
+			<Image condition="image">Winword.exe</Image> <!-- Windows Office: Word - Can download from URLs -->
+			<Image condition="image">squirrel.exe</Image> <!-- Windows: Update the Nuget/Squirrel packages. Part of Teams. - Can download from URLs -->
+			<!--Relevant 3rd Party Tools-->
+			<Image condition="image">netcat.exe</Image> <!-- Compiled netcat.c file if naming convention is kept https://github.com/DarrenRainey/netcat -->
+			<Image condition="image">nc.exe</Image> <!-- Nmap's modern version of netcat [ https://nmap.org/ncat/guide/index.html#ncat-overview ] [ https://securityblog.gr/1517/create-backdoor-in-windows-with-ncat/ ] -->
+			<Image condition="image">nc64.exe</Image> <!-- 64-bit version of nc that can be used on 64-bit Windows Architectures https://github.com/DarrenRainey/netcat-->
+			<Image condition="image">ncat.exe</Image> <!-- Nmap's modern version of netcat [ https://nmap.org/ncat/guide/index.html#ncat-overview ] [ https://securityblog.gr/1517/create-backdoor-in-windows-with-ncat/ ] -->
+			<Image condition="image">procdump.exe</Image> <!-- Sysinternals Suite client side that can be used to dump clear text passwords from memory -->
+			<Image condition="image">procdump64.exe</Image> <!-- Sysinternals Suite client side 64-bit version that can be used to dump clear text passwords from memory -->
+			<Image condition="image">psexec.exe</Image> <!--Sysinternals:PsExec client side | Credit @Cyb3rOps -->
+			<Image condition="image">psexec64.exe</Image> <!-- Sysinernals:PsExec64 client side | 64-bit version of psexec.exe -->
+			<Image condition="image">psexesvc.exe</Image> <!--Sysinternals:PsExec server side | Credit @Cyb3rOps -->
+			<Image condition="image">tor.exe</Image> <!--Tor [ https://www.hybrid-analysis.com/sample/800bf028a23440134fc834efc5c1e02cc70f05b2e800bbc285d7c92a4b126b1c?environmentId=100 ] -->
+			<Image condition="image">vnc.exe</Image> <!-- VNC client | Credit @Cyb3rOps -->
+			<Image condition="image">vncservice.exe</Image> <!-- VNC server | Credit @Cyb3rOps -->
+			<Image condition="image">vncviewer.exe</Image> <!-- VNC client | Credit @Cyb3rOps -->
+			<Image condition="image">winexesvc.exe</Image> <!-- Winexe service executable | Credit @Cyb3rOps -->
+			<Image condition="image">nmap.exe</Image>
+			<Image condition="image">psinfo.exe</Image>
+			<!--Ports: Suspicious-->
+			<DestinationPort name="SSH" condition="is">22</DestinationPort> <!--SSH protocol, monitor admin connections-->
+			<DestinationPort name="Telnet" condition="is">23</DestinationPort> <!--Telnet protocol, monitor admin connections, insecure-->
+			<DestinationPort name="SMTP" condition="is">25</DestinationPort> <!--SMTP mail protocol port, insecure, used by threats-->
+			<DestinationPort name="IMAP" condition="is">143</DestinationPort> <!--IMAP mail protocol port, insecure, used by threats-->
+			<DestinationPort name="RDP" condition="is">3389</DestinationPort> <!--Windows:RDP: Monitor admin connections-->
+			<DestinationPort name="VNC" condition="is">5800</DestinationPort> <!--VNC protocol: Monitor admin connections, often insecure, using hard-coded admin password-->
+			<DestinationPort name="VNC" condition="is">5900</DestinationPort> <!--VNC protocol Monitor admin connections, often insecure, using hard-coded admin password-->
+			<DestinationPort name="WinRM" condition="is">5985</DestinationPort> <!-- WinRM protocol used for remote connections to execute commands -->
+			<DestinationPort name="WinRM over HTTPS" condition="is">5986</DestinationPort> <!-- WinRM over HTTPS when set up in an environment can be used for remote connections to execute commands -->
+			<DestinationPort name="Alert,Metasploit" condition="is">4444</DestinationPort> <!-- Default Metasploit port -->
+			<!--Ports: Proxy-->
+			<DestinationPort name="Proxy" condition="is">1080</DestinationPort> <!--Socks proxy port | Credit @ion-storm-->
+			<DestinationPort name="Proxy" condition="is">3128</DestinationPort> <!--Socks proxy port | Credit @ion-storm-->
+			<DestinationPort name="Proxy" condition="is">8080</DestinationPort> <!--Socks proxy port | Credit @ion-storm-->
+			<!--Ports: Tor-->
+			<DestinationPort name="Tor" condition="is">1723</DestinationPort> <!--Tor protocol [ https://attack.mitre.org/wiki/Technique/T1090 ] | Credit @ion-storm-->
+			<DestinationPort name="Tor" condition="is">9001</DestinationPort> <!--Tor protocol [ http://www.computerworlduk.com/tutorial/security/tor-enterprise-2016-blocking-malware-darknet-use-rogue-nodes-3633907/ ] -->
+			<DestinationPort name="Tor" condition="is">9030</DestinationPort> <!--Tor protocol [ http://www.computerworlduk.com/tutorial/security/tor-enterprise-2016-blocking-malware-darknet-use-rogue-nodes-3633907/ ] -->
+		</NetworkConnect>
+	</RuleGroup>
+
+	<RuleGroup name="" groupRelation="or">
+		<NetworkConnect onmatch="exclude">
+			<!--SECTION: Microsoft-->
+			<Image condition="begin with">C:\ProgramData\Microsoft\Windows Defender\Platform\</Image>
+			<Image condition="end with">AppData\Local\Microsoft\Teams\current\Teams.exe</Image> <!--Microsoft: Teams-->
+			<DestinationHostname condition="is">microsoft.com</DestinationHostname> <!--Microsoft:Update delivery-->
+			<DestinationHostname condition="end with">.microsoft.com</DestinationHostname> <!--Microsoft:Update delivery-->
+			<DestinationHostname condition="end with">microsoft.com.akadns.net</DestinationHostname> <!--Microsoft:Update delivery-->
+			<DestinationHostname condition="end with">microsoft.com.nsatc.net</DestinationHostname> <!--Microsoft:Update delivery-->
+			<!--OCSP known addresses-->
+			<DestinationIp condition="is">23.4.43.27</DestinationIp> <!--Digicert [ https://otx.alienvault.com/indicator/ip/23.4.43.27 ] -->
+			<DestinationIp condition="is">72.21.91.29</DestinationIp> <!--Digicert [ https://otx.alienvault.com/indicator/ip/72.21.91.29 ] -->
+			<!--Section: Loopback Addresses-->
+			<DestinationIp condition="is">127.0.0.1</DestinationIp> <!--Credit @ITProPaul-->
+			<DestinationIp condition="begin with">fe80:0:0:0</DestinationIp> <!--Credit @ITProPaul-->
+			<!-- OneDrive -->
+			<Image condition="end with">\AppData\Local\Microsoft\OneDrive\OneDrive.exe</Image> <!--Microsoft: OneDrive-->
+			<!-- SECTION: Azure OMS/MMA Agent -->
+			<Image condition="begin with">C:\Program Files\Microsoft Monitoring Agent\</Image>
+			<Image condition="begin with">C:\Program Files\OMS Gateway\</Image>
+			<!-- SECTION: PRTG -->
+			<Image condition="is">C:\Program Files (x86)\PRTG Network Monitor\PRTG Probe.exe</Image>
+		</NetworkConnect>
+	</RuleGroup>
+
+	<!--SYSMON EVENT ID 4 : RESERVED FOR SYSMON SERVICE STATUS MESSAGES-->
+
+		<!--DATA: UtcTime, State, Version, SchemaVersion-->
+		<!--Cannot be filtered.-->
+
+	<!--SYSMON EVENT ID 5 : PROCESS ENDED [ProcessTerminate]-->
+		<!--COMMENT:	Useful data in building infection timelines.-->
+
+		<!--DATA: UtcTime, ProcessGuid, ProcessId, Image-->
+	<RuleGroup name="" groupRelation="or">
+		<ProcessTerminate onmatch="include">
+			<Image condition="begin with">C:\Users</Image> <!--Process terminations by user binaries-->
+			<Image condition="begin with">\</Image> <!--Devices and VSC shouldn't be executing changes | Credit: @SBousseaden @ionstorm @neu5ron @PerchedSystems [ https://twitter.com/SwiftOnSecurity/status/1133167323991486464 ] -->
+		</ProcessTerminate>
+	</RuleGroup>
+
+	<RuleGroup name="" groupRelation="or">
+		<ProcessTerminate onmatch="exclude">
+		</ProcessTerminate>
+	</RuleGroup>
+
+	<!--SYSMON EVENT ID 6 : DRIVER LOADED INTO KERNEL [DriverLoad]-->
+		<!--COMMENT:	Because drivers with bugs can be used to escalate to kernel permissions, be extremely selective
+			about what you exclude from monitoring. Low event volume, little incentive to exclude.
+			[ https://attack.mitre.org/wiki/Technique/T1014 ] -->
+		<!--TECHNICAL:	Sysmon will check the signing certificate revocation status of any driver you don't exclude.-->
+
+		<!--DATA: UtcTime, ImageLoaded, Hashes, Signed, Signature, SignatureStatus-->
+	<RuleGroup name="" groupRelation="or">
+		<DriverLoad onmatch="exclude">
+			<Signature condition="contains">microsoft</Signature> <!--Exclude signed Microsoft drivers-->
+			<Signature condition="contains">windows</Signature> <!--Exclude signed Microsoft drivers-->
+			<Signature condition="begin with">Intel </Signature> <!--Exclude signed Intel drivers-->
+		</DriverLoad>
+	</RuleGroup>
+
+	<!--SYSMON EVENT ID 7 : DLL (IMAGE) LOADED BY PROCESS [ImageLoad]-->
+		<!--COMMENT:	Can cause high system load, disabled by default.-->
+		<!--COMMENT:	[ https://attack.mitre.org/wiki/Technique/T1073 ] [ https://attack.mitre.org/wiki/Technique/T1038 ] [ https://attack.mitre.org/wiki/Technique/T1034 ] -->
+
+		<!--DATA: UtcTime, ProcessGuid, ProcessId, Image, ImageLoaded, Hashes, Signed, Signature, SignatureStatus-->
+	<RuleGroup name="" groupRelation="or">
+		<ImageLoad onmatch="include">
+			<!--NOTE: Using "include" with no rules means nothing in this section will be logged-->
+		</ImageLoad>
+	</RuleGroup>
+
+	<!--SYSMON EVENT ID 8 : REMOTE THREAD CREATED [CreateRemoteThread]-->
+		<!--COMMENT:	Monitor for processes injecting code into other processes. Often used by malware to cloak their actions. Also when Firefox loads Flash.
+		[ https://attack.mitre.org/wiki/Technique/T1055 ] -->
+
+		<!--DATA: UtcTime, SourceProcessGuid, SourceProcessId, SourceImage, TargetProcessId, TargetImage, NewThreadId, StartAddress, StartModule, StartFunction-->
+	<RuleGroup name="" groupRelation="or">
+		<CreateRemoteThread onmatch="exclude">
+			<!--COMMENT: Exclude mostly-safe sources and log anything else.-->
+			<SourceImage condition="is">C:\Windows\system32\wbem\WmiPrvSE.exe</SourceImage>
+			<SourceImage condition="is">C:\Windows\system32\svchost.exe</SourceImage>
+			<SourceImage condition="is">C:\Windows\system32\wininit.exe</SourceImage>
+			<SourceImage condition="is">C:\Windows\system32\csrss.exe</SourceImage>
+			<SourceImage condition="is">C:\Windows\system32\services.exe</SourceImage>
+			<SourceImage condition="is">C:\Windows\system32\winlogon.exe</SourceImage>
+			<SourceImage condition="is">C:\Windows\system32\audiodg.exe</SourceImage>
+			<StartModule condition="is">C:\Windows\system32\kernel32.dll</StartModule>
+			<TargetImage condition="is">C:\Program Files (x86)\Google\Chrome\Application\chrome.exe</TargetImage>
+		</CreateRemoteThread>
+	</RuleGroup>
+
+	<!--SYSMON EVENT ID 9 : RAW DISK ACCESS [RawAccessRead]-->
+		<!--EVENT 9: "RawAccessRead detected"-->
+		<!--COMMENT:	Can cause high system load, disabled by default.-->
+		<!--COMMENT:	Monitor for raw sector-level access to the disk, often used to bypass access control lists or access locked files.
+			Disabled by default since including even one entry here activates this component. Reward/performance/rule maintenance decision.
+			Encourage you to experiment with this feature yourself. [ https://attack.mitre.org/wiki/Technique/T1067 ] -->
+		<!--COMMENT:	You will likely want to set this to a full capture on domain controllers, where no process should be doing raw reads.-->
+
+		<!--DATA: UtcTime, ProcessGuid, ProcessId, Image, Device-->
+	<RuleGroup name="" groupRelation="or">
+		<RawAccessRead onmatch="include">
+			<!--NOTE: Using "include" with no rules means nothing in this section will be logged-->
+		</RawAccessRead>
+	</RuleGroup>
+
+	<!--SYSMON EVENT ID 10 : INTER-PROCESS ACCESS [ProcessAccess]-->
+		<!--EVENT 10: "Process accessed"-->
+		<!--COMMENT:	Can cause high system load, disabled by default.-->
+		<!--COMMENT:	Monitor for processes accessing other process' memory.-->
+
+		<!--DATA: UtcTime, SourceProcessGuid, SourceProcessId, SourceThreadId, SourceImage, TargetProcessGuid, TargetProcessId, TargetImage, GrantedAccess, CallTrace-->
+	<RuleGroup name="" groupRelation="or">
+		<ProcessAccess onmatch="include">
+			<!-- CobaltStrike BOF using OpenProcess/NtOpenProcess Ref: https://medium.com/falconforce/falconfriday-direct-system-calls-and-cobalt-strike-bofs-0xff14-741fa8e1bdd6 -->
+			<CallTrace condition="begin with">UNKNOWN</CallTrace>
+			<!-- Typical ProcessAccess Pattern of CobaltStrike BOF Ref: e.g. https://github.com/boku7/injectAmsiBypass -->
+			<Rule groupRelation="and">
+				<CallTrace condition="contains">UNKNOWN</CallTrace>
+				<GrantedAccess condition="contains any">0x1028;0x1fffff</GrantedAccess>
+			</Rule>
+			<!-- lsass.exe access with critical permission -->
+			<Rule groupRelation="and">
+				<TargetImage condition="end with">lsass.exe</TargetImage>
+				<GrantedAccess condition="contains any">0x40;0x1000;0x1010;0x1038;0x1410;0x1418;0x1438;0x143a;0x100000;0x1f0fff;0x1f1fff;0x1f2fff;0x1f3fff;0x1fffff</GrantedAccess> <!--0x1400 too noisy-->
+			</Rule>
+			<!-- LittleCorporal generated MalDoc Ref: https://github.com/connormcgarr/LittleCorporal -->
+			<Rule groupRelation="and">
+				<SourceImage condition="contains">winword.exe</SourceImage>
+				<CallTrace condition="contains">:\Windows\Microsoft.NET\Framework64\v2.</CallTrace>
+				<CallTrace condition="contains">UNKNOWN</CallTrace>
+			</Rule>
+		</ProcessAccess>
+	</RuleGroup>
+
+	<RuleGroup name="" groupRelation="or">
+		<ProcessAccess onmatch="exclude">
+			<!-- NOTE: Potentially noisy ProcessAccess Events in your environment can be excluded here -->
+		</ProcessAccess>
+	</RuleGroup>
+
+	<!--SYSMON EVENT ID 11 : FILE CREATED [FileCreate]-->
+		<!--EVENT 11: "File created"-->
+		<!--NOTE:	Other filesystem "minifilters" can make it appear to Sysmon that some files are being written twice. This is not a Sysmon issue, per Mark Russinovich.-->
+		<!--NOTE:	You may not see files detected by antivirus. Other filesystem minifilters, like antivirus, can act before Sysmon receives the alert a file was written.-->
+
+		<!--DATA: UtcTime, ProcessGuid, ProcessId, Image, TargetFilename, CreationUtcTime-->
+	<RuleGroup name="" groupRelation="or">
+		<FileCreate onmatch="include">
+			<TargetFilename name="T1023" condition="contains">\Start Menu</TargetFilename> <!--Windows: Startup links and shortcut modification [ https://attack.mitre.org/wiki/Technique/T1023 ] -->
+			<TargetFilename name="T1165" condition="contains">\Startup\</TargetFilename> <!--Microsoft:Changes to user's auto-launched files and shortcuts-->
+			<TargetFilename name="OutlookAttachment" condition="contains">\Content.Outlook\</TargetFilename> <!--Microsoft:Outlook: attachments-->
+			<TargetFilename name="Downloads" condition="contains">\Downloads\</TargetFilename> <!--Downloaded files. Does not include "Run" files in IE-->
+			<TargetFilename condition="end with">.application</TargetFilename> <!--Microsoft:ClickOnce: [ https://blog.netspi.com/all-you-need-is-one-a-clickonce-love-story/ ] -->
+			<TargetFilename condition="end with">.appref-ms</TargetFilename> <!--Microsoft:ClickOnce application | Credit @ion-storm -->
+			<TargetFilename condition="end with">.bat</TargetFilename> <!--Batch scripting-->
+			<TargetFilename condition="end with">.chm</TargetFilename>
+			<TargetFilename condition="end with">.cmd</TargetFilename> <!--Batch scripting: Batch scripts can also use the .cmd extension | Credit: @mmazanec -->
+			<TargetFilename condition="end with">.cmdline</TargetFilename> <!--Microsoft:dotNet: Executed by cvtres.exe-->
+			<TargetFilename name="T1176" condition="end with">.crx</TargetFilename> <!--Chrome extension-->
+			<TargetFilename condition="end with">.dmp</TargetFilename> <!--Process dumps [ (fr) http://blog.gentilkiwi.com/securite/mimikatz/minidump ] -->
+			<TargetFilename condition="end with">.docm</TargetFilename> <!--Microsoft:Office:Word: Macro-->
+			<TargetFilename name="DLL" condition="end with">.dll</TargetFilename> <!--Microsoft:Office:Word: Macro-->
+			<TargetFilename name="EXE" condition="end with">.exe</TargetFilename> <!--Executable-->
+			<TargetFilename name="ProcessHostingdotNETCode" condition="end with">.exe.log</TargetFilename> <!-- [ https://github.com/bitsadmin/nopowershell ] | Credit: @SBousseaden [ https://twitter.com/SBousseaden/status/1137493597769687040 ] -->
+			<TargetFilename condition="end with">.jar</TargetFilename> <!--Java applets-->
+			<TargetFilename condition="end with">.jnlp</TargetFilename> <!--Java applets-->
+			<TargetFilename condition="end with">.jse</TargetFilename> <!--Scripting [ Example: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Mal~Phires-C/detailed-analysis.aspx ] -->
+			<TargetFilename condition="end with">.hta</TargetFilename> <!--Scripting-->
+			<TargetFilename condition="end with">.aspx</TargetFilename> <!--Scripting-->
+			<TargetFilename condition="end with">.asp</TargetFilename> <!--Scripting-->
+			<TargetFilename condition="end with">.job</TargetFilename> <!--Scheduled task-->
+			<TargetFilename condition="end with">.pptm</TargetFilename> <!--Microsoft:Office:Word: Macro-->
+			<TargetFilename condition="end with">.ps1</TargetFilename> <!--PowerShell [ More information: http://www.hexacorn.com/blog/2014/08/27/beyond-good-ol-run-key-part-16/ ] -->
+			<TargetFilename condition="end with">.sct</TargetFilename> <!--Scripting | Credit @bartblaze -->
+			<TargetFilename condition="end with">.sys</TargetFilename> <!--System driver files-->
+			<TargetFilename condition="end with">.scr</TargetFilename> <!--System driver files-->
+			<TargetFilename condition="end with">.vbe</TargetFilename> <!--VisualBasicScripting-->
+			<TargetFilename condition="end with">.vbs</TargetFilename> <!--VisualBasicScripting-->
+			<TargetFilename condition="end with">.wsc</TargetFilename> <!--Scripting | Credit @bartblaze -->
+			<TargetFilename condition="end with">.wsf</TargetFilename> <!--Scripting | Credit @bartblaze -->
+			<TargetFilename condition="end with">.xlsm</TargetFilename> <!--Microsoft:Office:Word: Macro-->
+			<TargetFilename condition="end with">.ocx</TargetFilename> <!--Microsoft:ActiveX-->
+			<TargetFilename condition="end with">.kirbi</TargetFilename> <!--Mimikatz Kerberos Ticket Files-->
+			<TargetFilename condition="end with">proj</TargetFilename><!--Microsoft:MSBuild:Script: [ https://twitter.com/subTee/status/885919612969394177 ] -->
+			<TargetFilename condition="end with">.sln</TargetFilename><!--Microsoft:MSBuild:Script: [ https://twitter.com/subTee/status/885919612969394177 ] -->
+			<TargetFilename condition="end with">.xls</TargetFilename><!--Microsoft [ https://medium.com/@threathuntingteam/msxsl-exe-and-wmic-exe-a-way-to-proxy-code-execution-8d524f642b75 ] -->
+			<TargetFilename name="DefaultUserModified" condition="begin with">C:\Users\Default</TargetFilename> <!--Windows: Changes to default user profile-->
+			<TargetFilename condition="begin with">C:\Windows\system32\Drivers</TargetFilename> <!--Microsoft: Drivers dropped here-->
+			<TargetFilename condition="begin with">C:\Windows\SysWOW64\Drivers</TargetFilename> <!--Microsoft: Drivers dropped here-->
+			<TargetFilename name="T1003" condition="end with">\Windows\System32\mimilsa.log</TargetFilename> <!--Detects usage of Mimikatz Security Package (mimilib.dll) to dump security passwords in clear text https://pentestlab.blog/2019/10/21/persistence-security-support-provider/ -->
+			<TargetFilename name="T1003" condition="end with">\Windows\System32\kiwissp.log</TargetFilename> <!--Detects usage of old Mimikatz Security Package (mimilib.dll) to dump security passwords in clear text https://pentestlab.blog/2019/10/21/persistence-security-support-provider/ -->
+			<TargetFilename name="T1037,T1484" condition="begin with">C:\Windows\system32\GroupPolicy\Machine\Scripts</TargetFilename> <!--Group policy [ More information: http://www.hexacorn.com/blog/2017/01/07/beyond-good-ol-run-key-part-52/ ] -->
+			<TargetFilename name="T1037,T1484" condition="begin with">C:\Windows\system32\GroupPolicy\User\Scripts</TargetFilename> <!--Group policy [ More information: http://www.hexacorn.com/blog/2017/01/07/beyond-good-ol-run-key-part-52/ ] -->
+			<TargetFilename condition="begin with">C:\Windows\system32\Wbem</TargetFilename> <!--Microsoft:WMI: [ More information: http://2014.hackitoergosum.org/slides/day1_WMI_Shell_Andrei_Dumitrescu.pdf ] -->
+			<TargetFilename condition="begin with">C:\Windows\SysWOW64\Wbem</TargetFilename> <!--Microsoft:WMI: [ More information: http://2014.hackitoergosum.org/slides/day1_WMI_Shell_Andrei_Dumitrescu.pdf ] -->
+			<TargetFilename condition="begin with">C:\Windows\system32\WindowsPowerShell</TargetFilename> <!--Microsoft:Powershell: Look for modifications for persistence [ https://www.malwarearchaeology.com/cheat-sheets ] -->
+			<TargetFilename condition="begin with">C:\Windows\SysWOW64\WindowsPowerShell</TargetFilename> <!--Microsoft:Powershell: Look for modifications for persistence [ https://www.malwarearchaeology.com/cheat-sheets ] -->
+			<TargetFilename name="T1053" condition="begin with">C:\Windows\Tasks\</TargetFilename> <!--Microsoft:ScheduledTasks [ https://attack.mitre.org/wiki/Technique/T1053 ] -->
+			<TargetFilename name="T1053" condition="begin with">C:\Windows\system32\Tasks</TargetFilename> <!--Microsoft:ScheduledTasks [ https://attack.mitre.org/wiki/Technique/T1053 ] -->
+			<TargetFilename name="T1053" condition="begin with">C:\Windows\SysWOW64\Tasks</TargetFilename> <!--Microsoft:ScheduledTasks [ https://attack.mitre.org/wiki/Technique/T1053 ] -->
+			<Image condition="begin with">\Device\HarddiskVolumeShadowCopy</Image> <!--Nothing should be executing from VSC | Credit: @SBousseaden [ https://twitter.com/SBousseaden/status/1133030955407630336 ] -->
+			<!--Windows application compatibility-->
+			<TargetFilename condition="begin with">C:\Windows\AppPatch\Custom</TargetFilename> <!--Windows: Application compatibility shims [ https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html ] -->
+			<TargetFilename condition="contains">VirtualStore</TargetFilename> <!--Windows: UAC virtualization [ https://blogs.msdn.microsoft.com/oldnewthing/20150902-00/?p=91681 ] -->
+			<!--Exploitable file names-->
+			<TargetFilename condition="end with">.xls</TargetFilename> <!--Legacy Office files are often used for attacks-->
+			<TargetFilename condition="end with">.ppt</TargetFilename> <!--Legacy Office files are often used for attacks-->
+			<TargetFilename condition="end with">.rtf</TargetFilename> <!--RTF files often 0day malware vectors when opened by Office-->
+			<!-- Possible dropped webshells -->
+			<TargetFilename condition="end with">.php</TargetFilename> <!-- possible dropped webshell -->
+			<TargetFilename condition="end with">.asp</TargetFilename> <!-- possible dropped webshell -->
+			<TargetFilename condition="end with">.aspx</TargetFilename> <!-- possible dropped webshell -->
+			<TargetFilename condition="end with">.ashx</TargetFilename> <!-- possible dropped webshell -->
+			<TargetFilename condition="end with">.jsp</TargetFilename> <!-- possible dropped webshell -->
+			<TargetFilename condition="end with">.pl</TargetFilename> <!-- possible dropped webshell -->
+			<TargetFilename condition="contains">\SAM-20</TargetFilename> <!-- Default output of HiveNightmare / SeriousSAM tools -->
+			<TargetFilename condition="contains">\SAM-haxx</TargetFilename> <!-- Default output of HiveNightmare / SeriousSAM tools -->
+			<TargetFilename condition="contains">\Sam.save</TargetFilename> <!-- Default output of HiveNightmare / SeriousSAM tools -->
+			<TargetFilename condition="contains">\hive_sam_</TargetFilename> <!-- Default output of HiveNightmare / SeriousSAM tools -->
+			<TargetFilename condition="is">C:\windows\temp\sam</TargetFilename> <!-- Default output of HiveNightmare / SeriousSAM tools -->
+			<TargetFilename condition="begin with">C:\Windows\System32\spool\drivers\x64</TargetFilename> <!-- PrinterNight -->
+			<Rule groupRelation="and"> <!-- CVE-2021-40444 https://twitter.com/RonnyTNL/status/1436334640617373699 -->
+				<Image condition="end with">\WINWORD.EXE</Image>
+				<TargetFilename condition="contains any">.cab;.inf</TargetFilename>
+			</Rule>
+		</FileCreate>
+	</RuleGroup>
+
+	<RuleGroup name="" groupRelation="or">
+		<FileCreate onmatch="exclude">
+			<!--SECTION: Microsoft-->
+			<Image condition="is">C:\Program Files (x86)\EMET 5.5\EMET_Service.exe</Image> <!--Microsoft:EMET: Writes to C:\Windows\AppPatch\-->
+			<!--SECTION: Microsoft:Office:Click2Run-->
+			<Image condition="is">C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe</Image> <!-- Microsoft:Office Click2Run-->
+			<!--SECTION: Windows-->
+			<Image condition="is">C:\Windows\system32\smss.exe</Image> <!-- Windows: Session Manager SubSystem: Creates swapfile.sys,pagefile.sys,hiberfile.sys-->
+			<Image condition="is">C:\Windows\system32\CompatTelRunner.exe</Image> <!-- Windows: Windows 10 app, creates tons of cache files-->
+			<Image condition="is">\\?\C:\Windows\system32\wbem\WMIADAP.EXE</Image> <!-- Windows: WMI Performance updates-->
+			<Image condition="is">C:\Windows\system32\mobsync.exe</Image> <!--Windows: Network file syncing-->
+			<Image condition="is">C:\Windows\System32\WUDFHost.exe</Image> <!--Windows: Windows User-Mode Driver Framework Host. Safe as long as in the correct path. -->
+			<TargetFilename condition="begin with">C:\Windows\system32\DriverStore\Temp\</TargetFilename> <!-- Windows: Temp files by DrvInst.exe-->
+			<TargetFilename condition="begin with">C:\Windows\system32\wbem\Performance\</TargetFilename> <!-- Windows: Created in wbem by WMIADAP.exe-->
+			<TargetFilename condition="begin with">C:\Windows\Installer\</TargetFilename> <!--Windows:Installer: Ignore MSI installer files caching-->
+			<!--SECTION: Windows:Updates-->
+			<TargetFilename condition="begin with">C:\$WINDOWS.~BT\Sources\</TargetFilename> <!-- Windows: Feature updates containing lots of .exe and .sys-->
+			<Image condition="begin with">C:\Windows\winsxs\amd64_microsoft-windows</Image> <!-- Windows: Windows update-->
+		</FileCreate>
+	</RuleGroup>
+
+	<!--SYSMON EVENT ID 12 & 13 & 14 : REGISTRY MODIFICATION [RegistryEvent]-->
+		<!--EVENT 12: "Registry object added or deleted"-->
+		<!--EVENT 13: "Registry value set"-->
+		<!--EVENT 14: "Registry objected renamed"-->
+
+		<!--NOTE:	Windows writes hundreds or thousands of registry keys a minute, so just because you're not changing things, doesn't mean these rules aren't being run.-->
+		<!--NOTE:	You do not have to spend a lot of time worrying about performance, CPUs are fast, but it's something to consider. Every rule and condition type has a small cost.-->
+		<!--NOTE:	"contains" works by finding the first letter, then matching the second, etc, so the first letters should be as low-occurrence as possible.-->
+		<!--NOTE:	[ https://attack.mitre.org/wiki/Technique/T1112 ] -->
+
+		<!--TECHNICAL:	You cannot filter on the "Details" attribute, due to performance issues when very large keys are written, and variety of data formats-->
+		<!--TECHNICAL:	Possible prefixes are HKLM, HKCR, and HKU-->
+		<!--CRITICAL:	Schema version 3.30 and higher change HKLM\="\REGISTRY\MACHINE\" and HKU\="\REGISTRY\USER\" and HKCR\="\REGISTRY\MACHINE\SOFTWARE\Classes\" and CurrentControlSet="ControlSet001"-->
+		<!--CRITICAL:	Due to a bug, Sysmon versions BEFORE 7.01 may not properly log with the new prefix style for registry keys that was originally introduced in schema version 3.30-->
+		<!--NOTE:	Because Sysmon runs as a service, it has no filtering ability for, or concept of, HKCU or HKEY_CURRENT_USER. Use "contains" or "end with" to get around this limitation-->
+
+		<!-- ! CRITICAL NOTE !:	It may appear this section is MISSING important entries, but SOME RULES MONITOR MANY KEYS, so look VERY CAREFULLY to see if something is already covered.
+								Sysmon's wildcard monitoring along with highly-tuned generic strings cuts the rulesets down immensely, compared to doing this in other tools.
+								For example, most COM hijacking in CLSID's across the registry is covered by a single rule monitoring a InProcServer32 wildcard-->
+
+		<!--DATA: EventType, UtcTime, ProcessGuid, ProcessId, Image, TargetObject, Details (can't filter on), NewName (can't filter on)-->
+	<RuleGroup name="" groupRelation="or">
+		<RegistryEvent onmatch="include">
+			<!--Autorun or Startups-->
+				<!--ADDITIONAL REFERENCE: [ http://www.ghacks.net/2016/06/04/windows-automatic-startup-locations/ ] -->
+				<!--ADDITIONAL REFERENCE: [ https://view.officeapps.live.com/op/view.aspx?src=https://arsenalrecon.com/downloads/resources/Registry_Keys_Related_to_Autorun.ods ] -->
+				<!--ADDITIONAL REFERENCE: [ http://www.silentrunners.org/launchpoints.html ] -->
+				<!--ADDITIONAL REFERENCE: [ https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2 ] -->
+				<!--ADDITIONAL REFERENCE: [ https://web.archive.org/web/20200116001643/http://scholarworks.rit.edu/cgi/viewcontent.cgi?article=1533&context=theses | Understanding malware autostart techniques - Matthew Gottlieb ] -->
+			<TargetObject name="T1562.002" condition="end with">\MiniNT</TargetObject> <!--Windows: Disable eventlog by acting like WinPE [https://twitter.com/0gtweet/status/1182516740955226112] -->
+			<TargetObject name="T1060,RunKey" condition="contains">CurrentVersion\Run</TargetObject> <!--Windows: Wildcard for Run keys, including RunOnce, RunOnceEx, RunServices, RunServicesOnce [Also covers terminal server] -->
+			<TargetObject name="T1060,RunPolicy" condition="contains">Policies\Explorer\Run</TargetObject> <!--Windows: Alternate runs keys | Credit @ion-storm-->
+			<TargetObject name="T1484" condition="contains">Group Policy\Scripts</TargetObject> <!--Windows: Group policy scripts-->
+			<TargetObject name="T1484" condition="contains">Windows\System\Scripts</TargetObject> <!--Windows: Wildcard for Logon, Loggoff, Shutdown-->
+			<TargetObject name="T1060" condition="contains">CurrentVersion\Windows\Load</TargetObject> <!--Windows: [ https://msdn.microsoft.com/en-us/library/jj874148.aspx ] -->
+			<TargetObject name="T1060" condition="contains">CurrentVersion\Windows\Run</TargetObject> <!--Windows: [ https://msdn.microsoft.com/en-us/library/jj874148.aspx ] -->
+			<TargetObject name="T1060" condition="contains">CurrentVersion\Winlogon\Shell</TargetObject> <!--Windows: [ https://msdn.microsoft.com/en-us/library/ms838576(v=winembedded.5).aspx ] -->
+			<TargetObject name="T1060" condition="contains">CurrentVersion\Winlogon\System</TargetObject> <!--Windows [ https://www.exterminate-it.com/malpedia/regvals/zlob-dns-changer/118 ] -->
+			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify</TargetObject> <!--Windows: Autorun location [ https://attack.mitre.org/wiki/Technique/T1004 ] [ https://www.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order ] -->
+			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell</TargetObject> <!--Windows: [ https://technet.microsoft.com/en-us/library/ee851671.aspx ] -->
+			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit</TargetObject> <!--Windows: Autorun location [ https://www.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order ] -->
+			<TargetObject condition="begin with">HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32</TargetObject> <!--Windows: Legacy driver loading | Credit @ion-storm -->
+			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute</TargetObject> <!--Windows: Autorun | Credit @ion-storm | [ https://www.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order ] -->
+			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug</TargetObject> <!--Windows: Automatic program crash debug program [ https://www.symantec.com/security_response/writeup.jsp?docid=2007-050712-5453-99&tabid=2 ] -->
+			<TargetObject condition="contains">UserInitMprLogonScript</TargetObject> <!--Windows: Legacy logon script environment variable [ http://www.hexacorn.com/blog/2014/11/14/beyond-good-ol-run-key-part-18/ ] -->
+			<TargetObject name="T1112,ChangeStartupFolderPath" condition="end with">user shell folders\startup</TargetObject> <!--Monitor changes to Startup folder location for monitoring evasion | Credit @SBousseaden-->
+			<!--Services-->
+			<TargetObject name="T1031,T1050" condition="end with">\ServiceDll</TargetObject> <!--Windows: Points to a service's DLL [ https://blog.cylance.com/windows-registry-persistence-part-1-introduction-attack-phases-and-windows-services ] -->
+			<TargetObject name="T1031,T1050" condition="end with">\ServiceManifest</TargetObject> <!--Windows: Manifest pointing to service's DLL [ https://www.geoffchappell.com/studies/windows/win32/services/svchost/index.htm ] -->
+			<TargetObject name="T1031,T1050" condition="end with">\ImagePath</TargetObject> <!--Windows: Points to a service's EXE [ https://attack.mitre.org/wiki/Technique/T1050 ] -->
+			<TargetObject name="T1031,T1050" condition="end with">\Start</TargetObject> <!--Windows: Services start mode changes (Disabled, Automatically, Manual)-->
+			<!--RDP-->
+			<TargetObject name="RDP port change" condition="end with">Control\Terminal Server\WinStations\RDP-Tcp\PortNumber</TargetObject> <!--Windows: RDP port change under Control [ https://blog.menasec.net/2019/02/of-rdp-hijacking-part1-remote-desktop.html ]-->
+			<TargetObject name="RDP port change" condition="end with">Control\Terminal Server\fSingleSessionPerUser</TargetObject> <!--Windows: Allow same user to have mutliple RDP sessions, to hide from admin being impersonated-->
+			<TargetObject name="ModifyRemoteDesktopState" condition="end with">fDenyTSConnections</TargetObject> <!--Windows: Attacker turning on RDP-->
+			<TargetObject condition="end with">LastLoggedOnUser</TargetObject> <!--Windows: Changing last-logged in user-->
+			<TargetObject name="ModifyRemoteDesktopPort" condition="end with">RDP-tcp\PortNumber</TargetObject> <!--Windows: Changing RDP port to evade IDS-->
+			<TargetObject condition="end with">Services\PortProxy\v4tov4</TargetObject> <!--Windows: Changing RDP port to evade IDS-->
+			<TargetObject condition="contains">\Microsoft\Terminal Server Client\Default\MRU</TargetObject> <!-- MSTSC Connection History -->
+			<TargetObject condition="contains">\Microsoft\Terminal Server Client\Servers\</TargetObject> <!-- MSTSC Connection History -->
+			<!--CLSID launch commands and Default File Association changes-->
+			<TargetObject name="T1042" condition="contains">\command\</TargetObject> <!--Windows: Sensitive sub-key under file associations and CLSID that map to launch command-->
+			<TargetObject name="T1122" condition="contains">\ddeexec\</TargetObject> <!--Windows: Sensitive sub-key under file associations and CLSID that map to launch command-->
+			<TargetObject name="T1122" condition="contains">{86C86720-42A0-1069-A2E8-08002B30309D}</TargetObject> <!--Windows: Tooltip handler-->
+			<TargetObject name="T1042" condition="contains">exefile</TargetObject> <!--Windows Executable handler, to log any changes not already monitored-->
+			<!--Windows COM-->
+			<TargetObject name="T1122" condition="end with">\InprocServer32\(Default)</TargetObject> <!--Windows:COM Object Hijacking [ https://blog.gdatasoftware.com/2014/10/23941-com-object-hijacking-the-discreet-way-of-persistence ] | Credit @ion-storm -->
+			<!--Windows shell visual modifications used by malware-->
+			<TargetObject name="T1158" condition="end with">\Hidden</TargetObject> <!--Windows:Explorer: Some types of malware try to hide their hidden system files from the user, good signal event -->
+			<TargetObject name="T1158" condition="end with">\ShowSuperHidden</TargetObject> <!--Windows:Explorer: Some types of malware try to hide their hidden system files from the user, good signal event [ Example: https://www.symantec.com/security_response/writeup.jsp?docid=2007-061811-4341-99&tabid=2 ] -->
+			<TargetObject name="T1158" condition="end with">\HideFileExt</TargetObject> <!--Windows:Explorer: Some malware hides file extensions to make diagnosis/disinfection more daunting to novice users -->
+			<!--Windows shell hijack and modifications-->
+			<TargetObject condition="contains">Classes\*\</TargetObject> <!--Windows:Explorer: [ http://www.silentrunners.org/launchpoints.html ] -->
+			<TargetObject condition="contains">Classes\AllFilesystemObjects\</TargetObject> <!--Windows:Explorer: [ http://www.silentrunners.org/launchpoints.html ] -->
+			<TargetObject condition="contains">Classes\Directory\</TargetObject> <!--Windows:Explorer: [ https://stackoverflow.com/questions/1323663/windows-shell-context-menu-option ] -->
+			<TargetObject condition="contains">Classes\Drive\</TargetObject> <!--Windows:Explorer: [ https://stackoverflow.com/questions/1323663/windows-shell-context-menu-option ] -->
+			<TargetObject condition="contains">Classes\Folder\</TargetObject> <!--Windows:Explorer: ContextMenuHandlers, DragDropHandlers, CopyHookHandlers, [ https://stackoverflow.com/questions/1323663/windows-shell-context-menu-option ] -->
+			<TargetObject condition="contains">Classes\PROTOCOLS\</TargetObject> <!--Windows:Explorer: Protocol handlers-->
+			<TargetObject condition="contains">ContextMenuHandlers\</TargetObject> <!--Windows: [ http://oalabs.openanalysis.net/2015/06/04/malware-persistence-hkey_current_user-shell-extension-handlers/ ] -->
+			<TargetObject condition="contains">CurrentVersion\Shell</TargetObject> <!--Windows: Shell Folders, ShellExecuteHooks, ShellIconOverloadIdentifers, ShellServiceObjects, ShellServiceObjectDelayLoad [ http://oalabs.openanalysis.net/2015/06/04/malware-persistence-hkey_current_user-shell-extension-handlers/ ] -->
+			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks</TargetObject> <!--Windows: ShellExecuteHooks-->
+			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellServiceObjectDelayLoad</TargetObject> <!--Windows: ShellExecuteHooks-->
+			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellIconOverlayIdentifiers</TargetObject> <!--Windows: ShellExecuteHooks-->
+			<!--AppPaths hijacking-->
+			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\</TargetObject> <!--Windows: Credit to @Hexacorn [ http://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/ ] -->
+			<!--Terminal service boobytrap-->
+			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram</TargetObject> <!--Windows:RDP: Note other Terminal Server run keys are handled by another wildcard already-->
+			<!--Group Policy integrity-->
+			<TargetObject name="T1484" condition="begin with">HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\</TargetObject> <!--Windows: Group Policy internally uses a plug-in architecture that nothing should be modifying-->
+			<!--Winsock and Winsock2-->
+			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Services\WinSock</TargetObject> <!--Windows: Wildcard, includes Winsock and Winsock2-->
+			<TargetObject condition="end with">\ProxyServer</TargetObject> <!--Windows: System and user proxy server-->
+			<!--Credential providers-->
+			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider</TargetObject> <!--Wildcard, includes Credential Providers and Credential Provider Filters-->
+			<TargetObject name="T1101" condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\</TargetObject> <!-- [ https://attack.mitre.org/wiki/Technique/T1131 ] [ https://attack.mitre.org/wiki/Technique/T1101 ] -->
+			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders</TargetObject> <!--Windows: Changes to WDigest-UseLogonCredential for password scraping [ https://www.trustedsec.com/april-2015/dumping-wdigest-creds-with-meterpreter-mimikatzkiwi-in-windows-8-1/ ] -->
+			<TargetObject condition="begin with">HKLM\Software\Microsoft\Netsh</TargetObject> <!--Windows: Netsh helper DLL [ https://attack.mitre.org/wiki/Technique/T1128 ] -->
+			<TargetObject condition="contains">Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable</TargetObject> <!--Windows: Malware often disables a web proxy for 2nd stage downloads -->
+			<!--Networking-->
+			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\</TargetObject> <!--Windows: Order of network providers that are checked to connect to destination [ https://www.malwarearchaeology.com/cheat-sheets ] -->
+			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles</TargetObject> <!--Windows: | Credit @ion-storm -->
+			<TargetObject name="T1089" condition="end with">\EnableFirewall</TargetObject> <!--Windows: Monitor for firewall disablement, all firewall profiles [ https://attack.mitre.org/wiki/Technique/T1089 ] -->
+			<TargetObject name="T1089" condition="end with">\DoNotAllowExceptions</TargetObject> <!--Windows: Monitor for firewall disablement, all firewall profiles [ https://attack.mitre.org/wiki/Technique/T1089 ] -->
+			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List</TargetObject> <!--Windows Firewall authorized applications for all networks| Credit @ion-storm -->
+			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List</TargetObject> <!--Windows Firewall authorized applications for domain networks -->
+			<!--DLLs that get injected into every process at launch-->
+			<TargetObject name="T1103" condition="begin with">HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\</TargetObject> <!--Windows: Feature disabled by default [ https://attack.mitre.org/wiki/Technique/T1103 ] -->
+			<TargetObject name="T1103" condition="begin with">HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\</TargetObject> <!--Windows: Feature disabled by default [ https://attack.mitre.org/wiki/Technique/T1103 ] -->
+			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\</TargetObject> <!--Windows: Credit to @Hexacorn [ http://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/ ] [ https://blog.comodo.com/malware/trojware-win32-trojanspy-volisk-a/ ] -->
+			<!--Office-->
+			<TargetObject name="T1137" condition="contains">Microsoft\Office\Outlook\Addins\</TargetObject> <!--Microsoft:Office: Outlook add-ins, access to sensitive data and often cause issues-->
+			<TargetObject name="T1137" condition="contains">Office Test\</TargetObject> <!-- Microsoft:Office: Persistence method [ http://www.hexacorn.com/blog/2014/04/16/beyond-good-ol-run-key-part-10/ ] | Credit @Hexacorn -->
+			<TargetObject name="Suspicious,ChangedURLOutlook" condition="contains all">\Software\Microsoft\Office\;\Outlook\WebView\;URL</TargetObject> <!-- The URL shouldn't be changed all that often and could enable persistance for hackers | @humpelpum [ https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=70 ]-->
+			<TargetObject name="Context,ProtectedModeExitOrMacrosUsed" condition="contains">Security\Trusted Documents\TrustRecords</TargetObject> <!--Microsoft:Office: Monitor when "Enable editing" or "Enable macros" is used | Credit @OutflankNL | [ https://outflank.nl/blog/2018/01/16/hunting-for-evil-detect-macros-being-executed/ ] -->
+			<TargetObject name="Context,ContactedDomain" condition="end with">\EnableBHO</TargetObject> <!--Microsoft:Office: Contacted domains stored here 'HKEY_CURRENT_USER\<SID>\SOFTWARE\Microsoft\Office\16.0\Common\Internet\Server Cache\<domain>\EnableBHO' -->
+			<!--IE-->
+			<TargetObject name="T1176" condition="contains">Internet Explorer\Toolbar\</TargetObject> <!--Microsoft:InternetExplorer: Machine and user [ Example: https://www.exterminate-it.com/malpedia/remove-mywebsearch ] -->
+			<TargetObject name="T1176" condition="contains">Internet Explorer\Extensions\</TargetObject> <!--Microsoft:InternetExplorer: Machine and user [ Example: https://www.exterminate-it.com/malpedia/remove-mywebsearch ] -->
+			<TargetObject name="T1176" condition="contains">Browser Helper Objects\</TargetObject> <!--Microsoft:InternetExplorer: Machine and user [ https://msdn.microsoft.com/en-us/library/bb250436(v=vs.85).aspx ] -->
+			<TargetObject condition="end with">\DisableSecuritySettingsCheck</TargetObject>
+			<TargetObject condition="end with">\3\1206</TargetObject> <!--Microsoft:InternetExplorer: Malware sometimes assures scripting is on in Internet Zone [ https://support.microsoft.com/en-us/help/182569/internet-explorer-security-zones-registry-entries-for-advanced-users ] -->
+			<TargetObject condition="end with">\3\2500</TargetObject> <!--Microsoft:InternetExplorer: Malware sometimes disables Protected Mode in Internet Zone [ https://blog.avast.com/2013/08/12/your-documents-are-corrupted-from-image-to-an-information-stealing-trojan/ ] -->
+			<TargetObject condition="end with">\3\1809</TargetObject> <!--Microsoft:InternetExplorer: Malware sometimes disables Pop-up Blocker in Internet Zone [ https://support.microsoft.com/en-us/help/182569/internet-explorer-security-zones-registry-entries-for-advanced-users ] -->
+			<!--Magic registry keys-->
+			<TargetObject condition="begin with">HKLM\Software\Classes\CLSID\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}\</TargetObject> <!--Windows: Thumbnail cache autostart [ http://blog.trendmicro.com/trendlabs-security-intelligence/poweliks-levels-up-with-new-autostart-mechanism/ ] -->
+			<TargetObject condition="begin with">HKLM\Software\Classes\WOW6432Node\CLSID\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}\</TargetObject> <!--Windows: Thumbnail cache autostart [ http://blog.trendmicro.com/trendlabs-security-intelligence/poweliks-levels-up-with-new-autostart-mechanism/ ] -->
+			<TargetObject condition="begin with">HKLM\Software\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\</TargetObject> <!--Windows: DirectX instances-->
+			<TargetObject condition="begin with">HKLM\Software\Classes\WOW6432Node\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\</TargetObject> <!--Windows: DirectX instances-->
+			<!--Install/Run artifacts-->
+			<TargetObject condition="end with">\UrlUpdateInfo</TargetObject> <!--Microsoft:ClickOnce: Source URL is stored in this value [ https://subt0x10.blogspot.com/2016/12/mimikatz-delivery-via-clickonce-with.html ] -->
+			<TargetObject condition="end with">\InstallSource</TargetObject> <!--Windows: Source folder for certain program and component installations-->
+			<TargetObject name="Alert,Sysinternals Tool Used" condition="end with">\EulaAccepted</TargetObject> <!--Sysinternals tool launched. Lots of useful abilities for attackers -->
+			<!--Antivirus tampering-->
+			<TargetObject name="T1089,Tamper-Defender" condition="end with">\DisableAntiSpyware</TargetObject> <!--Windows:Defender: State modified via registry-->
+			<TargetObject name="T1089,Tamper-Defender" condition="end with">\DisableAntiVirus</TargetObject> <!--Windows:Defender: State modified via registry-->
+			<TargetObject name="T1089,Tamper-Defender" condition="end with">\SpynetReporting</TargetObject> <!--Windows:Defender: State modified via registry-->
+			<TargetObject name="T1089,Tamper-Defender" condition="end with">DisableRealtimeMonitoring</TargetObject> <!--Windows:Defender: State modified via registry-->
+			<TargetObject name="T1089,Tamper-Defender" condition="end with">\SubmitSamplesConsent</TargetObject> <!--Windows:Defender: State modified via registry-->
+			<TargetObject name="T1089,Tamper-Defender" condition="begin with">HKLM\Software\Microsoft\Windows Defender\Exclusions</TargetObject> <!--Windows:Defender: State modified via registry-->
+			<TargetObject name="T1562,Tamper-Defender" condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender</TargetObject> <!--Windows:Defender: Monitor any modified via registry-->
+			<!--Windows UAC tampering-->
+			<TargetObject name="T1088" condition="end with">HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA</TargetObject> <!--Detect: UAC Tampering | Credit @ion-storm -->
+			<TargetObject name="T1088" condition="end with">HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy</TargetObject> <!--Detect: UAC Tampering | Credit @ion-storm -->
+			<!--Microsoft Security Center tampering | Credit @ion-storm -->
+			<TargetObject name="T1089,Tamper-SecCenter" condition="end with">HKLM\Software\Microsoft\Security Center\</TargetObject> <!-- [ https://attack.mitre.org/wiki/Technique/T1089 ] -->
+			<TargetObject name="T1089,Tamper-SecCenter" condition="end with">SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth</TargetObject> <!--Windows:Security Center: Malware sometimes disables [ https://blog.avast.com/2013/08/12/your-documents-are-corrupted-from-image-to-an-information-stealing-trojan/ ] -->
+			<!--Windows application compatibility-->
+			<TargetObject name="T1138,AppCompatShim" condition="begin with">HKLM\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom</TargetObject> <!--Windows: AppCompat [ https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html ] -->
+			<TargetObject name="T1138,AppCompatShim" condition="begin with">HKLM\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB</TargetObject> <!--Windows: AppCompat [ https://attack.mitre.org/wiki/Technique/T1138 ] -->
+			<TargetObject condition="contains">VirtualStore</TargetObject> <!--Windows: Registry virtualization, something's wrong if it's in use [ https://msdn.microsoft.com/en-us/library/windows/desktop/aa965884(v=vs.85).aspx ] -->
+			<!--Windows internals integrity monitoring-->
+			<TargetObject name="T1183,IFEO" condition="begin with">HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\</TargetObject> <!--Windows: Malware likes changing IFEO, like adding Debugger to disable antivirus EXE-->
+			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\WINEVT\</TargetObject> <!--Windows: Event log system integrity and ACLs-->
+			<TargetObject name="Tamper-Safemode" condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Safeboot\</TargetObject> <!--Windows: Services approved to load in safe mode. Almost nothing should ever modify this.-->
+			<TargetObject name="Tamper-Winlogon" condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\</TargetObject> <!--Windows: Providers notified by WinLogon-->
+			<TargetObject name="Context,DeviceConnectedOrUpdated" condition="end with">\FriendlyName</TargetObject> <!--Windows: New devices connected and remembered-->
+			<TargetObject name="Context,MsiInstallerStarted" condition="is">HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default)</TargetObject> <!--Windows: See when WindowsInstaller is engaged, useful for timeline matching with other events-->
+			<TargetObject name="Tamper-Tracing" condition="begin with">HKLM\Software\Microsoft\Tracing\RASAPI32</TargetObject> <!--Windows: Malware sometimes disables tracing to obfuscate tracks-->
+			<TargetObject name="Context,ProcessAccessedPrivateResource" condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\</TargetObject> <!-- Windows: Win10 tracks when and what process uses webcam/microphone/location etc [ https://medium.com/@7a616368/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072 ] -->
+			<TargetObject condition="contains">\Keyboard Layout\Preload</TargetObject> <!--Microsoft:Windows: Keyboard layout loaded into user session [ https://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index ] | Credit @cyb3rops -->
+			<TargetObject condition="contains">\Keyboard Layout\Substitutes</TargetObject> <!--Microsoft:Windows: Keyboard layout loaded into user session [ https://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index ] | Credit @cyb3rops -->
+			<!--Windows inventory events-->
+			<TargetObject name="InvDB-Path" condition="end with">\LowerCaseLongPath</TargetObject> <!-- [ https://binaryforay.blogspot.com/2017/10/amcache-still-rules-everything-around.html ] -->
+			<TargetObject name="InvDB-Pub" condition="end with">\Publisher</TargetObject> <!-- [ https://binaryforay.blogspot.com/2017/10/amcache-still-rules-everything-around.html ] -->
+			<TargetObject name="InvDB-Ver" condition="end with">\BinProductVersion</TargetObject> <!-- [ https://docs.microsoft.com/en-us/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709 ] -->
+			<TargetObject name="InvDB-DriverVer" condition="end with">\DriverVersion</TargetObject> <!-- [ https://df-stream.com/2015/02/leveraging-devicecontainers-key/ ] -->
+			<TargetObject name="InvDB-DriverVer" condition="end with">\DriverVerVersion</TargetObject> <!-- [ https://df-stream.com/2015/02/leveraging-devicecontainers-key/ ] -->
+			<TargetObject name="InvDB-CompileTimeClaim" condition="end with">\LinkDate</TargetObject> <!-- Compile time of EXE, may not be reliable [ https://en.wikipedia.org/wiki/Link_time ] -->
+			<TargetObject name="InvDB" condition="contains">Compatibility Assistant\Store\</TargetObject> <!-- Inventory -->
+			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports</TargetObject> <!--Microsoft:Windows: Printer port changes as used in CVE-2020-1048 [ https://windows-internals.com/printdemon-cve-2020-1048/ ] -->
+			<TargetObject condition="contains">\Keyboard Layout\Preload</TargetObject> <!--Microsoft:Windows: Keyboard layout loaded into user session [ https://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index ] -->
+			<TargetObject condition="contains">\Keyboard Layout\Substitutes</TargetObject> <!--Microsoft:Windows: Keyboard layout loaded into user session [ https://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index ] -->
+			<!--Suspicious sources-->
+			<Image name="Suspicious,ImageBeginWithBackslash" condition="end with">regedit.exe</Image> <!--Users and helpdesk staff making system modifications -->
+			<Image name="Suspicious,ImageBeginWithBackslash" condition="begin with">\</Image> <!--Devices and VSC shouldn't be executing changes | Credit: @SBousseaden @ionstorm @neu5ron @PerchedSystems [ https://twitter.com/SwiftOnSecurity/status/1133167323991486464 ] -->
+			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\</TargetObject> <!--Microsoft:Windows:UAC: Detect malware changes to UAC prompt level-->
+			<TargetObject condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\</TargetObject> <!--Microsoft:Defender: Detect changes to Defender administrative settings to monitor for disablement-->
+			<!--Windows trust architecture monitoring | Credit: @mattifestation-->
+			<!--ADDITIONAL REFERENCE: https://specterops.io/assets/resources/SpecterOps_Subverting_Trust_in_Windows.pdf-->
+			<TargetObject condition="contains">Microsoft\Cryptography\OID\</TargetObject> <!-- Important trust registry values to monitor -->
+			<TargetObject condition="contains">WOW6432Node\Microsoft\Cryptography\OID\</TargetObject> <!-- Important trust registry values to monitor -->
+			<TargetObject condition="contains">Microsoft\Cryptography\Providers\Trust\</TargetObject> <!-- Important trust registry values to monitor -->
+			<TargetObject condition="contains">WOW6432Node\Microsoft\Cryptography\Providers\Trust\</TargetObject> <!-- Important trust registry values to monitor -->
+			<TargetObject condition="contains">Control\Print\Environments\Windows x64\Drivers</TargetObject> <!-- PrinterNightmare coverage -->
+			<TargetObject name="Context,ContactedDomain" condition="end with">\EnableBHO</TargetObject> <!--Microsoft:Office: Contacted domains stored here 'HKEY_CURRENT_USER\<SID>\SOFTWARE\Microsoft\Office\16.0\Common\Internet\Server Cache\<domain>\EnableBHO' -->
+		</RegistryEvent>
+	</RuleGroup>
+
+	<RuleGroup name="" groupRelation="or">
+		<RegistryEvent onmatch="exclude">
+		<!--COMMENT:	Remove low-information noise. Often these hide a procress recreating an empty key and do not hide the values created subsequently.-->
+		<!--NOTE:	A lot of noise can be removed by excluding CreateKey events, which are largely innocuous-->
+			<TargetObject condition="contains">\{CAFEEFAC-</TargetObject>
+			<EventType condition="is">CreateKey</EventType>
+			<TargetObject condition="begin with">HKLM\COMPONENTS</TargetObject>
+			<!--Inventory noise-->
+			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache</TargetObject>
+			<!--Misc-->
+			<TargetObject condition="end with">Toolbar\WebBrowser</TargetObject> <!--Microsoft:IE: Extraneous activity-->
+			<TargetObject condition="end with">Browser\ITBar7Height</TargetObject> <!--Microsoft:IE: Extraneous activity, covers ShellBrowser and WebBrowser-->
+			<TargetObject condition="end with">Browser\ITBar7Layout</TargetObject> <!--Microsoft:IE: Extraneous activity-->
+			<TargetObject condition="end with">Internet Explorer\Toolbar\Locked</TargetObject> <!--Windows:Explorer: Extraneous activity-->
+			<TargetObject condition="end with">Toolbar\WebBrowser\{47833539-D0C5-4125-9FA8-0819E2EAAC93}</TargetObject> <!--Windows:Explorer: Extraneous activity-->
+			<TargetObject condition="end with">}\PreviousPolicyAreas</TargetObject> <!--Windows: Remove noise from \Winlogon\GPExtensions by svchost.exe-->
+			<TargetObject condition="contains">\Control\WMI\Autologger\</TargetObject> <!--Windows: Remove noise from monitoring "\Start"-->
+			<TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc\Start</TargetObject> <!--Windows: Remove noise from monitoring "\Start"-->
+			<TargetObject condition="end with">\Lsa\OfflineJoin\CurrentValue</TargetObject> <!--Windows: Sensitive value during domain join-->
+			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\</TargetObject> <!--Windows: Remove noise monitoring installations run as system-->
+			<TargetObject condition="contains">_Classes\AppX</TargetObject> <!--Windows: Remove noise monitoring "Shell\open\command"--> <!--Win8+-->
+			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\</TargetObject> <!--Windows: SvcHost Noise-->
+			<!--Bootup Control noise-->
+			<TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\LsaPid</TargetObject> <!--Windows:lsass.exe: Boot noise-->
+			<TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache</TargetObject> <!--Windows:lsass.exe: Boot noise--> <!--Win8+-->
+			<TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Domains</TargetObject> <!--Windows:lsass.exe: Boot noise--> <!--Win8+-->
+			<!--Services startup settings noise, some low-risk services routinely change it and this can be ignored-->
+			<TargetObject condition="end with">\Services\BITS\Start</TargetObject> <!--Windows: Remove noise from monitoring "\Start"-->
+			<TargetObject condition="end with">\services\clr_optimization_v2.0.50727_32\Start</TargetObject> <!--Microsoft:dotNet: Windows 7-->
+			<TargetObject condition="end with">\services\clr_optimization_v2.0.50727_64\Start</TargetObject> <!--Microsoft:dotNet: Windows 7-->
+			<TargetObject condition="end with">\services\clr_optimization_v4.0.30319_32\Start</TargetObject> <!--Microsoft:dotNet: Windows 10-->
+			<TargetObject condition="end with">\services\clr_optimization_v4.0.30319_64\Start</TargetObject> <!--Microsoft:dotNet: Windows 10-->
+			<TargetObject condition="end with">\services\deviceAssociationService\Start</TargetObject> <!--Windows: Remove noise from monitoring "\Start"-->
+			<TargetObject condition="end with">\services\fhsvc\Start</TargetObject> <!--Windows: File History Service-->
+			<TargetObject condition="end with">\services\nal\Start</TargetObject> <!--Intel: Network adapter diagnostic driver-->
+			<TargetObject condition="end with">\services\trustedInstaller\Start</TargetObject> <!--Windows: Remove noise from monitoring "\Start"-->
+			<TargetObject condition="end with">\services\tunnel\Start</TargetObject> <!--Windows: Remove noise from monitoring "\Start"-->
+			<TargetObject condition="end with">\services\usoSvc\Start</TargetObject> <!--Windows: Remove noise from monitoring "\Start"-->
+			<!--FileExts noise filtering-->
+			<TargetObject condition="end with">\UserChoice\ProgId</TargetObject> <!--Windows: Remove noise from monitoring "FileExts"--> <!--Win8+-->
+			<TargetObject condition="end with">\UserChoice\Hash</TargetObject> <!--Windows: Remove noise from monitoring "FileExts"--> <!--Win8+-->
+			<TargetObject condition="end with">\OpenWithList\MRUList</TargetObject> <!--Windows: Remove noise from monitoring "FileExts"-->
+			<TargetObject condition="contains">Shell Extentions\Cached</TargetObject> <!--Windows: Remove noise generated by explorer.exe on monitored ShellCached binary keys--> <!--Win8+-->
+			<!--Group Policy noise-->
+			<TargetObject condition="end with">HKLM\System\CurrentControlSet\Control\Lsa\Audit\SpecialGroups</TargetObject> <!--Windows: Routinely set through Group Policy, not especially important to log-->
+			<TargetObject condition="end with">SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\PSScriptOrder</TargetObject> <!--Windows:Group Policy: Noise below the actual key while building-->
+			<TargetObject condition="end with">SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\SOM-ID</TargetObject> <!--Windows:Group Policy: Noise below the actual key while building-->
+			<TargetObject condition="end with">SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\GPO-ID</TargetObject> <!--Windows:Group Policy: Noise below the actual key while building-->
+			<TargetObject condition="end with">SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\0\IsPowershell</TargetObject> <!--Windows:Group Policy: Noise below the actual key while building-->
+			<TargetObject condition="end with">SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\0\ExecTime</TargetObject> <!--Windows:Group Policy: Noise below the actual key while building-->
+			<TargetObject condition="end with">SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\PSScriptOrder</TargetObject> <!--Windows:Group Policy: Noise below the actual key while building-->
+			<TargetObject condition="end with">SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\SOM-ID</TargetObject> <!--Windows:Group Policy: Noise below the actual key while building-->
+			<TargetObject condition="end with">SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\GPO-ID</TargetObject> <!--Windows:Group Policy: Noise below the actual key while building-->
+			<TargetObject condition="end with">SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\0\IsPowershell</TargetObject> <!--Windows:Group Policy: Noise below the actual key while building-->
+			<TargetObject condition="end with">SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\0\ExecTime</TargetObject> <!--Windows:Group Policy: Noise below the actual key while building-->
+			<TargetObject condition="contains">\safer\codeidentifiers\0\HASHES\{</TargetObject> <!--Windows: Software Restriction Policies. Can be used to disable security tools, but very noisy to monitor if you use it-->
+			<!--SECTION: Office C2R-->
+			<TargetObject condition="contains">VirtualStore\MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\</TargetObject> <!--Microsoft: SearchProtocolHost writes to OfficeC2R registry for Outlook, seemingly regarding mail indexing-->
+			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Office\ClickToRun\</TargetObject> <!--Microsoft: Virtual registry for Office-->
+			<!--SECTION: 3rd party-->
+			<Image condition="is">C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe</Image> <!--Constantly writes to HKLM-->
+			<TargetObject condition="begin with">HKCR\VLC.</TargetObject> <!--VLC update noise-->
+			<TargetObject condition="begin with">HKCR\iTunes.</TargetObject> <!--Apple: iTunes update noise-->
+			<!--WINEVT publishers noise-->
+			<TargetObject condition="is">HKLM\Software\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{945a8954-c147-4acd-923f-40c45405a658}</TargetObject> <!--Windows update-->
+		</RegistryEvent>
+	</RuleGroup>
+
+	<!--SYSMON EVENT ID 15 : ALTERNATE DATA STREAM CREATED [FileCreateStreamHash]-->
+		<!--EVENT 15: "File stream created"-->
+		<!--COMMENT:	Any files created with an NTFS Alternate Data Stream which match these rules will be hashed and logged.
+			[ https://blogs.technet.microsoft.com/askcore/2013/03/24/alternate-data-streams-in-ntfs/ ]
+			ADS's are used by browsers and email clients to mark files as originating from the Internet or other foreign sources.
+			[ https://textslashplain.com/2016/04/04/downloads-and-the-mark-of-the-web/ ] -->
+		<!--NOTE: Other filesystem minifilters can make it appear to Sysmon that some files are being written twice. This is not a Sysmon issue, per Mark Russinovich.-->
+
+		<!--DATA: UtcTime, ProcessGuid, ProcessId, Image, TargetFilename, CreationUtcTime, Hash-->
+		<FileCreateStreamHash onmatch="include">
+			<TargetFilename condition="contains">Downloads</TargetFilename> <!--Downloaded files. Does not include "Run" files in IE-->
+			<TargetFilename condition="contains">Temp\7z</TargetFilename> <!--7zip extractions-->
+			<TargetFilename condition="contains">Startup</TargetFilename> <!--ADS startup | Example: [ https://www.hybrid-analysis.com/sample/a314f6106633fba4b70f9d6ddbee452e8f8f44a72117749c21243dc93c7ed3ac?environmentId=100 ] -->
+			<TargetFilename condition="end with">.bat</TargetFilename> <!--Batch scripting-->
+			<TargetFilename condition="end with">.cmd</TargetFilename> <!--Batch scripting | Credit @ion-storm -->
+			<TargetFilename condition="end with">.doc</TargetFilename> <!--Office doc potentially with macro -->
+			<TargetFilename condition="end with">.hta</TargetFilename> <!--Scripting-->
+			<TargetFilename condition="end with">.jse</TargetFilename> <!--Registry File-->
+			<TargetFilename condition="end with">.lnk</TargetFilename> <!--Shortcut file | Credit @ion-storm -->
+			<TargetFilename condition="end with">.ppt</TargetFilename> <!--Office doc potentially with macros-->
+			<TargetFilename condition="end with">.ps1</TargetFilename> <!--PowerShell-->
+			<TargetFilename condition="end with">.ps2</TargetFilename> <!--PowerShell-->
+			<TargetFilename condition="end with">.reg</TargetFilename> <!--Registry File-->
+			<TargetFilename condition="end with">.sct</TargetFilename> <!--Scripting | Credit @bartblaze -->
+			<TargetFilename condition="end with">.vb</TargetFilename> <!--VisualBasicScripting files-->
+			<TargetFilename condition="end with">.vbe</TargetFilename> <!--VisualBasicScripting files-->
+			<TargetFilename condition="end with">.vbs</TargetFilename> <!--VisualBasicScripting files-->
+			<TargetFilename condition="end with">.wsc</TargetFilename> <!--Scripting | Credit @bartblaze -->
+			<TargetFilename condition="end with">.wsf</TargetFilename> <!--Scripting | Credit @bartblaze -->
+			<TargetFilename condition="end with">:Zone.Identifier</TargetFilename> <!-- Track Zone.Identifiers regardless of their download location -->
+			<TargetFilename condition="end with">:newads</TargetFilename> <!-- CobaltStrike BOF https://github.com/EspressoCake/Self_Deletion_BOF/blob/main/src/main.c -->
+
+		</FileCreateStreamHash>
+
+	<RuleGroup name="" groupRelation="or">
+		<FileCreateStreamHash onmatch="exclude">
+		</FileCreateStreamHash>
+	</RuleGroup>
+
+	<!--SYSMON EVENT ID 16 : SYSMON CONFIGURATION CHANGE-->
+		<!--EVENT 16: "Sysmon config state changed"-->
+		<!--COMMENT:	This ONLY logs if the hash of the configuration changes. Running "sysmon.exe -c" with the current configuration will not be logged with Event 16-->
+
+		<!--DATA: UtcTime, Configuration, ConfigurationFileHash-->
+		<!--Cannot be filtered.-->
+
+	<!--SYSMON EVENT ID 17 & 18 : PIPE CREATED / PIPE CONNECTED [PipeEvent]-->
+		<!--EVENT 17: "Pipe Created"-->
+		<!--EVENT 18: "Pipe Connected"-->
+
+		<!--ADDITIONAL REFERENCE: [ https://www.cobaltstrike.com/help-smb-beacon ] -->
+		<!--ADDITIONAL REFERENCE: [ https://blog.cobaltstrike.com/2015/10/07/named-pipe-pivoting/ ] -->
+
+		<!--DATA: UtcTime, ProcessGuid, ProcessId, PipeName, Image-->
+		<RuleGroup name="" groupRelation="or">
+			<PipeEvent onmatch="include">
+				<!-- Remote Command Execution Tools -->
+				<PipeName condition="contains any">paexec;remcom;csexec</PipeName>
+				<!-- Password or Credential Dumpers -->
+				<PipeName condition="contains any">\lsadump;\cachedump;\wceservicepipe</PipeName>
+				<!-- Malware -->
+				<PipeName condition="contains any">\isapi_http;\isapi_dg;\isapi_dg2;\sdlrpc;\ahexec;\winsession;\lsassw;\46a676ab7f179e511e30dd2dc41bd388;\9f81f59bc58452127884ce513865ed20;\e710f28d59aa529d6792ca6ff0ca1b34;\rpchlp_3;\NamePipe_MoreWindows;\pcheap_reuse;\gruntsvc;\583da945-62af-10e8-4902-a8f205c72b2e;\bizkaz;\svcctl;\Posh;\jaccdpqnvbrrxlaf;\csexecsvc</PipeName>
+				<PipeName condition="contains any">\atctl;\userpipe;\iehelper;\sdlrpc;\comnap</PipeName>
+				<PipeName condition="contains">\pipe\</PipeName> <!-- EfsPotato https://twitter.com/SBousseaden/status/1429530155291193354?s=20 -->
+				<!-- Cobalt Strike Pipe Names -->
+				<PipeName condition="contains all">MSSE-;-server</PipeName>
+				<PipeName condition="begin with">\postex_</PipeName>
+				<PipeName condition="begin with">\postex_ssh_</PipeName>
+				<PipeName condition="begin with">\status_</PipeName>
+				<PipeName condition="begin with">\msagent_</PipeName>
+				<!-- Malleable C2 profiles https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 -->
+				<!-- some of these are not exact matches, but the corresponding Sigma rules use Regexp to match exactly -->
+				<PipeName condition="begin with">\mojo.5688.8052.183894939787088877</PipeName>
+				<PipeName condition="begin with">\mojo.5688.8052.35780273329370473</PipeName>
+				<PipeName condition="begin with">\DserNamePipe</PipeName>
+				<PipeName condition="begin with">\mypipe-f</PipeName>
+				<PipeName condition="begin with">\mypipe-h</PipeName>
+				<PipeName condition="begin with">\windows.update.manager</PipeName>
+				<PipeName condition="begin with">\ntsvcs_</PipeName>
+				<PipeName condition="begin with">\scerpc_</PipeName>
+				<!-- Malleable C2 profiles https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752 -->
+				<PipeName condition="begin with">\demoagent_</PipeName>
+				<PipeName condition="begin with">\PGMessagePipe</PipeName>
+				<PipeName condition="begin with">\MsFteWds</PipeName>
+				<PipeName condition="begin with">\f4c3</PipeName>
+				<PipeName condition="begin with">\fullduplex_</PipeName>
+				<PipeName condition="begin with">\msrpc_</PipeName>
+				<PipeName condition="begin with">\win\msrpc_</PipeName>
+				<PipeName condition="begin with">\f53f</PipeName>
+				<PipeName condition="begin with">\rpc_</PipeName>
+				<PipeName condition="begin with">\spoolss_</PipeName>
+				<PipeName condition="begin with">\win_svc</PipeName>
+				<PipeName condition="begin with">\SearchTextHarvester</PipeName>
+				<PipeName condition="begin with">\adschemerpc</PipeName> <!-- Turla HyperStack - https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity -->
+				<PipeName condition="begin with">\AnonymousPipe</PipeName> <!-- Hidden Cobra Hoplight - https://us-cert.cisa.gov/ncas/analysis-reports/ar19-304a -->
+				<PipeName condition="begin with">\bc367</PipeName> <!-- Pacifier - https://download.bitdefender.com/resources/files/News/CaseStudies/study/115/Bitdefender-Whitepaper-PAC-A4-en-EN1.pdf -->
+				<PipeName condition="begin with">\bc31a7</PipeName> <!-- Pacifier - https://download.bitdefender.com/resources/files/News/CaseStudies/study/115/Bitdefender-Whitepaper-PAC-A4-en-EN1.pdf -->
+				<PipeName condition="begin with">\testPipe</PipeName> <!-- Emissary Panda Hyerbri - https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/ -->
+				<Rule groupRelation="and"> <!-- would be noisy otherwise as \Winsock2\CatalogchangeListener-???-0 is a legitimate pipe name -->
+					<PipeName condition="begin with">\Winsock2\CatalogChangeListener-</PipeName>
+					<PipeName condition="end with">-0,</PipeName>
+				</Rule>
+				<!-- these are standard pipes that appear frequently but the Sigma rules use RE to match on malicious pipes that use the common names as a prefix -->
+				<PipeName condition="begin with">\scerpc</PipeName>
+				<PipeName condition="begin with">\ntsvcs</PipeName>
+				<PipeName condition="begin with">\wkssvc</PipeName>
+				<!-- Other specific named pipes -->
+				<PipeName condition="contains">6e7645c4-32c5-4fe3-aabf-e94c2f4370e7</PipeName> <!-- LiquidSnake hacktool https://github.com/RiccardoAncarani/LiquidSnake -->
+				<Image condition="end with">\scrcons.exe</Image> <!-- Susupicious WMI Event Consumer creating a named pipe -->
+				<Rule groupRelation="and"> <!-- Some interesting ConnectPipe events that we want to include -->
+					<EventType condition="is">ConnectPipe</EventType>
+					<PipeName condition="is">\MICROSOFT##WID\tsql\query</PipeName> <!-- https://github.com/SigmaHQ/sigma/pull/2128 -->
+				</Rule>
+			</PipeEvent>
+		</RuleGroup>
+		<!-- Common Pipe Names to would appear very often in -->
+		<RuleGroup name="CommonPipes" groupRelation="or">
+			<PipeEvent onmatch="exclude">
+				<!-- the standard named pipes used by Windows services (we want only the ones that begin with these names) -->
+				<PipeName condition="is">\scerpc</PipeName>
+				<PipeName condition="is">\ntsvcs</PipeName>
+				<PipeName condition="is">\wkssvc</PipeName>
+			</PipeEvent>
+		</RuleGroup>
+
+	<!--SYSMON EVENT ID 19 & 20 & 21 : WMI EVENT MONITORING [WmiEvent]-->
+		<!--EVENT 19: "WmiEventFilter activity detected"-->
+		<!--EVENT 20: "WmiEventConsumer activity detected"-->
+		<!--EVENT 21: "WmiEventConsumerToFilter activity detected"-->
+
+		<!--ADDITIONAL REFERENCE: [ https://www.darkoperator.com/blog/2017/10/15/sysinternals-sysmon-610-tracking-of-permanent-wmi-events ] -->
+		<!--ADDITIONAL REFERENCE: [ https://rawsec.lu/blog/posts/2017/Sep/19/sysmon-v610-vs-wmi-persistence/ ] -->
+
+		<!--DATA: EventType, UtcTime, Operation, User, Name, Type, Destination, Consumer, Filter-->
+	<RuleGroup name="" groupRelation="or">
+		<WmiEvent onmatch="exclude">
+			<!--NOTE: Using exclude with no rules means everything will be logged-->
+		</WmiEvent>
+	</RuleGroup>
+
+	<!--SYSMON EVENT ID 22 : DNS QUERY [DnsQuery]-->
+		<!--EVENT 22: "Dns query"-->
+
+		<!--NOTE:	Due to the volume of events that DNS queries generate, some orgs may want to remove this section from their configuration to reduce Sysmon log turnover. -->
+
+		<!--COMMENT:	DNS logging is a very nuanced challenge in monitoring due to event volume. Legitimate domains can be used to host malware/C2, but lookup itself is not very informative.
+						It's fine to exclude monitoring these bulk low-value lookups, but at same time, you would not have a full log of how malware communicated, potentially missing C2.
+						This section of Sysmon configuration will require your full judgement and knowledge of your org's priorities. There is no correct answer.-->
+
+		<!--OPERATIONS:	Chrome and Firefox prefetch DNS lookups, or use alternate DNS lookup methods Sysmon won't capture. You need to turn these off.
+						Search for Group Policy for these browsers to configure this.-->
+
+		<!--OPERATIONS:	Most DNS traffic is web advertising. To significantly reduce DNS queries and malware ads, enable client-side advertising filtering via Group Policy. This is easy.
+				Internet Explorer: https://decentsecurity.com/adblocking-for-internet-explorer-deployment/
+				Chrome: https://decentsecurity.com/ublock-for-google-chrome-deployment/
+				Firefox: ToDo
+						Also note, this configuration is designed for United States computers. Your country's users will may need customization to reduce noise.
+			-->
+
+		<!--CONFIG:	DNS poisoning is an issue during threat investigations. Try to only exclude ROUTINE system-level queries you know are strongly validated with HTTPS or code signing.-->
+		<!--CONFIG:	If you exclude microsoft.com, someone could register malware-microsoft.com and it wouldn't be logged. Use "END WITH" with leading . or "IS" operators.-->
+		<!--CONFIG:	Be very specific in exclusions. Threat actors use legitimate services, too. Dont exclude all of AWS or Azure or Google or CDNs!-->
+		<!--CONFIG: Popularity data: [ http://s3-us-west-1.amazonaws.com/umbrella-static/index.html ] [ https://better.fyi/trackers/alexa-top-500-news/ ] -->
+
+		<!--CRITICAL:	Do NOT exclude "wpad" lookups. This is a MitM vector routinely used by attackers. Disable WPAD or enforce client-side DNSSEC for AD domain lookups.-->
+		<!--CRITICAL:	Do NOT exclude IPv6 lookups.-->
+
+		<!--DATA: RuleName, UtcTime, ProcessGuid, ProcessId, QueryName, QueryType, QueryStatus, QueryResults (can't filter on)-->
+
+		<!--BELOW: These domains should not be excluded at the top level. Be specific if you want to reduce noise under them.-->
+		<!-- Rejected: .cloudapp.net, customer content [ https://blogs.technet.microsoft.com/ptsblog/2012/06/18/security-consideration-when-using-cloudapp-net-domain-as-production-environment-in-windows-azure/ ] -->
+		<!-- Rejected: .googleapis.com, customer content [ https://www.zdnet.com/article/this-business-email-scam-spreads-trojans-through-google-cloud-storage/ ] -->
+		<!-- Rejected: .cloudfront.net, customer content -->
+		<!-- Rejected: .windows.net, customer content -->
+		<!-- Rejected: *github.com, customer content, including open-source malware components -->
+
+	<RuleGroup name="" groupRelation="or">
+		<DnsQuery onmatch="exclude">
+			<!--Network noise-->
+			<QueryName condition="end with">.arpa.</QueryName> <!--Design decision to not log reverse DNS lookups. You will need to decide.-->
+			<QueryName condition="end with">.arpa</QueryName> <!--Design decision to not log reverse DNS lookups. You will need to decide.-->
+			<QueryName condition="end with">.msftncsi.com</QueryName> <!--Microsoft proxy detection | Microsoft default exclusion-->
+			<QueryName condition="is">..localmachine</QueryName>
+			<QueryName condition="is">localhost</QueryName>
+			<!--Microsoft-->
+			<QueryName condition="end with">-pushp.svc.ms</QueryName> <!--Microsoft: Doesn't appear to host customer content or subdomains-->
+			<QueryName condition="end with">.b-msedge.net</QueryName> <!--Microsoft: Doesn't appear to host customer content or subdomains-->
+			<QueryName condition="end with">.bing.com</QueryName> <!-- Microsoft | Microsoft default exclusion -->
+			<QueryName condition="end with">.hotmail.com</QueryName> <!--Microsoft | Microsoft default exclusion-->
+			<QueryName condition="end with">.live.com</QueryName> <!--Microsoft | Microsoft default exclusion-->
+			<QueryName condition="end with">.live.net</QueryName> <!--Microsoft | Microsoft default exclusion-->
+			<QueryName condition="end with">.s-microsoft.com</QueryName> <!--Microsoft-->
+			<QueryName condition="end with">.microsoft.com</QueryName> <!--Microsoft | Microsoft default exclusion-->
+			<QueryName condition="end with">.microsoftonline.com</QueryName> <!--Microsoft | Microsoft default exclusion-->
+			<QueryName condition="end with">.microsoftstore.com</QueryName> <!--Microsoft | Microsoft default exclusion-->
+			<QueryName condition="end with">.ms-acdc.office.com</QueryName> <!--Microsoft: Doesn't appear to host customer content or subdomains-->
+			<QueryName condition="end with">.msedge.net</QueryName> <!--Microsoft: Doesn't appear to host customer content or subdomains-->
+			<QueryName condition="end with">.msn.com</QueryName> <!--Microsoft | Microsoft default exclusion-->
+			<QueryName condition="end with">.msocdn.com</QueryName> <!--Microsoft-->
+			<QueryName condition="end with">.skype.com</QueryName> <!--Microsoft | Microsoft default exclusion-->
+			<QueryName condition="end with">.skype.net</QueryName> <!--Microsoft | Microsoft default exclusion-->
+			<QueryName condition="end with">.windows.com</QueryName> <!--Microsoft-->
+			<QueryName condition="end with">.windows.net.nsatc.net</QueryName> <!--Microsoft-->
+			<QueryName condition="end with">.windowsupdate.com</QueryName> <!--Microsoft-->
+			<QueryName condition="end with">.xboxlive.com</QueryName> <!--Microsoft-->
+			<QueryName condition="is">login.windows.net</QueryName> <!--Microsoft-->
+			<Image condition="begin with">C:\ProgramData\Microsoft\Windows Defender\Platform\</Image> <!--Microsoft: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/network-protection -->
+			<!--Microsoft:Office365/AzureAD-->
+			<QueryName condition="end with">.activedirectory.windowsazure.com</QueryName> <!--Microsoft: AzureAD-->
+			<QueryName condition="end with">.aria.microsoft.com</QueryName> <!--Microsoft: OneDrive/SharePoint-->
+			<QueryName condition="end with">.msauth.net</QueryName>
+			<QueryName condition="end with">.msftauth.net</QueryName>
+			<QueryName condition="end with">.office.net</QueryName> <!--Microsoft: Office-->
+			<QueryName condition="end with">.opinsights.azure.com</QueryName> <!--Microsoft: AzureAD/InTune client event monitoring-->
+			<QueryName condition="end with">.res.office365.com</QueryName> <!--Microsoft: Office-->
+			<QueryName condition="is">acdc-direct.office.com</QueryName> <!--Microsoft: Office-->
+			<QueryName condition="is">atm-fp-direct.office.com</QueryName> <!--Microsoft: Office-->
+			<QueryName condition="is">loki.delve.office.com</QueryName> <!--Microsoft: Office-->
+			<QueryName condition="is">management.azure.com</QueryName> <!--Microsoft: AzureAD/InTune-->
+			<QueryName condition="is">messaging.office.com</QueryName> <!--Microsoft: Office-->
+			<QueryName condition="is">outlook.office365.com</QueryName> <!--Microsoft: Protected by HSTS-->
+			<QueryName condition="is">portal.azure.com</QueryName> <!--Microsoft: AzureAD/InTune-->
+			<QueryName condition="is">protection.outlook.com</QueryName> <!--Microsoft: Office-->
+			<QueryName condition="is">substrate.office.com</QueryName> <!--Microsoft: Office-->
+			<QueryName condition="end with">.measure.office.com</QueryName> <!--Microsoft: Office-->
+			<!--3rd-party applications-->
+			<QueryName condition="end with">.adobe.com</QueryName> <!--Adobe-->
+			<QueryName condition="end with">.adobe.io</QueryName> <!--Adobe-->
+			<QueryName condition="end with">.mozaws.net</QueryName> <!--Mozilla-->
+			<QueryName condition="end with">.mozilla.com</QueryName> <!--Mozilla-->
+			<QueryName condition="end with">.mozilla.net</QueryName> <!--Mozilla-->
+			<QueryName condition="end with">.mozilla.org</QueryName> <!--Mozilla-->
+			<QueryName condition="end with">.spotify.com</QueryName> <!--Spotify-->
+			<QueryName condition="end with">.spotify.map.fastly.net</QueryName> <!--Spotify-->
+			<QueryName condition="end with">.wbx2.com</QueryName> <!--Webex-->
+			<QueryName condition="end with">.webex.com</QueryName> <!--Webex-->
+			<QueryName condition="is">clients1.google.com</QueryName> <!--Google-->
+			<QueryName condition="is">clients2.google.com</QueryName> <!--Google-->
+			<QueryName condition="is">clients3.google.com</QueryName> <!--Google-->
+			<QueryName condition="is">clients4.google.com</QueryName> <!--Google-->
+			<QueryName condition="is">clients5.google.com</QueryName> <!--Google-->
+			<QueryName condition="is">clients6.google.com</QueryName> <!--Google-->
+			<QueryName condition="is">safebrowsing.googleapis.com</QueryName> <!--Google-->
+			<!--Goodlist CDN-->
+			<QueryName condition="end with">.akadns.net</QueryName> <!--AkamaiCDN, extensively used by Microsoft | Microsoft default exclusion-->
+			<QueryName condition="end with">.netflix.com</QueryName>
+			<QueryName condition="is">aspnetcdn.com</QueryName> <!--Microsoft [ https://docs.microsoft.com/en-us/aspnet/ajax/cdn/overview ]-->
+			<QueryName condition="end with">.aspnetcdn.com</QueryName> <!--Microsoft [ https://docs.microsoft.com/en-us/aspnet/ajax/cdn/overview ]-->
+			<QueryName condition="is">ajax.googleapis.com</QueryName>
+			<QueryName condition="is">cdnjs.cloudflare.com</QueryName> <!--Cloudflare: Hosts popular javascript libraries-->
+			<QueryName condition="is">fonts.googleapis.com</QueryName> <!--Google fonts-->
+			<QueryName condition="end with">.typekit.net</QueryName> <!--Adobe fonts-->
+			<QueryName condition="is">cdnjs.cloudflare.com</QueryName>
+			<QueryName condition="end with">.stackassets.com</QueryName> <!--Stack Overflow-->
+			<QueryName condition="end with">.steamcontent.com</QueryName>
+			<QueryName condition="is">play.google.com</QueryName>
+			<QueryName condition="is">content-autofill.googleapis.com</QueryName>
+			<!--Web resources-->
+			<QueryName condition="end with">.disqus.com</QueryName> <!--Microsoft default exclusion-->
+			<QueryName condition="end with">.fontawesome.com</QueryName>
+			<QueryName condition="is">disqus.com</QueryName> <!--Microsoft default exclusion-->
+			<!--Ads-->
+			<QueryName condition="end with">.1rx.io</QueryName> <!--Ads-->
+			<QueryName condition="end with">.2mdn.net</QueryName> <!--Ads: Google | Microsoft default exclusion-->
+			<QueryName condition="end with">.3lift.com</QueryName> <!--Ads-->
+			<QueryName condition="end with">.adadvisor.net</QueryName> <!--Ads: Neustar [ https://better.fyi/trackers/adadvisor.net/ ] -->
+			<QueryName condition="end with">.adap.tv</QueryName> <!--Ads:AOL | Microsoft default exclusion [ https://www.crunchbase.com/organization/adap-tv ] -->
+			<QueryName condition="end with">.addthis.com</QueryName> <!--Ads:Oracle | Microsoft default exclusion [ https://en.wikipedia.org/wiki/AddThis ] -->
+			<QueryName condition="end with">.adform.net</QueryName> <!--Ads-->
+			<QueryName condition="end with">.adnxs.com</QueryName> <!--Ads: AppNexus | Microsoft default exclusion-->
+			<QueryName condition="end with">.adroll.com</QueryName> <!--Ads-->
+			<QueryName condition="end with">.adrta.com</QueryName> <!--Ads-->
+			<QueryName condition="end with">.adsafeprotected.com</QueryName> <!--Ads-->
+			<QueryName condition="end with">.adsrvr.org</QueryName> <!--Ads-->
+			<QueryName condition="end with">.adsymptotic.com</QueryName> <!--Ads-->
+			<QueryName condition="end with">.advertising.com</QueryName> <!--Ads | Microsoft default exclusion-->
+			<QueryName condition="end with">.agkn.com</QueryName> <!--Ads | [ https://www.home.neustar/privacy ] -->
+			<QueryName condition="end with">.amazon-adsystem.com</QueryName> <!--Ads-->
+			<QueryName condition="end with">.amazon-adsystem.com</QueryName> <!--Ads-->
+			<QueryName condition="end with">.analytics.yahoo.com</QueryName> <!--Ads:Yahoo-->
+			<QueryName condition="end with">.aol.com</QueryName> <!--Ads | Microsoft default exclusion -->
+			<QueryName condition="end with">.betrad.com</QueryName> <!--Ads | Microsoft default exclusion-->
+			<QueryName condition="end with">.bidswitch.net</QueryName> <!--Ads-->
+			<QueryName condition="end with">.casalemedia.com</QueryName> <!--Ads | Microsoft default exclusion-->
+			<QueryName condition="end with">.chartbeat.net</QueryName> <!--Ads | Microsoft default exclusion [ https://better.fyi/trackers/chartbeat.com/ ]-->
+			<QueryName condition="end with">.cnn.com</QueryName> <!-- Microsoft default exclusion-->
+			<QueryName condition="end with">.convertro.com</QueryName> <!--Ads:Verizon-->
+			<QueryName condition="end with">.criteo.com</QueryName> <!--Ads [ https://better.fyi/trackers/criteo.com/ ] -->
+			<QueryName condition="end with">.criteo.net</QueryName> <!--Ads [ https://better.fyi/trackers/criteo.com/ ] -->
+			<QueryName condition="end with">.crwdcntrl.net</QueryName> <!--Ads: Lotame [ https://better.fyi/trackers/crwdcntrl.net/ ] -->
+			<QueryName condition="end with">.demdex.net</QueryName> <!--Ads | Microsoft default exclusion-->
+			<QueryName condition="end with">.domdex.com</QueryName>
+			<QueryName condition="end with">.dotomi.com</QueryName> <!--Ads | Microsoft default exclusion-->
+			<QueryName condition="end with">.doubleclick.net</QueryName> <!--Ads:Conversant | Microsoft default exclusion [ https://www.crunchbase.com/organization/dotomi ] -->
+			<QueryName condition="end with">.doubleverify.com</QueryName> <!--Ads: Google-->
+			<QueryName condition="end with">.emxdgt.com</QueryName> <!--Ads: EMX-->
+			<QueryName condition="end with">.everesttech.net</QueryName> <!--Ads | [ https://better.fyi/trackers/everesttech.net/ ] -->
+			<QueryName condition="end with">.exelator.com</QueryName> <!--Ads:Nielson Marketing Cloud-->
+			<QueryName condition="end with">.google-analytics.com</QueryName> <!--Ads:Google | Microsoft default exclusion-->
+			<QueryName condition="end with">.googleadservices.com</QueryName> <!--Google-->
+			<QueryName condition="end with">.googlesyndication.com</QueryName> <!--Ads:Google, sometimes called during malicious ads, but not directly responsible | Microsoft default exclusion [ https://www.hackread.com/wp-content/uploads/2018/06/Bitdefender-Whitepaper-Zacinlo.pdf ]-->
+			<QueryName condition="end with">.googletagmanager.com</QueryName> <!--Google-->
+			<QueryName condition="end with">.googlevideo.com</QueryName> <!--Google | Microsoft default exclusion-->
+			<QueryName condition="end with">.gstatic.com</QueryName> <!--Google | Microsoft default exclusion-->
+			<QueryName condition="end with">.gvt1.com</QueryName> <!--Google-->
+			<QueryName condition="end with">.gvt2.com</QueryName> <!--Google-->
+			<QueryName condition="end with">.ib-ibi.com</QueryName> <!--Ads: Offerpath [ https://better.fyi/trackers/ib-ibi.com/ ] -->
+			<QueryName condition="end with">.jivox.com</QueryName> <!--Ads-->
+			<QueryName condition="end with">.krxd.net</QueryName> <!--Ads-->
+			<QueryName condition="end with">.lijit.com</QueryName> <!--Ads-->
+			<QueryName condition="end with">.mathtag.com</QueryName> <!--Microsoft default exclusion-->
+			<QueryName condition="end with">.moatads.com</QueryName> <!--Ads | Microsoft default exclusion-->
+			<QueryName condition="end with">.moatpixel.com</QueryName> <!--Ads | Microsoft default exclusion-->
+			<QueryName condition="end with">.mookie1.com</QueryName> <!--Ads-->
+			<QueryName condition="end with">.myvisualiq.net</QueryName> <!--Ads-->
+			<QueryName condition="end with">.netmng.com</QueryName> <!--Ads-->
+			<QueryName condition="end with">.nexac.com</QueryName> <!--Ads | Microsoft default exclusion-->
+			<QueryName condition="end with">.openx.net</QueryName> <!--Ads-->
+			<QueryName condition="end with">.optimizely.com</QueryName> <!--Ads-->
+			<QueryName condition="end with">.outbrain.com</QueryName> <!--Ads-->
+			<QueryName condition="end with">.pardot.com</QueryName> <!--Ads-->
+			<QueryName condition="end with">.phx.gbl</QueryName> <!--Ads | Microsoft default exclusion-->
+			<QueryName condition="end with">.pinterest.com</QueryName> <!--Pinerest-->
+			<QueryName condition="end with">.pubmatic.com</QueryName> <!--Ads | Microsoft default exclusion-->
+			<QueryName condition="end with">.quantcount.com</QueryName>
+			<QueryName condition="end with">.quantserve.com</QueryName>
+			<QueryName condition="end with">.revsci.net</QueryName> <!--Ads:Omniture | Microsoft default exclusion-->
+			<QueryName condition="end with">.rfihub.net</QueryName> <!--Ads | Microsoft default exclusion-->
+			<QueryName condition="end with">.rlcdn.com</QueryName> <!--Ads: Rapleaf [ https://better.fyi/trackers/rlcdn.com/ ] -->
+			<QueryName condition="end with">.rubiconproject.com</QueryName> <!--Ads: Rubicon Project | Microsoft default exclusion [ https://better.fyi/trackers/rubiconproject.com/ ] -->
+			<QueryName condition="end with">.scdn.co</QueryName> <!--Spotify-->
+			<QueryName condition="end with">.scorecardresearch.com</QueryName> <!--Ads: Comscore | Microsoft default exclusion-->
+			<QueryName condition="end with">.serving-sys.com</QueryName> <!--Ads | Microsoft default exclusion-->
+			<QueryName condition="end with">.sharethrough.com</QueryName> <!--Ads-->
+			<QueryName condition="end with">.simpli.fi</QueryName>
+			<QueryName condition="end with">.sitescout.com</QueryName> <!--Ads-->
+			<QueryName condition="end with">.smartadserver.com</QueryName> <!--Ads-->
+			<QueryName condition="end with">.snapads.com</QueryName> <!--Ads-->
+			<QueryName condition="end with">.spotxchange.com</QueryName> <!--Ads-->
+			<QueryName condition="end with">.taboola.com</QueryName> <!--Ads:Taboola-->
+			<QueryName condition="end with">.taboola.map.fastly.net</QueryName> <!--Ads:Taboola-->
+			<QueryName condition="end with">.tapad.com</QueryName>
+			<QueryName condition="end with">.tidaltv.com</QueryName> <!--Ads: Videology [ https://better.fyi/trackers/tidaltv.com/ ] -->
+			<QueryName condition="end with">.trafficmanager.net</QueryName> <!--Ads | Microsoft default exclusion-->
+			<QueryName condition="end with">.tremorhub.com</QueryName> <!--Ads-->
+			<QueryName condition="end with">.tribalfusion.com</QueryName> <!--Ads: Exponential [ https://better.fyi/trackers/tribalfusion.com/ ] -->
+			<QueryName condition="end with">.turn.com</QueryName> <!--Ads | Microsoft default exclusion [ https://better.fyi/trackers/turn.com/ ] -->
+			<QueryName condition="end with">.twimg.com</QueryName> <!--Ads | Microsoft default exclusion-->
+			<QueryName condition="end with">.tynt.com</QueryName> <!--Ads-->
+			<QueryName condition="end with">.w55c.net</QueryName> <!--Ads:dataxu-->
+			<QueryName condition="end with">.ytimg.com</QueryName> <!--Google-->
+			<QueryName condition="end with">.zorosrv.com</QueryName> <!--Ads:Taboola-->
+			<QueryName condition="is">1rx.io</QueryName> <!--Ads-->
+			<QueryName condition="is">adservice.google.com</QueryName> <!--Google-->
+			<QueryName condition="is">ampcid.google.com</QueryName> <!--Google-->
+			<QueryName condition="is">clientservices.googleapis.com</QueryName> <!--Google-->
+			<QueryName condition="is">googleadapis.l.google.com</QueryName> <!--Google-->
+			<QueryName condition="is">imasdk.googleapis.com</QueryName> <!--Google [ https://developers.google.com/interactive-media-ads/docs/sdks/html5/ ] -->
+			<QueryName condition="is">l.google.com</QueryName> <!--Google-->
+			<QueryName condition="is">ml314.com</QueryName> <!--Ads-->
+			<QueryName condition="is">mtalk.google.com</QueryName> <!--Google-->
+			<QueryName condition="is">update.googleapis.com</QueryName> <!--Google-->
+			<QueryName condition="is">www.googletagservices.com</QueryName> <!--Google-->
+			<!--SocialNet-->
+			<QueryName condition="end with">.pscp.tv</QueryName> <!--Twitter:Periscope-->
+			<!--OSCP/CRL Common-->
+			<QueryName condition="end with">.amazontrust.com</QueryName>
+			<QueryName condition="end with">.digicert.com</QueryName>
+			<QueryName condition="end with">.globalsign.com</QueryName>
+			<QueryName condition="end with">.globalsign.net</QueryName>
+			<QueryName condition="end with">.intel.com</QueryName>
+			<QueryName condition="end with">.symcb.com</QueryName> <!--Digicert-->
+			<QueryName condition="end with">.symcd.com</QueryName> <!--Digicert-->
+			<QueryName condition="end with">.thawte.com</QueryName>
+			<QueryName condition="end with">.usertrust.com</QueryName>
+			<QueryName condition="end with">.verisign.com</QueryName>
+			<QueryName condition="end with">ocsp.identrust.com</QueryName>
+			<QueryName condition="end with">pki.goog</QueryName>
+			<QueryName condition="is">msocsp.com</QueryName> <!--Microsoft:OCSP-->
+			<QueryName condition="is">ocsp.comodoca.com</QueryName>
+			<QueryName condition="is">ocsp.entrust.net</QueryName>
+			<QueryName condition="is">ocsp.godaddy.com</QueryName>
+			<QueryName condition="is">ocsp.int-x3.letsencrypt.org</QueryName>
+			<QueryName condition="is">ocsp.msocsp.com</QueryName> <!--Microsoft:OCSP-->
+			<QueryName condition="is">pki.goog</QueryName>
+			<QueryName condition="end with">.pki.goog</QueryName>
+			<QueryName condition="is">ocsp.godaddy.com</QueryName>
+			<QueryName condition="is">amazontrust.com</QueryName>
+			<QueryName condition="end with">.amazontrust.com</QueryName>
+			<QueryName condition="is">ocsp.sectigo.com</QueryName>
+			<QueryName condition="is">pki-goog.l.google.com</QueryName>
+			<QueryName condition="end with">.usertrust.com</QueryName>
+			<QueryName condition="is">ocsp.comodoca.com</QueryName>
+			<QueryName condition="is">ocsp.verisign.com</QueryName>
+			<QueryName condition="is">ocsp.entrust.net</QueryName>
+			<QueryName condition="is">ocsp.identrust.com</QueryName>
+			<QueryName condition="end with">.ocsp.identrust.com</QueryName>
+			<QueryName condition="is">status.rapidssl.com</QueryName>
+			<QueryName condition="is">status.thawte.com</QueryName>
+			<QueryName condition="is">ocsp.int-x3.letsencrypt.org</QueryName>
+			<!-- SECTION: PRTG -->
+			<Image condition="is">C:\Program Files (x86)\PRTG Network Monitor\PRTG Probe.exe</Image>
+		</DnsQuery>
+	</RuleGroup>
+
+	<!--SYSMON EVENT ID 23 : FILE DELETE [FileDelete]-->
+		<!--EVENT 23: "File Delete"-->
+		<!--COMMENT:	Sandbox usage. When a program signals to Windows a file should be deleted or wiped, Sysmon may be able to capture it.
+			Tries to save a copy of the deleted file in the archivedirectory which defaults to C:\Sysmon (to view uncheck "Hide protected
+			operating system files (Recommended)" from Folder Options). Can quickly fill the available drive space with copies of files.
+			Use EVENT ID 26 if a copy is not needed.
+			[ https://isc.sans.edu/forums/diary/Sysmon+and+File+Deletion/26084/ ]
+		-->
+
+		<!--DATA: RuleName, UtcTime, ProcessGuid, ProcessId, User, Image, TargetFilename, Hashes, IsExecutable, Archived -->
+
+	<!--
+	<RuleGroup name="" groupRelation="or">
+		<FileDelete onmatch="include">
+		</FileDelete>
+	</RuleGroup>
+	-->
+
+	<!--SYSMON EVENT ID 24 : CLIPBOARD EVENT MONITORING [ClipboardChange]-->
+		<!--EVENT 24: "Clipboard changed"-->
+		<!--COMMENT:	Sandbox usage. Sysmon can capture the contents of clipboard events.
+			An example of what could be a production usage on restricted desktops is provided below, but it is commented-out. -->
+
+		<!--DATA: EventType, UtcTime, ProcessGuid, ProcessId, Image, Session, ClientInfo, Hashes, Archived -->
+
+	<!--
+	<RuleGroup name="" groupRelation="or">
+		<ClipboardChange onmatch="include">
+			<Image condition="end with">wscript.exe</Image>
+			<Image condition="end with">cscript.exe</Image>
+			<Image condition="end with">powershell.exe</Image>
+			<Image condition="end with">rdpclip.exe</Image>
+		</ClipboardChange>
+	</RuleGroup>
+	-->
+
+	<!--SYSMON EVENT ID 25 : PROCESS TAMPERING [ProcessTampering]-->
+		<!--EVENT 25: "Process Tampering"-->
+		<!--COMMENT:	This event is generated when a process image is changed from an external source, such as a different process.
+			This may or may not provide value in your environment as it requires tuning and a SIEM to correlate the ProcessGuids.
+			[ https://medium.com/falconforce/sysmon-13-process-tampering-detection-820366138a6c ] -->
+
+		<!--DATA: EventType, RuleName, UtcTime, ProcessGuid, ProcessId, Image, Type -->
+
+	<!--
+	<RuleGroup name="" groupRelation="or">
+		<ProcessTampering onmatch="exclude">
+			<Image condition="begin with">C:\Program Files (x86)\Microsoft\Edge\Application\</Image>
+		</ProcessTampering>
+	</RuleGroup>
+	-->
+
+	<!--SYSMON EVENT ID 26 : FILE DELETE LOGGED [FileDeleteDetected]-->
+		<!--EVENT 26: "File Delete logged"-->
+		<!--COMMENT:	This event is generated when a program signals to Windows a file should be deleted or wiped, Sysmon may be able to capture it.
+			Unlike event ID 23 it does not archive a copy of the file deleted allowing for more widespread use outside of a sandbox or IR triage without
+			risk of filling up the storage space with deleted archives.
+			[ https://medium.com/falconforce/sysmon-13-10-filedeletedetected-fe2475cb419e ]
+		-->
+
+		<!--DATA: RuleName, UtcTime, ProcessGuid, ProcessId, User, Image, TargetFilename, Hashes, IsExecutable -->
+
+	<!--SYSMON EVENT ID 255 : ERROR-->
+		<!--"This event is generated when an error occurred within Sysmon. They can happen if the system is under heavy load
+			and certain tasked could not be performed or a bug exists in the Sysmon service. You can report any bugs on the
+			Sysinternals forum or over Twitter (@markrussinovich)."-->
+		<!--Cannot be filtered.-->
+
+
+	<!--SYSMON EVENT ID 27 : FILE BLOCK [FileBlockExecutable]-->
+		<!--EVENT 27: "File Block Executable"-->
+		<!--COMMENT:	This event is generated when an executable gets blocked
+			[ https://medium.com/@olafhartong/sysmon-14-0-fileblockexecutable-13d7ba3dff3e ]
+		-->
+
+	<RuleGroup name="" groupRelation="or">
+		<FileBlockExecutable onmatch="include">
+			<Image name="technique_id=T1105,technique_name=Ingress Tool Transfer" condition="image">excel.exe</Image>
+			<Image name="technique_id=T1105,technique_name=Ingress Tool Transfer" condition="image">winword.exe</Image>
+			<Image name="technique_id=T1105,technique_name=Ingress Tool Transfer" condition="image">powerpnt.exe</Image>
+			<Image name="technique_id=T1105,technique_name=Ingress Tool Transfer" condition="image">outlook.exe</Image>
+			<Image name="technique_id=T1105,technique_name=Ingress Tool Transfer" condition="image">msaccess.exe</Image>
+			<Image name="technique_id=T1105,technique_name=Ingress Tool Transfer" condition="image">mspub.exe</Image>
+		</FileBlockExecutable>
+	</RuleGroup>
+
+	</EventFiltering>
+</Sysmon>
diff --git a/sysmonconfig-trace.xml b/sysmonconfig-trace.xml
new file mode 100644
index 00000000..187a2b6e
--- /dev/null
+++ b/sysmonconfig-trace.xml
@@ -0,0 +1,282 @@
+<!--
+	Author: Roberto Rodriguez (@Cyb3rWard0g), some modifications by Nextron Systems staff
+	License: GPL-3.0
+	Sysmon version: 13.30
+	Modified: 2022/08/17
+
+	WARNING: This config is a "log all" config, which should only be used for debugging or research purposes. It generates a very high number of events (especially process access events; multiple MB per minute)
+
+	USE CASES: Debugging, Threat Research (which Sysmon events can be identified)
+-->
+<Sysmon schemaversion="4.81">
+   <!-- Capture all hashes -->
+   <HashAlgorithms>*</HashAlgorithms>
+   <DnsLookup>False</DnsLookup>
+   <ArchiveDirectory>Archive</ArchiveDirectory>
+   <CaptureClipboard/>
+   <EventFiltering>
+   		<RuleGroup name="" groupRelation="or">
+			<!-- Event ID 1 == Process Creation. Log all newly created processes except -->
+			<ProcessCreate onmatch="exclude">
+				<Image condition="image">Sysmon.exe</Image>
+				<Image condition="contains">splunk</Image>
+				<Image condition="contains">btool.exe</Image>
+				<Image condition="contains">SnareCore</Image>
+				<Image condition="contains">nxlog</Image>
+				<Image condition="contains">winlogbeat</Image>
+				<Image condition="contains">Microsoft Monitoring Agent\Agent\MonitoringHost.exe</Image>
+				<Image condition="begin with">C:\Program Files\NVIDIA Corporation\Display\</Image>
+				<Image condition="is">C:\Program Files\Dell\SupportAssist\pcdrcui.exe</Image>
+				<Image condition="is">C:\Program Files\Dell\SupportAssist\koala.exe</Image>
+				<Image condition="is">C:\WindowsAzure\Packages\CollectGuestLogs</Image>
+				<Image condition="begin with">C:\Program Files\Windows Defender</Image>
+				<Image condition="is">C:\Windows\System32\audiodg.exe</Image>
+				<Image condition="is">C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe</Image>
+				<Image condition="is">C:\Program Files (x86)\Google\Update\GoogleUpdate.exe</Image>
+				<Image condition="end with">ec2config.exe</Image>
+				<CommandLine condition="begin with">C:\WIndows\System32\poqexec.exe /noreboot /transaction</CommandLine>
+			</ProcessCreate>
+		</RuleGroup>
+		<RuleGroup name="" groupRelation="or">
+			<!-- Event ID 2 == File Creation Time. POC - Log file modified creation time -->
+			<FileCreateTime onmatch="exclude"/>
+		</RuleGroup>
+		<RuleGroup name="" groupRelation="or">
+			<!-- Event ID 3 == Network Connection. Log all initiated network connection except -->
+			<NetworkConnect onmatch="exclude">
+				<Image condition="is">C:\Program Files\Microsoft Office\Office15\ONENOTE.EXE</Image>
+				<Image condition="end with">Spotify.exe</Image>
+				<Image condition="end with">OneDrive.exe</Image>
+				<Image condition="end with">AppData\Roaming\Dashlane\Dashlane.exe</Image>
+				<Image condition="end with">AppData\Roaming\Dashlane\DashlanePlugin.exe</Image>
+				<Image condition="end with">winlogbeat.exe</Image>
+				<Image condition="end with">ec2config.exe</Image>
+				<Image condition="end with">cfn-signal.exe</Image>
+				<Image condition="end with">amazon-ssm-agent.exe</Image>
+				<Image condition="end with">ec2wallpaperinfo.exe</Image>
+				<Image condition="is">C:\Windows\System32\spoolsv.exe</Image>
+				<Image condition="is">C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe</Image>
+				<Image condition="is">C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe</Image>
+				<Image condition="is">C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe</Image>
+				<Image condition="is">C:\Windows\System32\CompatTelRunner.exe</Image>
+				<Image condition="is">C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe</Image>
+				<Image condition="is">C:\Program Files (x86)\Google\Chrome\Application\chrome.exe</Image>
+				<Image condition="is">C:\Windows\System32\mmc.exe</Image>
+				<Image condition="is">C:\Program Files\Microsoft VS Code\Code.exe</Image>
+				<Image condition="is">C:\Program Files\Microsoft Monitoring Agent\Agent\HealthService.exe</Image>
+				<Image condition="begin with">C:\Program Files\Windows Defender Advanced Threat Protection\</Image>
+				<Image condition="begin with">C:\Packages\Plugins\</Image> <!--Azure ARM Extensions -->
+				<Image condition="begin with">C:\WindowsAzure\</Image> <!--Azure -->
+				<Image condition="begin with">C:\Program Files\Azure Advanced Threat Protection Sensor\</Image> <!--Azure Microsoft Defender for Identity -->
+				<Image condition="begin with">C:\Program Files\Microsoft Azure AD Connect Health Sync Agent\</Image> <!--Azure AD Connect Agent -->
+				<Image condition="begin with">C:\Program Files\Microsoft Azure AD Sync\</Image> <!--Azure AD Connect Agent -->
+				<Image condition="begin with">C:\Program Files\Microsoft Monitoring Agent\</Image> <!--Azure Microsoft Monitoring Agent -->
+			</NetworkConnect>
+		</RuleGroup>
+		<RuleGroup name="" groupRelation="or">
+			<!-- Event ID 5 == Process Terminated. Log processes terminated -->
+			<ProcessTerminate onmatch="exclude" />
+		</RuleGroup>
+		<RuleGroup name="" groupRelation="or">
+			<!-- Event ID 6 == Driver Loaded. Log all drivers except those with the following signatures -->
+			<DriverLoad onmatch="exclude">
+				<Signature condition="contains">microsoft</Signature>
+				<Signature condition="contains">windows</Signature>
+				<Signature condition="is">VMware</Signature>
+				<Signature condition="begin with">Intel </Signature>
+			</DriverLoad>
+		</RuleGroup>
+		<RuleGroup name="" groupRelation="or">
+			<!-- Event ID 7 == Image Loaded. Log everything except -->
+			<ImageLoad onmatch="exclude">
+				<Image condition="image">chrome.exe</Image>
+				<Image condition="image">vmtoolsd.exe</Image>
+				<Image condition="image">Sysmon.exe</Image>
+				<Image condition="image">mmc.exe</Image>
+				<Image condition="is">C:\Program Files (x86)\Google\Update\GoogleUpdate.exe</Image>
+				<Image condition="is">C:\Windows\System32\taskeng.exe</Image>
+				<Image condition="is">C:\Program Files\VMware\VMware Tools\TPAutoConnect.exe</Image>
+				<Image condition="is">C:\Program Files\Windows Defender\NisSrv.exe</Image>
+				<Image condition="is">C:\Program Files\Windows Defender\MsMpEng.exe</Image>
+				<Image condition="end with">onedrivesetup.exe</Image>
+				<Image condition="end with">onedrive.exe</Image>
+				<Image condition="end with">skypeapp.exe</Image>
+				<Image condition="begin with">C:\Packages\Plugins\</Image> <!--Azure ARM Extensions -->
+				<Image condition="begin with">C:\WindowsAzure\</Image> <!--Azure -->
+				<ImageLoaded condition="begin with">C:\Program Files\Microsoft Monitoring Agent\</ImageLoaded> <!--Azure Microsoft Monitoring Aget-->
+			</ImageLoad>
+		</RuleGroup>
+		<RuleGroup name="" groupRelation="or">
+			<!-- Event ID 8 == CreateRemoteThread. Log everything except -->
+			<CreateRemoteThread onmatch="exclude" />
+		</RuleGroup>
+		<RuleGroup name="" groupRelation="or">
+			<!-- Event ID 9 == RawAccessRead. Log everything except -->
+			<RawAccessRead onmatch="exclude">
+				<Image condition="image">Sysmon.exe</Image>
+				<Image condition="is">C:\Program Files\VMware\VMware Tools\vmtoolsd.exe</Image>
+				<Image condition="is">C:\Program Files (x86)\Google\Update\GoogleUpdate.exe</Image>
+			</RawAccessRead>
+		</RuleGroup>
+		<RuleGroup name="" groupRelation="or">
+			<!-- Event ID 10 == ProcessAccess. Log everything except -->
+			<ProcessAccess onmatch="exclude">
+				<SourceImage condition="is">C:\WINDOWS\System32\VBoxService.exe</SourceImage>
+				<SourceImage condition="is">C:\Program Files\VMware\VMware Tools\vmtoolsd.exe</SourceImage>
+				<SourceImage condition="image">Sysmon.exe</SourceImage>
+				<SourceImage condition="image">GoogleUpdate.exe</SourceImage>
+				<SourceImage condition="image">aurora-agent-64.exe</SourceImage>
+				<SourceImage condition="is">C:\Program Files (x86)\Google\Chrome\Application\chrome.exe</SourceImage>
+				<SourceImage condition="is">C:\Program Files\Windows Defender\MsMpEng.exe</SourceImage>
+				<SourceImage condition="is">C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1907.4-0\MsMpEng.exe</SourceImage>
+				<SourceImage condition="is">C:\Program Files\Microsoft VS Code\Code.exe</SourceImage>
+				<SourceImage condition="is">C:\WindowsAzure\Packages\CollectGuestLogs.exe</SourceImage>
+				<SourceImage condition="is">C:\Program Files\Microsoft Monitoring Agent\Agent\HealthService.exe</SourceImage>
+				<SourceImage condition="is">C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe</SourceImage>
+				<TargetImage condition="image">Sysmon.exe</TargetImage>
+				<TargetImage condition="is">C:\Program Files\VMware\VMware Tools\TPAutoConnSvc.exe</TargetImage>
+				<TargetImage condition="is">C:\Program Files\VMware\VMware Tools\TPAutoConnect.exe</TargetImage>
+				<TargetImage condition="is">C:\Program Files\Microsoft VS Code\Code.exe</TargetImage>
+				<TargetImage condition="is">C:\Program Files\Windows Defender\MsMpEng.exe</TargetImage>
+				<TargetImage condition="is">c:\Program Files\Microsoft VS Code\resources\app\out\vs\workbench\services\files\node\watcher\win32\CodeHelper.exe</TargetImage>
+				<TargetImage condition="is">C:\Program Files\Amazon\Ec2ConfigService\Ec2Config.exe</TargetImage>
+				<TargetImage condition="is">C:\Program Files\Microsoft Monitoring Agent\Agent\HealthService.exe</TargetImage>
+				<TargetImage condition="is">C:\windows\system32\CompatTelRunner.exe</TargetImage>
+				<TargetImage condition="begin with">C:\Packages\Plugins\</TargetImage> <!--Azure ARM Extensions -->
+				<TargetImage condition="begin with">C:\WindowsAzure\</TargetImage> <!--Azure -->
+				<TargetImage condition="begin with">C:\Program Files\WindowsApps\</TargetImage>
+				<TargetImage condition="begin with">C:\Program Files\Windows Defender Advanced Threat Protection\</TargetImage>
+				<SourceImage condition="begin with">C:\Program Files\Windows Defender Advanced Threat Protection\</SourceImage>
+				<TargetImage condition="begin with">C:\Windows\SystemApps\InputApp</TargetImage>
+				<SourceImage condition="begin with">C:\Program Files\Azure Advanced Threat Protection Sensor\</SourceImage> <!-- Microsoft Defender for Identity Sensor -->
+				<SourceImage condition="end with">Microsoft.Tri.Sensor.Updater.exe</SourceImage> <!-- Microsoft Defender for Identity Sensor -->
+				<SourceImage condition="end with">onedrivesetup.exe</SourceImage>
+				<TargetImage condition="end with">StartMenuExperienceHost.exe</TargetImage>
+				<TargetImage condition="end with">ShellExperienceHost.exe</TargetImage>
+				<TargetImage condition="end with">mmc.exe</TargetImage>
+				<TargetImage condition="end with">Microsoft.Tri.Sensor.exe</TargetImage> <!-- Microsoft Defender for Identity Sensor -->
+				<TargetImage condition="end with">Microsoft.Tri.Sensor.Updater.exe</TargetImage> <!-- Microsoft Defender for Identity Sensor -->
+				<SourceImage condition="begin with">C:\ProgramData\Microsoft\Windows Defender\platform\</SourceImage>
+				<Rule name="RuntimeBroker" groupRelation="and">
+					<SourceImage condition="is">C:\Windows\System32\RuntimeBroker.exe</SourceImage>
+					<TargetImage condition="is">C:\windows\Explorer.EXE</TargetImage>
+				</Rule>
+				<Rule name="MsMpEng" groupRelation="and">
+					<SourceImage condition="begin with">C:\ProgramData\Microsoft\Windows Defender\platform\</SourceImage>
+					<TargetImage condition="end with">\svchost.exe</TargetImage>
+				</Rule>
+				<TargetImage condition="contains">Microsoft.Windows.Cortana</TargetImage>
+			</ProcessAccess>
+		</RuleGroup>
+		<RuleGroup name="" groupRelation="or">
+			<!-- Event ID 11 == FileCreate. Log everything except -->
+			<FileCreate onmatch="exclude">
+				<Image condition="image">SearchIndexer.exe</Image>
+				<Image condition="image">winlogbeat.exe</Image>
+				<Image condition="is">C:\Program Files (x86)\Google\Chrome\Application\chrome.exe</Image>
+				<Image condition="is">C:\Program Files\Microsoft VS Code\Code.exe</Image>
+				<Image condition="end with">onedrivesetup.exe</Image>
+				<Image condition="end with">onedrive.exe</Image>
+				<Image condition="end with">skypeapp.exe</Image>
+				<Image condition="begin with">C:\Packages\Plugins\</Image> <!--Azure ARM Extensions -->
+				<Image condition="begin with">C:\WindowsAzure\</Image> <!--Azure -->
+				<Image condition="begin with">C:\Windows\SystemApps\Microsoft.Windows.Cortana</Image>
+				<Image condition="begin with">C:\Program Files\Microsoft Azure AD Sync\</Image> <!--Azure AD Connect Agent -->
+				<Image condition="begin with">C:\Program Files\Microsoft Azure AD Connect Health Sync Agent\</Image> <!--Azure AD Connect Agent -->
+				<TargetFilename condition="begin with">C:\Windows\System32\winevt\Logs\</TargetFilename>
+			</FileCreate>
+		</RuleGroup>
+		<RuleGroup name="" groupRelation="or">
+			<!-- Event ID 12,13,14 == RegObject added/deleted, RegValue Set, RegObject Renamed. Log everything except -->
+			<RegistryEvent onmatch="exclude">
+				<Image condition="is">C:\Program Files\VMware\VMware Tools\vmtoolsd.exe</Image>
+				<Image condition="image">Sysmon.exe</Image>
+				<Image condition="image">GoogleUpdate.exe</Image>
+				<Image condition="is">C:\Program Files\VMware\VMware Tools\TPAutoConnect.exe</Image>
+				<Image condition="is">C:\Program Files\Windows Defender\NisSrv.exe</Image>
+				<Image condition="is">C:\Program Files\Microsoft Monitoring Agent\Agent\HealthService.exe</Image>
+				<Image condition="is">C:\windows\system32\AUDIODG.EXE</Image>
+				<Image condition="is">C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe</Image>  <!--MDATP-->
+				<Image condition="is">C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe</Image> <!--MDATP-->
+				<Image condition="begin with">C:\Program Files\Azure Advanced Threat Protection Sensor\</Image> <!-- Microsoft Defender for Identity Sensor -->
+				<Image condition="begin with">C:\Windows\SystemApps\Microsoft.Windows.Cortana</Image>
+				<Image condition="begin with">C:\WindowsAzure\</Image>
+				<Image condition="end with">onedrivesetup.exe</Image>
+				<Image condition="end with">onedrive.exe</Image>
+				<Image condition="end with">skypeapp.exe</Image>
+				<Image condition="end with">Sysmon64.exe</Image>
+				<Image condition="end with">Microsoft.Tri.Sensor.exe</Image> <!-- Microsoft Defender for Identity Sensor -->
+				<Image condition="end with">Microsoft.Tri.Sensor.Updater.exe</Image> <!-- Microsoft Defender for Identity Sensor -->
+				<TargetObject condition="is">\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\Microsoft Print to PDF\PrinterDriverData</TargetObject>
+				<TargetObject condition="end with">LanguageList</TargetObject>
+				<TargetObject condition="end with">Windows.UI.SettingsAppThreshold.pri</TargetObject>
+				<TargetObject condition="end with">\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications</TargetObject>
+				<TargetObject condition="end with">\Software\Microsoft\Input\Settings\Insights</TargetObject>
+				<TargetObject condition="end with">\Schemas\StateSchema</TargetObject>
+				<TargetObject condition="end with">\Windows Search\CrawlScopeManager\Windows\SystemIndex</TargetObject>
+				<TargetObject condition="end with">\AppModel\StateRepository\Cache\Metadata</TargetObject>
+				<TargetObject condition="contains">\OpenWithProgids\</TargetObject>
+				<TargetObject condition="contains">\Microsoft.WindowsMaps</TargetObject>
+				<TargetObject condition="contains">\AppModel\Deployment\Package</TargetObject>
+				<TargetObject condition="contains">\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager</TargetObject>
+				<TargetObject condition="contains">\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization\</TargetObject>
+				<TargetObject condition="contains">\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.OneConnect</TargetObject>
+				<TargetObject condition="is">HKLM\SOFTWARE\Microsoft\SecurityManager\CapAuthz</TargetObject>
+				<TargetObject condition="contains">\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Cortana</TargetObject>
+				<TargetObject condition="contains">\DeliveryOptimization\Swarms\</TargetObject>
+				<TargetObject condition="is">HKLM\System\CurrentControlSet\Services\W32Time\Config\LastKnownGoodTime</TargetObject>
+				<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppReadiness\</TargetObject>
+				<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package</TargetObject> <!--Windows app package-->
+				<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason</TargetObject>
+			</RegistryEvent>
+		</RuleGroup>
+		<RuleGroup name="" groupRelation="or">
+			<!-- Event ID 15 == FileStream Created. Log when a file stream is created neither the hash of the contents of the stream -->
+			<FileCreateStreamHash onmatch="exclude" />
+		</RuleGroup>
+		<RuleGroup name="" groupRelation="or">
+			<!-- Event ID 17,18 == PipeEvent. Log Named pipe created & Named pipe connected -->
+			<PipeEvent onmatch="exclude">
+				<Image condition="begin with">C:\Packages\Plugins\</Image> <!--Azure ARM Extensions -->
+				<Image condition="begin with">C:\WindowsAzure\</Image> <!--Azure -->
+				<Image condition="is">C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe</Image> <!--Microsoft Monitoring Agent-->
+			</PipeEvent>
+		</RuleGroup>
+		<RuleGroup name="" groupRelation="or">
+			<!-- Event ID 19,20,21, == WmiEvent. Log all WmiEventFilter, WmiEventConsumer, WmiEventConsumerToFilter activity-->
+			<WmiEvent onmatch="exclude"/>
+		</RuleGroup>
+		<RuleGroup name="" groupRelation="or">
+			<!--Event ID 22 == DNS Query-->
+			<DnsQuery onmatch="exclude">
+				<Image condition="is">C:\Program Files (x86)\nxlog\nxlog.exe</Image>
+			</DnsQuery>
+		</RuleGroup>
+        <RuleGroup name="" groupRelation="or">
+			<!--Event ID 23 == File Delete-->
+			<FileDelete onmatch="include">
+            </FileDelete>
+		</RuleGroup>
+		<RuleGroup name="" groupRelation="or">
+			<!--Event ID 23 == File Delete-->
+			<FileDelete onmatch="exclude">
+				<Image condition="is">C:\windows\system32\mmc.exe</Image>
+            </FileDelete>
+		</RuleGroup>
+		<RuleGroup name="" groupRelation="or">
+			<!--Event ID 24 == Clipboard -->
+			<ClipboardChange onmatch="exclude" />
+		</RuleGroup>
+		<RuleGroup name="" groupRelation="or">
+			<!--Event ID 25 == ProcessTampering -->
+			<ProcessTampering onmatch="exclude" />
+		</RuleGroup>
+		<RuleGroup name="" groupRelation="or">
+			<!--Event ID 26 == FileDeleteDetected -->
+			<FileDeleteDetected onmatch="exclude">
+				<Image condition="begin with">C:\WindowsAzure\</Image> <!--Azure -->
+				<Image condition="begin with">C:\Packages\Plugins\</Image> <!--Azure ARM Extensions -->
+			</FileDeleteDetected>
+		</RuleGroup>
+  </EventFiltering>
+</Sysmon>

From c134c2b928056ed9dd67fc2d43bcd509437550d8 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Wed, 17 Aug 2022 12:45:54 +0200
Subject: [PATCH 065/149] docs: configs

---
 README.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/README.md b/README.md
index 81945ea2..b00970cc 100644
--- a/README.md
+++ b/README.md
@@ -17,6 +17,14 @@ It started as a is simply copy of the original repository. We merged most of the
 - PrinterNightmare
 - HiveNightmare
 
+## Configs
+
+This repo includes the original and two additional configurations
+
+- `sysmonconfig-export.xml` the original config provided by @SwiftOnSecurity
+- `sysmonconfig-export-block.xml` the original config provided by @SwiftOnSecurity with some basic blocking rules (careful!)
+- `sysmonconfig-trace.xml` a config by @Cyb3rWard0g that logs just everything with a few examples for debugging or threat research purposes
+
 ## Testing
 
 This configuration is focused on detection coverage. We have only one rather small testing environment to avoid problematic expressions that trigger too often. It is recommended to test the downloaded configuration on a small set of systems in your environment in any case.

From 3b4e2f5bb7475fd3e6818b7379eea70a6a46b781 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Wed, 17 Aug 2022 12:48:53 +0200
Subject: [PATCH 066/149] fix: updated placeholders

---
 sysmonconfig-export-block.xml | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index f7db4203..5c93229b 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -1319,12 +1319,11 @@
 
 	<RuleGroup name="" groupRelation="or">
 		<FileBlockExecutable onmatch="include">
-			<Image name="technique_id=T1105,technique_name=Ingress Tool Transfer" condition="image">excel.exe</Image>
-			<Image name="technique_id=T1105,technique_name=Ingress Tool Transfer" condition="image">winword.exe</Image>
-			<Image name="technique_id=T1105,technique_name=Ingress Tool Transfer" condition="image">powerpnt.exe</Image>
-			<Image name="technique_id=T1105,technique_name=Ingress Tool Transfer" condition="image">outlook.exe</Image>
-			<Image name="technique_id=T1105,technique_name=Ingress Tool Transfer" condition="image">msaccess.exe</Image>
-			<Image name="technique_id=T1105,technique_name=Ingress Tool Transfer" condition="image">mspub.exe</Image>
+			<TargetFilename condition="contains all">C:\Users\Public;.exe</TargetFilename>
+			<TargetFilename condition="contains all">C:\Users\Public;.ps1</TargetFilename>
+			<TargetFilename condition="contains all">C:\Users\Public;.vbs</TargetFilename>
+			<TargetFilename condition="contains all">C:\Users\Public;.bat</TargetFilename>
+			<TargetFilename condition="contains all">C:\Users\Public;.vbe</TargetFilename>
 		</FileBlockExecutable>
 	</RuleGroup>
 

From d746b575b794a139c3dc4f735d7dcd3aea6fefbf Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Wed, 17 Aug 2022 13:59:34 +0200
Subject: [PATCH 067/149] new block rules

---
 sysmonconfig-export-block.xml | 60 +++++++++++++++++++++++++++++++++++
 1 file changed, 60 insertions(+)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 5c93229b..2d4fa456 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -1319,11 +1319,71 @@
 
 	<RuleGroup name="" groupRelation="or">
 		<FileBlockExecutable onmatch="include">
+			<!-- Suspicious Extensions in Public Folder -->
 			<TargetFilename condition="contains all">C:\Users\Public;.exe</TargetFilename>
 			<TargetFilename condition="contains all">C:\Users\Public;.ps1</TargetFilename>
 			<TargetFilename condition="contains all">C:\Users\Public;.vbs</TargetFilename>
 			<TargetFilename condition="contains all">C:\Users\Public;.bat</TargetFilename>
 			<TargetFilename condition="contains all">C:\Users\Public;.vbe</TargetFilename>
+			<!-- Hacktool Blocks based on Imphashes -->
+			<Hashes condition="contains">IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932</Hashes> <!-- PetitPotam -->
+			<Hashes condition="contains">IMPHASH=3A19059BD7688CB88E70005F18EFC439</Hashes> <!-- PetitPotam -->
+			<Hashes condition="contains">IMPHASH=9DA6D5D77BE11712527DCAB86DF449A3</Hashes> <!-- Mimikatz -->
+			<Hashes condition="contains">IMPHASH=A6E01BC1AB89F8D91D9EAB72032AAE88</Hashes> <!-- Mimikatz -->
+			<Hashes condition="contains">IMPHASH=D21BBC50DCC169D7B4D0F01962793154</Hashes> <!-- Mimikatz -->
+			<Hashes condition="contains">IMPHASH=9528A0E91E28FBB88AD433FEABCA2456</Hashes> <!-- Mimikatz -->
+			<Hashes condition="contains">IMPHASH=4C1B52A19748428E51B14C278D0F58E3</Hashes> <!-- Mimikatz -->
+			<Hashes condition="contains">IMPHASH=725BB81DC24214F6ECACC0CFB36AD30D</Hashes> <!-- Mimikatz -->
+			<Hashes condition="contains">IMPHASH=672B13F4A0B6F27D29065123FE882DFC</Hashes> <!-- Mimikatz -->
+			<Hashes condition="contains">IMPHASH=0C106686A31BFE2BA931AE1CF6E9DBC6</Hashes> <!-- Mimikatz -->
+			<Hashes condition="contains">IMPHASH=23867A89C2B8FC733BE6CF5EF902F2D1</Hashes> <!-- JuicyPotato  -->
+			<Hashes condition="contains">IMPHASH=9FB060C2977A9D9B782440B98D410C3E</Hashes> <!-- RoguePotato -->
+			<Hashes condition="contains">IMPHASH=B18A1401FF8F444056D29450FBC0A6CE</Hashes> <!-- Pwdump -->
+			<Hashes condition="contains">IMPHASH=13F08707F759AF6003837A150A371BA1</Hashes> <!-- Pwdump -->
+			<Hashes condition="contains">IMPHASH=749A7BB1F0B4C4455949C0B2BF7F9E9F</Hashes> <!-- Pwdump -->
+			<Hashes condition="contains">IMPHASH=94CB940A1A6B65BED4D5A8F849CE9793</Hashes> <!-- PwDumpX -->
+			<Hashes condition="contains">IMPHASH=1781F06048A7E58B323F0B9259BE798B</Hashes> <!-- Pwdump -->
+			<Hashes condition="contains">IMPHASH=CB567F9498452721D77A451374955F5F</Hashes> <!-- Pwdump -->
+			<Hashes condition="contains">IMPHASH=730073214094CD328547BF1F72289752</Hashes> <!-- Htran -->
+			<Hashes condition="contains">IMPHASH=6EEFD92BFFBFB27F378B81C09CA96786</Hashes> <!-- Ncat -->
+			<Hashes condition="contains">IMPHASH=AC615FB1D93576FA3C26077A619C9144</Hashes> <!-- Ncat -->
+			<Hashes condition="contains">IMPHASH=DC25EE78E2EF4D36FAA0BADF1E7461C9</Hashes> <!-- Cobalt Strike beacons -->
+			<Hashes condition="contains">IMPHASH=17B461A082950FC6332228572138B80C</Hashes> <!-- Cobalt Strike beacons -->
+			<Hashes condition="contains">IMPHASH=C547F2E66061A8DFFB6F5A3FF63C0A74</Hashes> <!-- PPLDump -->
+			<Hashes condition="contains">IMPHASH=0588081AB0E63BA785938467E1B10CCA</Hashes> <!-- PPLDump -->
+			<Hashes condition="contains">IMPHASH=ADA161BF41B8E5E9132858CB54CAB5FB</Hashes> <!-- DripLoader -->
+			<Hashes condition="contains">IMPHASH=2A1BC4913CD5ECB0434DF07CB675B798</Hashes> <!-- DripLoader -->
+			<Hashes condition="contains">IMPHASH=11083E75553BAAE21DC89CE8F9A195E4</Hashes> <!-- DripLoader -->
+			<Hashes condition="contains">IMPHASH=A23D29C9E566F2FA8FFBB79267F5DF80</Hashes> <!-- DripLoader -->
+			<Hashes condition="contains">IMPHASH=4A07F944A83E8A7C2525EFA35DD30E2F</Hashes> <!-- CreateMiniDump -->
+			<Hashes condition="contains">IMPHASH=767637C23BB42CD5D7397CF58B0BE688</Hashes> <!-- UACMe Akagi -->
+			<Hashes condition="contains">IMPHASH=14C4E4C72BA075E9069EE67F39188AD8</Hashes> <!-- UACMe Akagi -->
+			<Hashes condition="contains">IMPHASH=3C782813D4AFCE07BBFC5A9772ACDBDC</Hashes> <!-- UACMe Akagi -->
+			<Hashes condition="contains">IMPHASH=7D010C6BB6A3726F327F7E239166D127</Hashes> <!-- UACMe Akagi -->
+			<Hashes condition="contains">IMPHASH=89159BA4DD04E4CE5559F132A9964EB3</Hashes> <!-- UACMe Akagi -->
+			<Hashes condition="contains">IMPHASH=6F33F4A5FC42B8CEC7314947BD13F30F</Hashes> <!-- UACMe Akagi -->
+			<Hashes condition="contains">IMPHASH=5834ED4291BDEB928270428EBBAF7604</Hashes> <!-- UACMe Akagi -->
+			<Hashes condition="contains">IMPHASH=5A8A8A43F25485E7EE1B201EDCBC7A38</Hashes> <!-- UACMe Akagi -->
+			<Hashes condition="contains">IMPHASH=DC7D30B90B2D8ABF664FBED2B1B59894</Hashes> <!-- UACMe Akagi -->
+			<Hashes condition="contains">IMPHASH=41923EA1F824FE63EA5BEB84DB7A3E74</Hashes> <!-- UACMe Akagi -->
+			<Hashes condition="contains">IMPHASH=3DE09703C8E79ED2CA3F01074719906B</Hashes> <!-- UACMe Akagi -->
+			<Hashes condition="contains">IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F</Hashes> <!-- WCE -->
+			<Hashes condition="contains">IMPHASH=E96A73C7BF33A464C510EDE582318BF2</Hashes> <!-- WCE -->
+		</FileBlockExecutable>
+	</RuleGroup>
+	
+	<!-- Microsoft Office Programs Dropping Suspicious Files -->
+	<RuleGroup name="" groupRelation="and">
+		<FileBlockExecutable onmatch="include">
+			<!-- Typical Office Programs -->
+			<Image condition="contains any">\excel.exe;\winword.exe</Image>
+		</FileBlockExecutable>
+		<FileBlockExecutable onmatch="include">
+			<!-- Suspicious Extensions -->
+			<TargetFilename condition="end with">.exe</TargetFilename>
+			<TargetFilename condition="end with">.ps1</TargetFilename>
+			<TargetFilename condition="end with">.vbs</TargetFilename>
+			<TargetFilename condition="end with">.bat</TargetFilename>
 		</FileBlockExecutable>
 	</RuleGroup>
 

From cc1683c92377c398e7fe9b8439e4f4d72e313314 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Wed, 17 Aug 2022 14:15:45 +0200
Subject: [PATCH 068/149] Last change

---
 sysmonconfig-export-block.xml | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 2d4fa456..c3406272 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -1317,7 +1317,7 @@
 			[ https://medium.com/@olafhartong/sysmon-14-0-fileblockexecutable-13d7ba3dff3e ]
 		-->
 
-	<RuleGroup name="" groupRelation="or">
+	<RuleGroup name="ImageBlock" groupRelation="or">
 		<FileBlockExecutable onmatch="include">
 			<!-- Suspicious Extensions in Public Folder -->
 			<TargetFilename condition="contains all">C:\Users\Public;.exe</TargetFilename>
@@ -1373,17 +1373,12 @@
 	</RuleGroup>
 	
 	<!-- Microsoft Office Programs Dropping Suspicious Files -->
-	<RuleGroup name="" groupRelation="and">
+	<RuleGroup name="OfficeDrop" groupRelation="and">
 		<FileBlockExecutable onmatch="include">
 			<!-- Typical Office Programs -->
-			<Image condition="contains any">\excel.exe;\winword.exe</Image>
-		</FileBlockExecutable>
-		<FileBlockExecutable onmatch="include">
+			<Image condition="end with">\winword.exe</Image>
 			<!-- Suspicious Extensions -->
-			<TargetFilename condition="end with">.exe</TargetFilename>
-			<TargetFilename condition="end with">.ps1</TargetFilename>
-			<TargetFilename condition="end with">.vbs</TargetFilename>
-			<TargetFilename condition="end with">.bat</TargetFilename>
+			<TargetFilename condition="contains any">.exe;.ps1;.vbs;.bat</TargetFilename>
 		</FileBlockExecutable>
 	</RuleGroup>
 

From 5e79e00c552c6ce5fc7f8fa196d6bf5557a7a6ad Mon Sep 17 00:00:00 2001
From: phantinuss <79651203+phantinuss@users.noreply.github.com>
Date: Wed, 17 Aug 2022 14:31:05 +0200
Subject: [PATCH 069/149] more office apps and file extensions

---
 sysmonconfig-export-block.xml | 24 +++++++++++++++---------
 1 file changed, 15 insertions(+), 9 deletions(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index c3406272..71166e5b 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -1369,18 +1369,24 @@
 			<Hashes condition="contains">IMPHASH=3DE09703C8E79ED2CA3F01074719906B</Hashes> <!-- UACMe Akagi -->
 			<Hashes condition="contains">IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F</Hashes> <!-- WCE -->
 			<Hashes condition="contains">IMPHASH=E96A73C7BF33A464C510EDE582318BF2</Hashes> <!-- WCE -->
-		</FileBlockExecutable>
-	</RuleGroup>
-	
-	<!-- Microsoft Office Programs Dropping Suspicious Files -->
-	<RuleGroup name="OfficeDrop" groupRelation="and">
-		<FileBlockExecutable onmatch="include">
+			<!-- Microsoft Office Programs Dropping Suspicious Files -->
+			<RuleGroup name="OfficeDrop" groupRelation="and">
 			<!-- Typical Office Programs -->
-			<Image condition="end with">\winword.exe</Image>
+				<RuleGroup name="OfficeApps" groupRelation="or">
+					<Image condition="image">winword.exe</Image>
+					<Image condition="image">excel.exe</Image>
+					<Image condition="image">powerpnt.exe</Image>
+					<Image condition="image">msaccess.exe</Image>
+					<Image condition="image">mspub.exe</Image>
+					<Image condition="image">eqnedt32.exe</Image>
+					<Image condition="image">visio.exe</Image>
+					<Image condition="image">wordpad.exe</Image>
+					<Image condition="image">wordview.exe</Image>
+				</RuleGroup>
 			<!-- Suspicious Extensions -->
-			<TargetFilename condition="contains any">.exe;.ps1;.vbs;.bat</TargetFilename>
+			<TargetFilename condition="contains any">.exe;.dll;.bat;.ps1;.vbs;.vbe;.hta</TargetFilename>
+			</RuleGroup>
 		</FileBlockExecutable>
 	</RuleGroup>
-
 	</EventFiltering>
 </Sysmon>

From 9ae94983fe3f4c75ce786f7b220e3d120b2cdb71 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Wed, 17 Aug 2022 14:40:04 +0200
Subject: [PATCH 070/149] new hacktool imphashes

---
 sysmonconfig-export-block.xml | 59 ++++++++++++++++++++++++++++-------
 1 file changed, 48 insertions(+), 11 deletions(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index c3406272..3a3f9498 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -1328,29 +1328,66 @@
 			<!-- Hacktool Blocks based on Imphashes -->
 			<Hashes condition="contains">IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932</Hashes> <!-- PetitPotam -->
 			<Hashes condition="contains">IMPHASH=3A19059BD7688CB88E70005F18EFC439</Hashes> <!-- PetitPotam -->
+			<Hashes condition="contains">IMPHASH=bf6223a49e45d99094406777eb6004ba</Hashes> <!-- PetitPotam -->
+			<Hashes condition="contains">IMPHASH=0C106686A31BFE2BA931AE1CF6E9DBC6</Hashes> <!-- Mimikatz -->
+			<Hashes condition="contains">IMPHASH=0D1447D4B3259B3C2A1D4CFB7ECE13C3</Hashes> <!-- Mimikatz -->
+			<Hashes condition="contains">IMPHASH=1B0369A1E06271833F78FFA70FFB4EAF</Hashes> <!-- Mimikatz -->
+			<Hashes condition="contains">IMPHASH=4C1B52A19748428E51B14C278D0F58E3</Hashes> <!-- Mimikatz -->
+			<Hashes condition="contains">IMPHASH=4D927A711F77D62CEBD4F322CB57EC6F</Hashes> <!-- Mimikatz -->
+			<Hashes condition="contains">IMPHASH=66EE036DF5FC1004D9ED5E9A94A1086A</Hashes> <!-- Mimikatz -->
+			<Hashes condition="contains">IMPHASH=672B13F4A0B6F27D29065123FE882DFC</Hashes> <!-- Mimikatz -->
+			<Hashes condition="contains">IMPHASH=6BBD59CEA665C4AFCC2814C1327EC91F</Hashes> <!-- Mimikatz -->
+			<Hashes condition="contains">IMPHASH=725BB81DC24214F6ECACC0CFB36AD30D</Hashes> <!-- Mimikatz -->
+			<Hashes condition="contains">IMPHASH=9528A0E91E28FBB88AD433FEABCA2456</Hashes> <!-- Mimikatz -->
 			<Hashes condition="contains">IMPHASH=9DA6D5D77BE11712527DCAB86DF449A3</Hashes> <!-- Mimikatz -->
 			<Hashes condition="contains">IMPHASH=A6E01BC1AB89F8D91D9EAB72032AAE88</Hashes> <!-- Mimikatz -->
+			<Hashes condition="contains">IMPHASH=B24C5EDDAEA4FE50C6A96A2A133521E4</Hashes> <!-- Mimikatz -->
 			<Hashes condition="contains">IMPHASH=D21BBC50DCC169D7B4D0F01962793154</Hashes> <!-- Mimikatz -->
-			<Hashes condition="contains">IMPHASH=9528A0E91E28FBB88AD433FEABCA2456</Hashes> <!-- Mimikatz -->
-			<Hashes condition="contains">IMPHASH=4C1B52A19748428E51B14C278D0F58E3</Hashes> <!-- Mimikatz -->
-			<Hashes condition="contains">IMPHASH=725BB81DC24214F6ECACC0CFB36AD30D</Hashes> <!-- Mimikatz -->
-			<Hashes condition="contains">IMPHASH=672B13F4A0B6F27D29065123FE882DFC</Hashes> <!-- Mimikatz -->
-			<Hashes condition="contains">IMPHASH=0C106686A31BFE2BA931AE1CF6E9DBC6</Hashes> <!-- Mimikatz -->
+			<Hashes condition="contains">IMPHASH=FCC251CCEAE90D22C392215CC9A2D5D6</Hashes> <!-- Mimikatz -->
 			<Hashes condition="contains">IMPHASH=23867A89C2B8FC733BE6CF5EF902F2D1</Hashes> <!-- JuicyPotato  -->
-			<Hashes condition="contains">IMPHASH=9FB060C2977A9D9B782440B98D410C3E</Hashes> <!-- RoguePotato -->
-			<Hashes condition="contains">IMPHASH=B18A1401FF8F444056D29450FBC0A6CE</Hashes> <!-- Pwdump -->
+			<Hashes condition="contains">IMPHASH=A37FF327F8D48E8A4D2F757E1B6E70BC</Hashes> <!-- JuicyPotato  -->
+			<Hashes condition="contains">IMPHASH=6118619783FC175BC7EBECFF0769B46E</Hashes> <!-- RoguePotato -->
+			<Hashes condition="contains">IMPHASH=959A83047E80AB68B368FDB3F4C6E4EA</Hashes> <!-- RoguePotato -->
+			<Hashes condition="contains">IMPHASH=563233BFA169ACC7892451F71AD5850A</Hashes> <!-- RoguePotato -->
+			<Hashes condition="contains">IMPHASH=87575CB7A0E0700EB37F2E3668671A08</Hashes> <!-- RoguePotato -->
 			<Hashes condition="contains">IMPHASH=13F08707F759AF6003837A150A371BA1</Hashes> <!-- Pwdump -->
+			<Hashes condition="contains">IMPHASH=1781F06048A7E58B323F0B9259BE798B</Hashes> <!-- Pwdump -->
+			<Hashes condition="contains">IMPHASH=233F85F2D4BC9D6521A6CAAE11A1E7F5</Hashes> <!-- Pwdump -->
+			<Hashes condition="contains">IMPHASH=24AF2584CBF4D60BBE5C6D1B31B3BE6D</Hashes> <!-- Pwdump -->
+			<Hashes condition="contains">IMPHASH=632969DDF6DBF4E0F53424B75E4B91F2</Hashes> <!-- Pwdump -->
+			<Hashes condition="contains">IMPHASH=713C29B396B907ED71A72482759ED757</Hashes> <!-- Pwdump -->
 			<Hashes condition="contains">IMPHASH=749A7BB1F0B4C4455949C0B2BF7F9E9F</Hashes> <!-- Pwdump -->
+			<Hashes condition="contains">IMPHASH=8628B2608957A6B0C6330AC3DE28CE2E</Hashes> <!-- Pwdump -->
+			<Hashes condition="contains">IMPHASH=8B114550386E31895DFAB371E741123D</Hashes> <!-- Pwdump -->
 			<Hashes condition="contains">IMPHASH=94CB940A1A6B65BED4D5A8F849CE9793</Hashes> <!-- PwDumpX -->
-			<Hashes condition="contains">IMPHASH=1781F06048A7E58B323F0B9259BE798B</Hashes> <!-- Pwdump -->
+			<Hashes condition="contains">IMPHASH=9D68781980370E00E0BD939EE5E6C141</Hashes> <!-- Pwdump -->
+			<Hashes condition="contains">IMPHASH=B18A1401FF8F444056D29450FBC0A6CE</Hashes> <!-- Pwdump -->
 			<Hashes condition="contains">IMPHASH=CB567F9498452721D77A451374955F5F</Hashes> <!-- Pwdump -->
 			<Hashes condition="contains">IMPHASH=730073214094CD328547BF1F72289752</Hashes> <!-- Htran -->
-			<Hashes condition="contains">IMPHASH=6EEFD92BFFBFB27F378B81C09CA96786</Hashes> <!-- Ncat -->
-			<Hashes condition="contains">IMPHASH=AC615FB1D93576FA3C26077A619C9144</Hashes> <!-- Ncat -->
-			<Hashes condition="contains">IMPHASH=DC25EE78E2EF4D36FAA0BADF1E7461C9</Hashes> <!-- Cobalt Strike beacons -->
 			<Hashes condition="contains">IMPHASH=17B461A082950FC6332228572138B80C</Hashes> <!-- Cobalt Strike beacons -->
+			<Hashes condition="contains">IMPHASH=DC25EE78E2EF4D36FAA0BADF1E7461C9</Hashes> <!-- Cobalt Strike beacons -->
+			<Hashes condition="contains">IMPHASH=819B19D53CA6736448F9325A85736792</Hashes> <!-- Cobalt Strike beacons -->
+			<Hashes condition="contains">IMPHASH=829DA329CE140D873B4A8BDE2CBFAA7E</Hashes> <!-- Cobalt Strike beacons -->
 			<Hashes condition="contains">IMPHASH=C547F2E66061A8DFFB6F5A3FF63C0A74</Hashes> <!-- PPLDump -->
 			<Hashes condition="contains">IMPHASH=0588081AB0E63BA785938467E1B10CCA</Hashes> <!-- PPLDump -->
+			<Hashes condition="contains">IMPHASH=0D9EC08BAC6C07D9987DFD0F1506587C</Hashes> <!-- NanoDump -->
+			<Hashes condition="contains">IMPHASH=BC129092B71C89B4D4C8CDF8EA590B29</Hashes> <!-- NanoDump -->
+			<Hashes condition="contains">IMPHASH=4DA924CF622D039D58BCE71CDF05D242</Hashes> <!-- NanoDump -->
+			<Hashes condition="contains">IMPHASH=E7A3A5C377E2D29324093377D7DB1C66</Hashes> <!-- NanoDump -->
+			<Hashes condition="contains">IMPHASH=9A9DBEC5C62F0380B4FA5FD31DEFFEDF</Hashes> <!-- NanoDump -->
+			<Hashes condition="contains">IMPHASH=AF8A3976AD71E5D5FDFB67DDB8DADFCE</Hashes> <!-- NanoDump -->
+			<Hashes condition="contains">IMPHASH=0C477898BBF137BBD6F2A54E3B805FF4</Hashes> <!-- NanoDump -->
+			<Hashes condition="contains">IMPHASH=0CA9F02B537BCEA20D4EA5EB1A9FE338</Hashes> <!-- NanoDump -->
+			<Hashes condition="contains">IMPHASH=3AB3655E5A14D4EEFC547F4781BF7F9E</Hashes> <!-- NanoDump -->
+			<Hashes condition="contains">IMPHASH=E6F9D5152DA699934B30DAAB206471F6</Hashes> <!-- NanoDump -->
+			<Hashes condition="contains">IMPHASH=3AD59991CCF1D67339B319B15A41B35D</Hashes> <!-- NanoDump -->
+			<Hashes condition="contains">IMPHASH=FFDD59E0318B85A3E480874D9796D872</Hashes> <!-- NanoDump -->
+			<Hashes condition="contains">IMPHASH=0CF479628D7CC1EA25EC7998A92F5051</Hashes> <!-- NanoDump -->
+			<Hashes condition="contains">IMPHASH=07A2D4DCBD6CB2C6A45E6B101F0B6D51</Hashes> <!-- NanoDump -->
+			<Hashes condition="contains">IMPHASH=D6D0F80386E1380D05CB78E871BC72B1</Hashes> <!-- NanoDump -->
+			<Hashes condition="contains">IMPHASH=F34D5F2D4577ED6D9CEEC516C1F5A744</Hashes> <!-- NanoDump -->
+			<Hashes condition="contains">IMPHASH=38D9E015591BBFD4929E0D0F47FA0055</Hashes> <!-- HandleKatz -->
+			<Hashes condition="contains">IMPHASH=0E2216679CA6E1094D63322E3412D650</Hashes> <!-- HandleKatz -->
 			<Hashes condition="contains">IMPHASH=ADA161BF41B8E5E9132858CB54CAB5FB</Hashes> <!-- DripLoader -->
 			<Hashes condition="contains">IMPHASH=2A1BC4913CD5ECB0434DF07CB675B798</Hashes> <!-- DripLoader -->
 			<Hashes condition="contains">IMPHASH=11083E75553BAAE21DC89CE8F9A195E4</Hashes> <!-- DripLoader -->

From 16edc4569203526478b9a1bef2b31b7ab045a026 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Wed, 17 Aug 2022 14:59:00 +0200
Subject: [PATCH 071/149] fix: .NET imphash

---
 sysmonconfig-export-block.xml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 3a3f9498..e21e2384 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -1385,7 +1385,6 @@
 			<Hashes condition="contains">IMPHASH=0CF479628D7CC1EA25EC7998A92F5051</Hashes> <!-- NanoDump -->
 			<Hashes condition="contains">IMPHASH=07A2D4DCBD6CB2C6A45E6B101F0B6D51</Hashes> <!-- NanoDump -->
 			<Hashes condition="contains">IMPHASH=D6D0F80386E1380D05CB78E871BC72B1</Hashes> <!-- NanoDump -->
-			<Hashes condition="contains">IMPHASH=F34D5F2D4577ED6D9CEEC516C1F5A744</Hashes> <!-- NanoDump -->
 			<Hashes condition="contains">IMPHASH=38D9E015591BBFD4929E0D0F47FA0055</Hashes> <!-- HandleKatz -->
 			<Hashes condition="contains">IMPHASH=0E2216679CA6E1094D63322E3412D650</Hashes> <!-- HandleKatz -->
 			<Hashes condition="contains">IMPHASH=ADA161BF41B8E5E9132858CB54CAB5FB</Hashes> <!-- DripLoader -->

From b709916fbdb06547ebdc381e457188721be73eeb Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Wed, 17 Aug 2022 15:06:27 +0200
Subject: [PATCH 072/149] end with extensions

---
 sysmonconfig-export-block.xml | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 4c798992..6ff863e1 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -1405,6 +1405,7 @@
 			<Hashes condition="contains">IMPHASH=3DE09703C8E79ED2CA3F01074719906B</Hashes> <!-- UACMe Akagi -->
 			<Hashes condition="contains">IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F</Hashes> <!-- WCE -->
 			<Hashes condition="contains">IMPHASH=E96A73C7BF33A464C510EDE582318BF2</Hashes> <!-- WCE -->
+
 			<!-- Microsoft Office Programs Dropping Suspicious Files -->
 			<RuleGroup name="OfficeDrop" groupRelation="and">
 			<!-- Typical Office Programs -->
@@ -1419,10 +1420,20 @@
 					<Image condition="image">wordpad.exe</Image>
 					<Image condition="image">wordview.exe</Image>
 				</RuleGroup>
-			<!-- Suspicious Extensions -->
-			<TargetFilename condition="contains any">.exe;.dll;.bat;.ps1;.vbs;.vbe;.hta</TargetFilename>
+				<!-- Suspicious Extensions -->
+				<RuleGroup name="SuspiciousExtensions" groupRelation="or">
+					<TargetFilename condition="end with">.exe</TargetFilename>
+					<TargetFilename condition="end with">.dll</TargetFilename>
+					<TargetFilename condition="end with">.bat</TargetFilename>
+					<TargetFilename condition="end with">.ps1</TargetFilename>
+					<TargetFilename condition="end with">.vbs</TargetFilename>
+					<TargetFilename condition="end with">.vbe</TargetFilename>
+					<TargetFilename condition="end with">.hta</TargetFilename>
+				</RuleGroup>
 			</RuleGroup>
+
 		</FileBlockExecutable>
+
 	</RuleGroup>
 	</EventFiltering>
 </Sysmon>

From 36e2821968f371ef8483ecfb5c54e2039d1fbb8d Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Wed, 17 Aug 2022 14:07:10 +0100
Subject: [PATCH 073/149] Update sysmonconfig-trace.xml

---
 sysmonconfig-trace.xml | 93 +++++++++++++++++++++++++++---------------
 1 file changed, 61 insertions(+), 32 deletions(-)

diff --git a/sysmonconfig-trace.xml b/sysmonconfig-trace.xml
index 187a2b6e..623f5b9a 100644
--- a/sysmonconfig-trace.xml
+++ b/sysmonconfig-trace.xml
@@ -19,6 +19,7 @@
 			<!-- Event ID 1 == Process Creation. Log all newly created processes except -->
 			<ProcessCreate onmatch="exclude">
 				<Image condition="image">Sysmon.exe</Image>
+				<Image condition="image">Sysmon64.exe</Image>
 				<Image condition="contains">splunk</Image>
 				<Image condition="contains">btool.exe</Image>
 				<Image condition="contains">SnareCore</Image>
@@ -45,15 +46,16 @@
 			<!-- Event ID 3 == Network Connection. Log all initiated network connection except -->
 			<NetworkConnect onmatch="exclude">
 				<Image condition="is">C:\Program Files\Microsoft Office\Office15\ONENOTE.EXE</Image>
-				<Image condition="end with">Spotify.exe</Image>
-				<Image condition="end with">OneDrive.exe</Image>
-				<Image condition="end with">AppData\Roaming\Dashlane\Dashlane.exe</Image>
-				<Image condition="end with">AppData\Roaming\Dashlane\DashlanePlugin.exe</Image>
-				<Image condition="end with">winlogbeat.exe</Image>
-				<Image condition="end with">ec2config.exe</Image>
-				<Image condition="end with">cfn-signal.exe</Image>
-				<Image condition="end with">amazon-ssm-agent.exe</Image>
-				<Image condition="end with">ec2wallpaperinfo.exe</Image>
+				<Image condition="end with">\Spotify.exe</Image>
+				<Image condition="end with">\OneDrive.exe</Image>
+				<Image condition="end with">\AppData\Roaming\Dashlane\Dashlane.exe</Image>
+				<Image condition="end with">\AppData\Roaming\Dashlane\DashlanePlugin.exe</Image>
+				<Image condition="end with">\winlogbeat.exe</Image>
+				<Image condition="end with">\ec2config.exe</Image>
+				<Image condition="end with">\cfn-signal.exe</Image>
+				<Image condition="end with">\amazon-ssm-agent.exe</Image>
+				<Image condition="end with">\ec2wallpaperinfo.exe</Image>
+				<Image condition="end with">\Ninite.exe</Image>
 				<Image condition="is">C:\Windows\System32\spoolsv.exe</Image>
 				<Image condition="is">C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe</Image>
 				<Image condition="is">C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe</Image>
@@ -82,6 +84,7 @@
 			<DriverLoad onmatch="exclude">
 				<Signature condition="contains">microsoft</Signature>
 				<Signature condition="contains">windows</Signature>
+				<Signature condition="contains">symantec</Signature>
 				<Signature condition="is">VMware</Signature>
 				<Signature condition="begin with">Intel </Signature>
 			</DriverLoad>
@@ -92,18 +95,20 @@
 				<Image condition="image">chrome.exe</Image>
 				<Image condition="image">vmtoolsd.exe</Image>
 				<Image condition="image">Sysmon.exe</Image>
+				<Image condition="image">Sysmon64.exe</Image>
 				<Image condition="image">mmc.exe</Image>
-				<Image condition="is">C:\Program Files (x86)\Google\Update\GoogleUpdate.exe</Image>
+				<Image condition="end with">\Google\Update\GoogleUpdate.exe</Image>
 				<Image condition="is">C:\Windows\System32\taskeng.exe</Image>
 				<Image condition="is">C:\Program Files\VMware\VMware Tools\TPAutoConnect.exe</Image>
 				<Image condition="is">C:\Program Files\Windows Defender\NisSrv.exe</Image>
 				<Image condition="is">C:\Program Files\Windows Defender\MsMpEng.exe</Image>
-				<Image condition="end with">onedrivesetup.exe</Image>
-				<Image condition="end with">onedrive.exe</Image>
-				<Image condition="end with">skypeapp.exe</Image>
+				<Image condition="end with">\onedrivesetup.exe</Image>
+				<Image condition="end with">\onedrive.exe</Image>
+				<Image condition="end with">\skypeapp.exe</Image>
 				<Image condition="begin with">C:\Packages\Plugins\</Image> <!--Azure ARM Extensions -->
 				<Image condition="begin with">C:\WindowsAzure\</Image> <!--Azure -->
 				<ImageLoaded condition="begin with">C:\Program Files\Microsoft Monitoring Agent\</ImageLoaded> <!--Azure Microsoft Monitoring Aget-->
+				<Image condition="end with">\CompatTelRunner.exe</Image>
 			</ImageLoad>
 		</RuleGroup>
 		<RuleGroup name="" groupRelation="or">
@@ -114,8 +119,11 @@
 			<!-- Event ID 9 == RawAccessRead. Log everything except -->
 			<RawAccessRead onmatch="exclude">
 				<Image condition="image">Sysmon.exe</Image>
+				<Image condition="image">Sysmon64.exe</Image>
 				<Image condition="is">C:\Program Files\VMware\VMware Tools\vmtoolsd.exe</Image>
-				<Image condition="is">C:\Program Files (x86)\Google\Update\GoogleUpdate.exe</Image>
+				<Image condition="end with">\Google\Update\GoogleUpdate.exe</Image>
+				<Image condition="is">C:\Program Files\Windows Defender\MsMpEng.exe</Image>
+				<Image condition="is">C:\Windows\System32\svchost.exe</Image>
 			</RawAccessRead>
 		</RuleGroup>
 		<RuleGroup name="" groupRelation="or">
@@ -124,16 +132,21 @@
 				<SourceImage condition="is">C:\WINDOWS\System32\VBoxService.exe</SourceImage>
 				<SourceImage condition="is">C:\Program Files\VMware\VMware Tools\vmtoolsd.exe</SourceImage>
 				<SourceImage condition="image">Sysmon.exe</SourceImage>
+				<SourceImage condition="image">Sysmon64.exe</SourceImage>
 				<SourceImage condition="image">GoogleUpdate.exe</SourceImage>
 				<SourceImage condition="image">aurora-agent-64.exe</SourceImage>
-				<SourceImage condition="is">C:\Program Files (x86)\Google\Chrome\Application\chrome.exe</SourceImage>
+				<SourceImage condition="end with">\Google\Chrome\Application\chrome.exe</SourceImage>
 				<SourceImage condition="is">C:\Program Files\Windows Defender\MsMpEng.exe</SourceImage>
-				<SourceImage condition="is">C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1907.4-0\MsMpEng.exe</SourceImage>
+				<Rule name="MsMpEngVersion" groupRelation="and">
+					<SourceImage condition="begin with">C:\ProgramData\Microsoft\Windows Defender\platform\</SourceImage>
+					<SourceImage condition="end with">\MsMpEng.exe</TargetImage>
+				</Rule>
 				<SourceImage condition="is">C:\Program Files\Microsoft VS Code\Code.exe</SourceImage>
 				<SourceImage condition="is">C:\WindowsAzure\Packages\CollectGuestLogs.exe</SourceImage>
 				<SourceImage condition="is">C:\Program Files\Microsoft Monitoring Agent\Agent\HealthService.exe</SourceImage>
 				<SourceImage condition="is">C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe</SourceImage>
 				<TargetImage condition="image">Sysmon.exe</TargetImage>
+				<TargetImage condition="image">Sysmon64.exe</TargetImage>
 				<TargetImage condition="is">C:\Program Files\VMware\VMware Tools\TPAutoConnSvc.exe</TargetImage>
 				<TargetImage condition="is">C:\Program Files\VMware\VMware Tools\TPAutoConnect.exe</TargetImage>
 				<TargetImage condition="is">C:\Program Files\Microsoft VS Code\Code.exe</TargetImage>
@@ -147,16 +160,16 @@
 				<TargetImage condition="begin with">C:\Program Files\WindowsApps\</TargetImage>
 				<TargetImage condition="begin with">C:\Program Files\Windows Defender Advanced Threat Protection\</TargetImage>
 				<SourceImage condition="begin with">C:\Program Files\Windows Defender Advanced Threat Protection\</SourceImage>
+				<SourceImage condition="begin with">C:\ProgramData\Microsoft\Windows Defender\platform\</SourceImage>
 				<TargetImage condition="begin with">C:\Windows\SystemApps\InputApp</TargetImage>
 				<SourceImage condition="begin with">C:\Program Files\Azure Advanced Threat Protection Sensor\</SourceImage> <!-- Microsoft Defender for Identity Sensor -->
-				<SourceImage condition="end with">Microsoft.Tri.Sensor.Updater.exe</SourceImage> <!-- Microsoft Defender for Identity Sensor -->
-				<SourceImage condition="end with">onedrivesetup.exe</SourceImage>
-				<TargetImage condition="end with">StartMenuExperienceHost.exe</TargetImage>
-				<TargetImage condition="end with">ShellExperienceHost.exe</TargetImage>
-				<TargetImage condition="end with">mmc.exe</TargetImage>
-				<TargetImage condition="end with">Microsoft.Tri.Sensor.exe</TargetImage> <!-- Microsoft Defender for Identity Sensor -->
-				<TargetImage condition="end with">Microsoft.Tri.Sensor.Updater.exe</TargetImage> <!-- Microsoft Defender for Identity Sensor -->
-				<SourceImage condition="begin with">C:\ProgramData\Microsoft\Windows Defender\platform\</SourceImage>
+				<SourceImage condition="end with">\Microsoft.Tri.Sensor.Updater.exe</SourceImage> <!-- Microsoft Defender for Identity Sensor -->
+				<SourceImage condition="end with">\onedrivesetup.exe</SourceImage>
+				<TargetImage condition="end with">\StartMenuExperienceHost.exe</TargetImage>
+				<TargetImage condition="end with">\ShellExperienceHost.exe</TargetImage>
+				<TargetImage condition="end with">\mmc.exe</TargetImage>
+				<TargetImage condition="end with">\Microsoft.Tri.Sensor.exe</TargetImage> <!-- Microsoft Defender for Identity Sensor -->
+				<TargetImage condition="end with">\Microsoft.Tri.Sensor.Updater.exe</TargetImage> <!-- Microsoft Defender for Identity Sensor -->
 				<Rule name="RuntimeBroker" groupRelation="and">
 					<SourceImage condition="is">C:\Windows\System32\RuntimeBroker.exe</SourceImage>
 					<TargetImage condition="is">C:\windows\Explorer.EXE</TargetImage>
@@ -166,6 +179,11 @@
 					<TargetImage condition="end with">\svchost.exe</TargetImage>
 				</Rule>
 				<TargetImage condition="contains">Microsoft.Windows.Cortana</TargetImage>
+				<TargetImage condition="end with">\MsMpEng.exe</TargetImage>
+				<TargetImage condition="is">C:\Windows\System32\VBoxService.exe</TargetImage>
+				<SourceImage condition="end with">\Ninite.exe</SourceImage>
+				<TargetImage condition="end with">\Ninite.exe</TargetImage>
+				<GrantedAccess condition="is">0x1000</GrantedAccess>
 			</ProcessAccess>
 		</RuleGroup>
 		<RuleGroup name="" groupRelation="or">
@@ -183,6 +201,8 @@
 				<Image condition="begin with">C:\Windows\SystemApps\Microsoft.Windows.Cortana</Image>
 				<Image condition="begin with">C:\Program Files\Microsoft Azure AD Sync\</Image> <!--Azure AD Connect Agent -->
 				<Image condition="begin with">C:\Program Files\Microsoft Azure AD Connect Health Sync Agent\</Image> <!--Azure AD Connect Agent -->
+				<Image condition="end with">\TiWorker.exe</Image>
+				<Image condition="end with">\Ninite.exe</Image>
 				<TargetFilename condition="begin with">C:\Windows\System32\winevt\Logs\</TargetFilename>
 			</FileCreate>
 		</RuleGroup>
@@ -201,15 +221,18 @@
 				<Image condition="begin with">C:\Program Files\Azure Advanced Threat Protection Sensor\</Image> <!-- Microsoft Defender for Identity Sensor -->
 				<Image condition="begin with">C:\Windows\SystemApps\Microsoft.Windows.Cortana</Image>
 				<Image condition="begin with">C:\WindowsAzure\</Image>
-				<Image condition="end with">onedrivesetup.exe</Image>
-				<Image condition="end with">onedrive.exe</Image>
-				<Image condition="end with">skypeapp.exe</Image>
-				<Image condition="end with">Sysmon64.exe</Image>
-				<Image condition="end with">Microsoft.Tri.Sensor.exe</Image> <!-- Microsoft Defender for Identity Sensor -->
-				<Image condition="end with">Microsoft.Tri.Sensor.Updater.exe</Image> <!-- Microsoft Defender for Identity Sensor -->
+				<Image condition="end with">\onedrivesetup.exe</Image>
+				<Image condition="end with">\onedrive.exe</Image>
+				<Image condition="end with">\skypeapp.exe</Image>
+				<Image condition="end with">\Sysmon64.exe</Image>
+				<Image condition="end with">\Microsoft.Tri.Sensor.exe</Image> <!-- Microsoft Defender for Identity Sensor -->
+				<Image condition="end with">\Microsoft.Tri.Sensor.Updater.exe</Image> <!-- Microsoft Defender for Identity Sensor -->
+				<Image condition="end with">\TiWorker.exe</Image>
+				<Image condition="is">C:\Windows\system32\compattelrunner.exe</Image>
+				<Image condition="is">C:\Windows\Sysmon64.exe</Image>
 				<TargetObject condition="is">\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\Microsoft Print to PDF\PrinterDriverData</TargetObject>
-				<TargetObject condition="end with">LanguageList</TargetObject>
-				<TargetObject condition="end with">Windows.UI.SettingsAppThreshold.pri</TargetObject>
+				<TargetObject condition="end with">\LanguageList</TargetObject>
+				<TargetObject condition="end with">\Windows.UI.SettingsAppThreshold.pri</TargetObject>
 				<TargetObject condition="end with">\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications</TargetObject>
 				<TargetObject condition="end with">\Software\Microsoft\Input\Settings\Insights</TargetObject>
 				<TargetObject condition="end with">\Schemas\StateSchema</TargetObject>
@@ -228,6 +251,11 @@
 				<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppReadiness\</TargetObject>
 				<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package</TargetObject> <!--Windows app package-->
 				<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason</TargetObject>
+				<Rule groupRelation="and">
+					<Image condition="is">C:\Windows\system32\svchost.exe</Image>
+					<TargetObject condition="contains">\DRIVERS\DriverDatabase\</TargetObject>
+				</Rule>
+				<TargetObject condition="contains">\Microsoft\SystemCertificates\</TargetObject>
 			</RegistryEvent>
 		</RuleGroup>
 		<RuleGroup name="" groupRelation="or">
@@ -276,6 +304,7 @@
 			<FileDeleteDetected onmatch="exclude">
 				<Image condition="begin with">C:\WindowsAzure\</Image> <!--Azure -->
 				<Image condition="begin with">C:\Packages\Plugins\</Image> <!--Azure ARM Extensions -->
+				<Image condition="end with">\TiWorker.exe</Image>
 			</FileDeleteDetected>
 		</RuleGroup>
   </EventFiltering>

From 79c75dc41e9ac67208bee5faea28426d5dec7c8f Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Wed, 17 Aug 2022 15:07:12 +0200
Subject: [PATCH 074/149] docs: readme

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index b00970cc..61564cea 100644
--- a/README.md
+++ b/README.md
@@ -22,7 +22,7 @@ It started as a is simply copy of the original repository. We merged most of the
 This repo includes the original and two additional configurations
 
 - `sysmonconfig-export.xml` the original config provided by @SwiftOnSecurity
-- `sysmonconfig-export-block.xml` the original config provided by @SwiftOnSecurity with some basic blocking rules (careful!)
+- `sysmonconfig-export-block.xml` the original config provided by @SwiftOnSecurity with some basic blocking rules usable since Sysmon v14 (WARNING: use it with care!)
 - `sysmonconfig-trace.xml` a config by @Cyb3rWard0g that logs just everything with a few examples for debugging or threat research purposes
 
 ## Testing

From aaeae9409f1dadb1384366b5e5b1aa9fd8475940 Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Wed, 17 Aug 2022 14:13:06 +0100
Subject: [PATCH 075/149] Update sysmonconfig-export.xml

---
 sysmonconfig-export.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index aa15f0ec..17b21507 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -258,7 +258,7 @@
 			<Image condition="contains">setup</Image> <!--Ignore setups-->
 			<Image condition="contains">install</Image> <!--Ignore setups-->
 			<Image condition="contains">Update\</Image> <!--Ignore setups-->
-			<Image condition="end with">redist.exe</Image> <!--Ignore setups-->
+			<Image condition="end with">\redist.exe</Image> <!--Ignore setups-->
 			<Image condition="is">msiexec.exe</Image> <!--Ignore setups-->
 			<Image condition="is">TrustedInstaller.exe</Image> <!--Ignore setups-->
 			<TargetFilename condition="contains">\NVIDIA\NvBackend\ApplicationOntology\</TargetFilename> <!--NVIDIA GeForce Experience Application Ontology, 1000's of events in user profile-->
@@ -502,7 +502,7 @@
 			</Rule>
 			<!-- lsass.exe access with critical permission -->
 			<Rule groupRelation="and">
-				<TargetImage condition="end with">lsass.exe</TargetImage>
+				<TargetImage condition="end with">\lsass.exe</TargetImage>
 				<GrantedAccess condition="contains any">0x40;0x1000;0x1010;0x1038;0x1410;0x1418;0x1438;0x143a;0x100000;0x1f0fff;0x1f1fff;0x1f2fff;0x1f3fff;0x1fffff</GrantedAccess> <!--0x1400 too noisy-->
 			</Rule>
 			<!-- LittleCorporal generated MalDoc Ref: https://github.com/connormcgarr/LittleCorporal -->

From 3e13b8babc202d29ba4636b27261f0678fce1483 Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Wed, 17 Aug 2022 14:13:39 +0100
Subject: [PATCH 076/149] Update sysmonconfig-export-block.xml

---
 sysmonconfig-export-block.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 4c798992..50d883f7 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -210,7 +210,7 @@
 			<Image condition="contains">setup</Image> <!--Ignore setups-->
 			<Image condition="contains">install</Image> <!--Ignore setups-->
 			<Image condition="contains">Update\</Image> <!--Ignore setups-->
-			<Image condition="end with">redist.exe</Image> <!--Ignore setups-->
+			<Image condition="end with">\redist.exe</Image> <!--Ignore setups-->
 			<Image condition="is">msiexec.exe</Image> <!--Ignore setups-->
 			<Image condition="is">TrustedInstaller.exe</Image> <!--Ignore setups-->
 			<TargetFilename condition="contains">\NVIDIA\NvBackend\ApplicationOntology\</TargetFilename> <!--NVIDIA GeForce Experience Application Ontology, 1000's of events in user profile-->
@@ -454,7 +454,7 @@
 			</Rule>
 			<!-- lsass.exe access with critical permission -->
 			<Rule groupRelation="and">
-				<TargetImage condition="end with">lsass.exe</TargetImage>
+				<TargetImage condition="end with">\lsass.exe</TargetImage>
 				<GrantedAccess condition="contains any">0x40;0x1000;0x1010;0x1038;0x1410;0x1418;0x1438;0x143a;0x100000;0x1f0fff;0x1f1fff;0x1f2fff;0x1f3fff;0x1fffff</GrantedAccess> <!--0x1400 too noisy-->
 			</Rule>
 			<!-- LittleCorporal generated MalDoc Ref: https://github.com/connormcgarr/LittleCorporal -->

From 6f49ce00726c8d45d809d1879f27fb2fe69fb8f1 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Wed, 17 Aug 2022 15:43:17 +0200
Subject: [PATCH 077/149] updates on block list

---
 sysmonconfig-export-block.xml | 76 +++++++++++++++++++----------------
 1 file changed, 42 insertions(+), 34 deletions(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 6ff863e1..ae6c651c 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -1319,12 +1319,37 @@
 
 	<RuleGroup name="ImageBlock" groupRelation="or">
 		<FileBlockExecutable onmatch="include">
-			<!-- Suspicious Extensions in Public Folder -->
-			<TargetFilename condition="contains all">C:\Users\Public;.exe</TargetFilename>
-			<TargetFilename condition="contains all">C:\Users\Public;.ps1</TargetFilename>
-			<TargetFilename condition="contains all">C:\Users\Public;.vbs</TargetFilename>
-			<TargetFilename condition="contains all">C:\Users\Public;.bat</TargetFilename>
-			<TargetFilename condition="contains all">C:\Users\Public;.vbe</TargetFilename>
+			<!-- Executables dropped to suspicious folders -->
+			<TargetFilename condition="begin with">C:\Users\Public\</TargetFilename> <!-- often used staging directories; could cause false positives --> 
+			<TargetFilename condition="begin with">C:\Perflogs\</TargetFilename> <!-- often used staging directories --> 
+			<TargetFilename condition="begin with">C:\Windows\Fonts\</TargetFilename> <!-- often used staging directories --> 
+			<TargetFilename condition="begin with">C:\Windows\debug\</TargetFilename> <!-- often used staging directories --> 
+			<TargetFilename condition="begin with">C:\Windows\Tasks\</TargetFilename> <!-- often used staging directories --> 
+			<TargetFilename condition="begin with">C:\Windows\tracing\</TargetFilename> <!-- often used staging directories --> 
+			<TargetFilename condition="begin with">C:\Windows\Help\</TargetFilename> <!-- often used staging directories --> 
+			<TargetFilename condition="begin with">C:\Windows\Logs\</TargetFilename> <!-- often used staging directories --> 
+			<TargetFilename condition="begin with">C:\Windows\System32\spool\SERVERS\</TargetFilename> <!-- often used in exploits against print spooler --> 
+			<TargetFilename condition="begin with">C:\Windows\System32\spool\PRINTERS\</TargetFilename> <!-- often used in exploits against print spooler --> 
+			<TargetFilename condition="begin with">C:\Windows\Help\</TargetFilename> <!-- often used staging directories --> 
+			<TargetFilename condition="contains all">C:\Users\;\Music\</TargetFilename> <!-- often used staging directories in User folders --> 
+			<TargetFilename condition="contains all">C:\Users\;\Pictures\</TargetFilename> <!-- often used staging directories in User folders --> 
+			<TargetFilename condition="contains all">C:\Users\;\Videos\</TargetFilename> <!-- often used staging directories in User folders --> 
+			<TargetFilename condition="contains all">C:\Users\;\Contacts\</TargetFilename> <!-- often used staging directories in User folders --> 
+			<!-- Executables double extensions -->
+			<TargetFilename condition="end with">.pdf.exe</TargetFilename>
+			<TargetFilename condition="end with">.doc.exe</TargetFilename>
+			<TargetFilename condition="end with">.docx.exe</TargetFilename>
+			<TargetFilename condition="end with">.xls.exe</TargetFilename>
+			<TargetFilename condition="end with">.xlsx.exe</TargetFilename>
+			<TargetFilename condition="end with">.xlsm.exe</TargetFilename>
+			<TargetFilename condition="end with">.docm.exe</TargetFilename>
+			<TargetFilename condition="end with">.ppt.exe</TargetFilename>
+			<TargetFilename condition="end with">.pptx.exe</TargetFilename>
+			<TargetFilename condition="end with">.txt.exe</TargetFilename>
+			<TargetFilename condition="end with">.rtf.exe</TargetFilename>
+			<TargetFilename condition="end with">.htm.exe</TargetFilename>
+			<TargetFilename condition="end with">.html.exe</TargetFilename>
+			<TargetFilename condition="end with">.iso.exe</TargetFilename>
 			<!-- Hacktool Blocks based on Imphashes -->
 			<Hashes condition="contains">IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932</Hashes> <!-- PetitPotam -->
 			<Hashes condition="contains">IMPHASH=3A19059BD7688CB88E70005F18EFC439</Hashes> <!-- PetitPotam -->
@@ -1405,35 +1430,18 @@
 			<Hashes condition="contains">IMPHASH=3DE09703C8E79ED2CA3F01074719906B</Hashes> <!-- UACMe Akagi -->
 			<Hashes condition="contains">IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F</Hashes> <!-- WCE -->
 			<Hashes condition="contains">IMPHASH=E96A73C7BF33A464C510EDE582318BF2</Hashes> <!-- WCE -->
-
-			<!-- Microsoft Office Programs Dropping Suspicious Files -->
-			<RuleGroup name="OfficeDrop" groupRelation="and">
-			<!-- Typical Office Programs -->
-				<RuleGroup name="OfficeApps" groupRelation="or">
-					<Image condition="image">winword.exe</Image>
-					<Image condition="image">excel.exe</Image>
-					<Image condition="image">powerpnt.exe</Image>
-					<Image condition="image">msaccess.exe</Image>
-					<Image condition="image">mspub.exe</Image>
-					<Image condition="image">eqnedt32.exe</Image>
-					<Image condition="image">visio.exe</Image>
-					<Image condition="image">wordpad.exe</Image>
-					<Image condition="image">wordview.exe</Image>
-				</RuleGroup>
-				<!-- Suspicious Extensions -->
-				<RuleGroup name="SuspiciousExtensions" groupRelation="or">
-					<TargetFilename condition="end with">.exe</TargetFilename>
-					<TargetFilename condition="end with">.dll</TargetFilename>
-					<TargetFilename condition="end with">.bat</TargetFilename>
-					<TargetFilename condition="end with">.ps1</TargetFilename>
-					<TargetFilename condition="end with">.vbs</TargetFilename>
-					<TargetFilename condition="end with">.vbe</TargetFilename>
-					<TargetFilename condition="end with">.hta</TargetFilename>
-				</RuleGroup>
-			</RuleGroup>
-
+			<!-- Microsoft Office Programs Dropping Executables -->
+			<Image condition="image">winword.exe</Image>
+			<Image condition="image">excel.exe</Image>
+			<Image condition="image">powerpnt.exe</Image>
+			<Image condition="image">msaccess.exe</Image>
+			<Image condition="image">mspub.exe</Image>
+			<Image condition="image">eqnedt32.exe</Image>
+			<Image condition="image">visio.exe</Image>
+			<Image condition="image">wordpad.exe</Image>
+			<Image condition="image">wordview.exe</Image>
 		</FileBlockExecutable>
-
 	</RuleGroup>
+
 	</EventFiltering>
 </Sysmon>

From f9aa1ab6feee5996b01c97397167f024666f6c08 Mon Sep 17 00:00:00 2001
From: phantinuss <79651203+phantinuss@users.noreply.github.com>
Date: Wed, 17 Aug 2022 14:55:27 +0200
Subject: [PATCH 078/149] chore: add tests for trace and block config

---
 .github/workflows/main.yml | 67 ++++++++++++++++++++++++++++----------
 1 file changed, 50 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 5150c13f..ba6ce5da 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -10,52 +10,85 @@ on:
     branches:
     - master
   workflow_dispatch:
-  
 jobs:
-  msbuild:
+  msbuild-default:
     runs-on: 'windows-latest'
     steps:
     - name: Checkout open-sysmon-conf
       uses: actions/checkout@v2
-    
-    - name: Download Sysmon 
+
+    - name: Download Sysmon
       run: Invoke-WebRequest http://live.sysinternals.com/tools/sysmon.exe -OutFile .\sysmon.exe
       shell: powershell
-    
-    - name: Run Sysmon 
+
+    - name: Run Sysmon
       run: .\sysmon.exe -accepteula -i sysmonconfig-export.xml
       shell: powershell
-      
+
     - name: Check Eventcount
       run:  '$EventCount = 0 ;Get-WinEvent -ListLog Microsoft-Windows-Sysmon* | where {$_.RecordCount -gt 0} | foreach{$_;$EventCount = $EventCount + $_.RecordCount}|Out-Null;"Eventcount: "+$EventCount; if ($EventCount -gt 100){ Write-Output "Too many events"; $host.SetShouldExit(1)}'
       shell: powershell
-      
+  msbuild-trace:
+    runs-on: 'windows-latest'
+    steps:
+    - name: Checkout open-sysmon-conf
+      uses: actions/checkout@v2
+
+    - name: Download Sysmon
+      run: Invoke-WebRequest http://live.sysinternals.com/tools/sysmon.exe -OutFile .\sysmon.exe
+      shell: powershell
+
+    - name: Run Sysmon
+      run: .\sysmon.exe -accepteula -i sysmonconfig-trace.xml
+      shell: powershell
+
+    - name: Check Eventcount
+      run:  '$EventCount = 0 ;Get-WinEvent -ListLog Microsoft-Windows-Sysmon* | where {$_.RecordCount -gt 0} | foreach{$_;$EventCount = $EventCount + $_.RecordCount}|Out-Null;"Eventcount: "+$EventCount; if ($EventCount -gt 100){ Write-Output "Too many events"; $host.SetShouldExit(1)}'
+      shell: powershell
+  msbuild-block:
+    runs-on: 'windows-latest'
+    steps:
+    - name: Checkout open-sysmon-conf
+      uses: actions/checkout@v2
+
+    - name: Download Sysmon
+      run: Invoke-WebRequest http://live.sysinternals.com/tools/sysmon.exe -OutFile .\sysmon.exe
+      shell: powershell
+
+    - name: Run Sysmon
+      run: .\sysmon.exe -accepteula -i sysmonconfig-export-block.xml
+      shell: powershell
+
+    - name: Check Eventcount
+      run:  '$EventCount = 0 ;Get-WinEvent -ListLog Microsoft-Windows-Sysmon* | where {$_.RecordCount -gt 0} | foreach{$_;$EventCount = $EventCount + $_.RecordCount}|Out-Null;"Eventcount: "+$EventCount; if ($EventCount -gt 100){ Write-Output "Too many events"; $host.SetShouldExit(1)}'
+      shell: powershell
+
   busySystem:
     runs-on: 'windows-latest'
     steps:
     - name: Checkout open-sysmon-conf
       uses: actions/checkout@v2
-    
-    - name: Download Sysmon 
+
+    - name: Download Sysmon
       run: Invoke-WebRequest http://live.sysinternals.com/tools/sysmon.exe -OutFile .\sysmon.exe
       shell: powershell
-      
-    - name: Run Sysmon 
+
+    - name: Run Sysmon
       run: .\sysmon.exe -accepteula -i sysmonconfig-export.xml
       shell: powershell
-      
+
     - name: Print Eventcount
       run: Get-WinEvent -ListLog Microsoft-Windows-Sysmon*
-      
+
     - name: Install some Choco Packages
       run: choco install ninja adobereader googlechrome firefox python3
-      
+
     - name: Download User Sim
       run: Invoke-WebRequest https://github.com/humpalum/sim-user/releases/download/latest/5minuser.exe  -OutFile .\5minuser.exe
-      
+
     - name: Run User Sim
       run: .\5minuser.exe
-    
+
     - name: Check Eventcount
       run:  '$EventCount = 0 ;Get-WinEvent -ListLog Microsoft-Windows-Sysmon* | where {$_.RecordCount -gt 0} | foreach{$_;$EventCount = $EventCount + $_.RecordCount}|Out-Null;"Eventcount: "+$EventCount; if ($EventCount -gt 10000){ Write-Output "Too many events"; $host.SetShouldExit(1)}'
       shell: powershell

From 051230bebcd197dc3f23c18c2121c84a4484b91b Mon Sep 17 00:00:00 2001
From: phantinuss <79651203+phantinuss@users.noreply.github.com>
Date: Wed, 17 Aug 2022 15:53:15 +0200
Subject: [PATCH 079/149] chore: increase event count for trace logs

---
 .github/workflows/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index ba6ce5da..3b7184bd 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -43,7 +43,7 @@ jobs:
       shell: powershell
 
     - name: Check Eventcount
-      run:  '$EventCount = 0 ;Get-WinEvent -ListLog Microsoft-Windows-Sysmon* | where {$_.RecordCount -gt 0} | foreach{$_;$EventCount = $EventCount + $_.RecordCount}|Out-Null;"Eventcount: "+$EventCount; if ($EventCount -gt 100){ Write-Output "Too many events"; $host.SetShouldExit(1)}'
+      run:  '$EventCount = 0 ;Get-WinEvent -ListLog Microsoft-Windows-Sysmon* | where {$_.RecordCount -gt 0} | foreach{$_;$EventCount = $EventCount + $_.RecordCount}|Out-Null;"Eventcount: "+$EventCount; if ($EventCount -gt 2000){ Write-Output "Too many events"; $host.SetShouldExit(1)}'
       shell: powershell
   msbuild-block:
     runs-on: 'windows-latest'

From ccb7fc15eb47f09f80fbc399af91eae51a000668 Mon Sep 17 00:00:00 2001
From: phantinuss <79651203+phantinuss@users.noreply.github.com>
Date: Thu, 18 Aug 2022 10:29:55 +0200
Subject: [PATCH 080/149] chore: spacing

---
 .github/workflows/main.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 3b7184bd..6033ccd8 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -11,6 +11,7 @@ on:
     - master
   workflow_dispatch:
 jobs:
+
   msbuild-default:
     runs-on: 'windows-latest'
     steps:
@@ -28,6 +29,7 @@ jobs:
     - name: Check Eventcount
       run:  '$EventCount = 0 ;Get-WinEvent -ListLog Microsoft-Windows-Sysmon* | where {$_.RecordCount -gt 0} | foreach{$_;$EventCount = $EventCount + $_.RecordCount}|Out-Null;"Eventcount: "+$EventCount; if ($EventCount -gt 100){ Write-Output "Too many events"; $host.SetShouldExit(1)}'
       shell: powershell
+
   msbuild-trace:
     runs-on: 'windows-latest'
     steps:
@@ -45,6 +47,7 @@ jobs:
     - name: Check Eventcount
       run:  '$EventCount = 0 ;Get-WinEvent -ListLog Microsoft-Windows-Sysmon* | where {$_.RecordCount -gt 0} | foreach{$_;$EventCount = $EventCount + $_.RecordCount}|Out-Null;"Eventcount: "+$EventCount; if ($EventCount -gt 2000){ Write-Output "Too many events"; $host.SetShouldExit(1)}'
       shell: powershell
+
   msbuild-block:
     runs-on: 'windows-latest'
     steps:

From 4a8d6895d28c7337cb3a97809caddcd316d1b535 Mon Sep 17 00:00:00 2001
From: phantinuss <79651203+phantinuss@users.noreply.github.com>
Date: Thu, 18 Aug 2022 10:40:53 +0200
Subject: [PATCH 081/149] chore: rename msbuild-default back to msbuild

---
 .github/workflows/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 6033ccd8..cf31f6ad 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -12,7 +12,7 @@ on:
   workflow_dispatch:
 jobs:
 
-  msbuild-default:
+  msbuild:
     runs-on: 'windows-latest'
     steps:
     - name: Checkout open-sysmon-conf

From 01d2ab35bc729b7c22deb2ab19c8cad28bc30f00 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Thu, 18 Aug 2022 13:06:01 +0200
Subject: [PATCH 082/149] feat: adding certutil.exe to the blocklist

---
 sysmonconfig-export-block.xml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index ae6c651c..30552da9 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -1440,6 +1440,8 @@
 			<Image condition="image">visio.exe</Image>
 			<Image condition="image">wordpad.exe</Image>
 			<Image condition="image">wordview.exe</Image>
+			<!-- LOLBINs that can be used to download executables -->
+			<Image condition="image">certutil.exe</Image>
 		</FileBlockExecutable>
 	</RuleGroup>
 

From ab94a0b7e0883c6aa6f660e4040b9591a83350a7 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Thu, 18 Aug 2022 13:19:27 +0200
Subject: [PATCH 083/149] more LOLBINS

---
 sysmonconfig-export-block.xml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 30552da9..b33ee1c8 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -1442,6 +1442,13 @@
 			<Image condition="image">wordview.exe</Image>
 			<!-- LOLBINs that can be used to download executables -->
 			<Image condition="image">certutil.exe</Image>
+			<Image condition="image">certoc.exe</Image>
+			<Image condition="image">CertReq.exe</Image>
+			<!-- <Image condition="image">bitsadmin.exe</Image> (depends on the environment; comment in if you're sure that bitsadmin doesn't do that in your env) -->
+			<Image condition="image">Desktopimgdownldr.exe</Image>
+			<Image condition="image">esentutl.exe</Image>
+			<Image condition="image">expand.exe</Image>
+			<Image condition="image">finger.exe</Image>
 		</FileBlockExecutable>
 	</RuleGroup>
 

From 63782a9a8b97aeb879c523e40fc09da71ec4ca02 Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Thu, 18 Aug 2022 12:39:13 +0100
Subject: [PATCH 084/149] Update sysmonconfig-export-block.xml

---
 sysmonconfig-export-block.xml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 44e5283f..374b6482 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -33,7 +33,6 @@
 			<!--SECTION: Microsoft Windows-->
 			<CommandLine condition="is">"C:\Windows\system32\cscript.exe" /nologo "MonitorKnowledgeDiscovery.vbs"</CommandLine>
 			<CommandLine condition="begin with"> "C:\Windows\system32\wermgr.exe" "-queuereporting_svc" </CommandLine> <!--Windows:Windows error reporting/telemetry-->
-			<CommandLine condition="begin with">C:\Windows\system32\DllHost.exe /Processid</CommandLine> <!--Windows-->
 			<CommandLine condition="begin with">C:\Windows\system32\wbem\wmiprvse.exe -Embedding</CommandLine> <!--Windows: WMI provider host-->
 			<CommandLine condition="begin with">C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding</CommandLine> <!--Windows: WMI provider host-->
 			<CommandLine condition="is">C:\Windows\system32\wermgr.exe -upload</CommandLine> <!--Windows:Windows error reporting/telemetry-->
@@ -398,6 +397,8 @@
 		<!--DATA: UtcTime, ProcessGuid, ProcessId, Image, ImageLoaded, Hashes, Signed, Signature, SignatureStatus-->
 	<RuleGroup name="" groupRelation="or">
 		<ImageLoad onmatch="include">
+			<ImageLoaded condition="begin with">C:\Users\Public\</ImageLoaded>
+			<ImageLoaded condition="begin with">C:\PerfLogs\</ImageLoaded>
 			<!--NOTE: Using "include" with no rules means nothing in this section will be logged-->
 		</ImageLoad>
 	</RuleGroup>
@@ -1322,6 +1323,7 @@
 			<!-- Executables dropped to suspicious folders -->
 			<TargetFilename condition="begin with">C:\Users\Public\</TargetFilename> <!-- often used staging directories; could cause false positives --> 
 			<TargetFilename condition="begin with">C:\Perflogs\</TargetFilename> <!-- often used staging directories --> 
+			<TargetFilename condition="begin with">C:\AppData\LocalLow\</TargetFilename> <!-- often used staging directories --> 
 			<TargetFilename condition="begin with">C:\Windows\Fonts\</TargetFilename> <!-- often used staging directories --> 
 			<TargetFilename condition="begin with">C:\Windows\debug\</TargetFilename> <!-- often used staging directories --> 
 			<TargetFilename condition="begin with">C:\Windows\Tasks\</TargetFilename> <!-- often used staging directories --> 
@@ -1350,6 +1352,9 @@
 			<TargetFilename condition="end with">.htm.exe</TargetFilename>
 			<TargetFilename condition="end with">.html.exe</TargetFilename>
 			<TargetFilename condition="end with">.iso.exe</TargetFilename>
+			<TargetFilename condition="end with">.zip.exe</TargetFilename>
+			<TargetFilename condition="end with">.rar.exe</TargetFilename>
+			<TargetFilename condition="end with">.7z.exe</TargetFilename>
 			<!-- Hacktool Blocks based on Imphashes -->
 			<Hashes condition="contains">IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932</Hashes> <!-- PetitPotam -->
 			<Hashes condition="contains">IMPHASH=3A19059BD7688CB88E70005F18EFC439</Hashes> <!-- PetitPotam -->

From eadb3785c984c724cb8f59ea58ec1c5971d6b6b2 Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Thu, 18 Aug 2022 12:48:22 +0100
Subject: [PATCH 085/149] Update sysmonconfig-trace.xml

---
 sysmonconfig-trace.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sysmonconfig-trace.xml b/sysmonconfig-trace.xml
index 623f5b9a..775d498d 100644
--- a/sysmonconfig-trace.xml
+++ b/sysmonconfig-trace.xml
@@ -139,7 +139,7 @@
 				<SourceImage condition="is">C:\Program Files\Windows Defender\MsMpEng.exe</SourceImage>
 				<Rule name="MsMpEngVersion" groupRelation="and">
 					<SourceImage condition="begin with">C:\ProgramData\Microsoft\Windows Defender\platform\</SourceImage>
-					<SourceImage condition="end with">\MsMpEng.exe</TargetImage>
+					<SourceImage condition="end with">\MsMpEng.exe</SourceImage>
 				</Rule>
 				<SourceImage condition="is">C:\Program Files\Microsoft VS Code\Code.exe</SourceImage>
 				<SourceImage condition="is">C:\WindowsAzure\Packages\CollectGuestLogs.exe</SourceImage>

From 8ce36b438494de274ac6b7986a33032536261468 Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Thu, 18 Aug 2022 13:04:15 +0100
Subject: [PATCH 086/149] Update sysmonconfig-export-block.xml

---
 sysmonconfig-export-block.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 026ae5b8..2fb961a5 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -1323,7 +1323,7 @@
 			<!-- Executables dropped to suspicious folders -->
 			<TargetFilename condition="begin with">C:\Users\Public\</TargetFilename> <!-- often used staging directories; could cause false positives --> 
 			<TargetFilename condition="begin with">C:\Perflogs\</TargetFilename> <!-- often used staging directories --> 
-			<TargetFilename condition="begin with">C:\AppData\LocalLow\</TargetFilename> <!-- often used staging directories --> 
+			<TargetFilename condition="begin with">C:\Users\;\AppData\LocalLow\</TargetFilename> <!-- often used staging directories --> 
 			<TargetFilename condition="begin with">C:\Windows\Fonts\</TargetFilename> <!-- often used staging directories --> 
 			<TargetFilename condition="begin with">C:\Windows\debug\</TargetFilename> <!-- often used staging directories --> 
 			<TargetFilename condition="begin with">C:\Windows\Tasks\</TargetFilename> <!-- often used staging directories --> 

From 45b23232b4bbbc2799d73d6ea33f9496d58eefc3 Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Thu, 18 Aug 2022 15:12:08 +0100
Subject: [PATCH 087/149] Update sysmonconfig-export-block.xml

---
 sysmonconfig-export-block.xml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 2fb961a5..6931d139 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -1323,7 +1323,6 @@
 			<!-- Executables dropped to suspicious folders -->
 			<TargetFilename condition="begin with">C:\Users\Public\</TargetFilename> <!-- often used staging directories; could cause false positives --> 
 			<TargetFilename condition="begin with">C:\Perflogs\</TargetFilename> <!-- often used staging directories --> 
-			<TargetFilename condition="begin with">C:\Users\;\AppData\LocalLow\</TargetFilename> <!-- often used staging directories --> 
 			<TargetFilename condition="begin with">C:\Windows\Fonts\</TargetFilename> <!-- often used staging directories --> 
 			<TargetFilename condition="begin with">C:\Windows\debug\</TargetFilename> <!-- often used staging directories --> 
 			<TargetFilename condition="begin with">C:\Windows\Tasks\</TargetFilename> <!-- often used staging directories --> 

From 665de6f12e7d46cdf1ed3d208a4e8b94862dcca3 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Thu, 18 Aug 2022 16:49:22 +0200
Subject: [PATCH 088/149] feat: progs that should never drop exes

---
 sysmonconfig-export-block.xml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 60b7c877..006264af 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -1335,6 +1335,7 @@
 			<TargetFilename condition="contains all">C:\Users\;\Pictures\</TargetFilename> <!-- often used staging directories in User folders --> 
 			<TargetFilename condition="contains all">C:\Users\;\Videos\</TargetFilename> <!-- often used staging directories in User folders --> 
 			<TargetFilename condition="contains all">C:\Users\;\Contacts\</TargetFilename> <!-- often used staging directories in User folders --> 
+			
 			<!-- Executables double extensions -->
 			<TargetFilename condition="end with">.pdf.exe</TargetFilename>
 			<TargetFilename condition="end with">.doc.exe</TargetFilename>
@@ -1350,6 +1351,7 @@
 			<TargetFilename condition="end with">.htm.exe</TargetFilename>
 			<TargetFilename condition="end with">.html.exe</TargetFilename>
 			<TargetFilename condition="end with">.iso.exe</TargetFilename>
+			
 			<!-- Hacktool Blocks based on Imphashes -->
 			<Hashes condition="contains">IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932</Hashes> <!-- PetitPotam -->
 			<Hashes condition="contains">IMPHASH=3A19059BD7688CB88E70005F18EFC439</Hashes> <!-- PetitPotam -->
@@ -1430,6 +1432,7 @@
 			<Hashes condition="contains">IMPHASH=3DE09703C8E79ED2CA3F01074719906B</Hashes> <!-- UACMe Akagi -->
 			<Hashes condition="contains">IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F</Hashes> <!-- WCE -->
 			<Hashes condition="contains">IMPHASH=E96A73C7BF33A464C510EDE582318BF2</Hashes> <!-- WCE -->
+			
 			<!-- Microsoft Office Programs Dropping Executables -->
 			<Image condition="image">winword.exe</Image>
 			<Image condition="image">excel.exe</Image>
@@ -1440,6 +1443,7 @@
 			<Image condition="image">visio.exe</Image>
 			<Image condition="image">wordpad.exe</Image>
 			<Image condition="image">wordview.exe</Image>
+			
 			<!-- LOLBINs that can be used to download executables -->
 			<Image condition="image">certutil.exe</Image>
 			<Image condition="image">certoc.exe</Image>
@@ -1449,6 +1453,13 @@
 			<Image condition="image">esentutl.exe</Image>
 			<Image condition="image">expand.exe</Image>
 			<Image condition="image">finger.exe</Image>
+
+			<!-- Executables that should never drop an executable to disk (but may after a previous process injection or if it's malware that uses a legitimate name)-->
+			<Image condition="image">notepad.exe</Image>
+			<Image condition="image">AcroRd32.exe</Image>
+			<Image condition="image">RdrCEF.exe</Image>
+			<Image condition="image">mshta.exe</Image>
+			<Image condition="image">hh.exe</Image>
 		</FileBlockExecutable>
 	</RuleGroup>
 

From 73ca9002cf7358b7371b068e93d96268fabbd45a Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Fri, 19 Aug 2022 09:06:26 +0200
Subject: [PATCH 089/149] Sliver stagers

---
 sysmonconfig-export-block.xml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 8e3b2d29..6f14fc1e 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -3,6 +3,11 @@
 	Source project:	https://github.com/SwiftOnSecurity/sysmon-config
 	Source license:	Creative Commons Attribution 4.0 | You may privatize, fork, edit, teach, publish, or deploy for commercial use - with attribution in the text.
 
+	WARNING: THIS CONFIG INCLUDES BLOCKING RULES THAT MAY CAUSE ISSUES ENDSYSTEMS!
+	         Test this configuration intensively before using it on productive systems
+
+	LAST CHANGE: 18.08.2022
+
 	REQUIRED: Sysmon version 14 or higher (due to changes in syntax and bug-fixes)
 		https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
 -->
@@ -1436,6 +1441,7 @@
 			<Hashes condition="contains">IMPHASH=3DE09703C8E79ED2CA3F01074719906B</Hashes> <!-- UACMe Akagi -->
 			<Hashes condition="contains">IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F</Hashes> <!-- WCE -->
 			<Hashes condition="contains">IMPHASH=E96A73C7BF33A464C510EDE582318BF2</Hashes> <!-- WCE -->
+			<Hashes condition="contains">IMPHASH=32089B8851BBF8BC2D014E9F37288C83</Hashes> <!-- Sliver Stagers -->
 			
 			<!-- Microsoft Office Programs Dropping Executables -->
 			<Image condition="image">winword.exe</Image>

From 8b5e89957842ff94ad00dcc269c91ac1e58bd450 Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Fri, 19 Aug 2022 23:02:29 +0100
Subject: [PATCH 090/149] Update sysmonconfig-export-block.xml

---
 sysmonconfig-export-block.xml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 6f14fc1e..26268d79 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -1453,6 +1453,8 @@
 			<Image condition="image">visio.exe</Image>
 			<Image condition="image">wordpad.exe</Image>
 			<Image condition="image">wordview.exe</Image>
+			<Image condition="image">msohtmed.exe</Image>
+			<Image condition="image">mspub.exe</Image>
 			
 			<!-- LOLBINs that can be used to download executables -->
 			<Image condition="image">certutil.exe</Image>
@@ -1463,6 +1465,7 @@
 			<Image condition="image">esentutl.exe</Image>
 			<Image condition="image">expand.exe</Image>
 			<Image condition="image">finger.exe</Image>
+			<Image condition="image">presentationhost.exe</Image>
 
 			<!-- Executables that should never drop an executable to disk (but may after a previous process injection or if it's malware that uses a legitimate name)-->
 			<Image condition="image">notepad.exe</Image>
@@ -1470,6 +1473,8 @@
 			<Image condition="image">RdrCEF.exe</Image>
 			<Image condition="image">mshta.exe</Image>
 			<Image condition="image">hh.exe</Image>
+			<Image condition="image">calc.exe</Image>
+			<Image condition="image">mspaint.exe</Image>
 		</FileBlockExecutable>
 	</RuleGroup>
 

From 3ae0fcebf5b7a2dbb47b02a316bc3f73c2bac595 Mon Sep 17 00:00:00 2001
From: Florian Roth <venom14@gmail.com>
Date: Sun, 21 Aug 2022 09:17:00 +0200
Subject: [PATCH 091/149] Dumpert Imphashes

---
 sysmonconfig-export-block.xml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 6f14fc1e..8aff3ade 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -1442,6 +1442,9 @@
 			<Hashes condition="contains">IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F</Hashes> <!-- WCE -->
 			<Hashes condition="contains">IMPHASH=E96A73C7BF33A464C510EDE582318BF2</Hashes> <!-- WCE -->
 			<Hashes condition="contains">IMPHASH=32089B8851BBF8BC2D014E9F37288C83</Hashes> <!-- Sliver Stagers -->
+			<Hashes condition="contains">IMPHASH=09D278F9DE118EF09163C6140255C690</Hashes> <!-- Dumpert -->
+			<Hashes condition="contains">IMPHASH=03866661686829D806989E2FC5A72606</Hashes> <!-- Dumpert -->
+			<Hashes condition="contains">IMPHASH=E57401FBDADCD4571FF385AB82BD5D6D</Hashes> <!-- Dumpert -->
 			
 			<!-- Microsoft Office Programs Dropping Executables -->
 			<Image condition="image">winword.exe</Image>

From 3f808d9c022c507aae21a9346afba4a59dd533b9 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Sun, 21 Aug 2022 09:42:30 +0200
Subject: [PATCH 092/149] docs: README updates

---
 README.md | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index 61564cea..6e3cde64 100644
--- a/README.md
+++ b/README.md
@@ -17,7 +17,7 @@ It started as a is simply copy of the original repository. We merged most of the
 - PrinterNightmare
 - HiveNightmare
 
-## Configs
+## Configs in this Repository
 
 This repo includes the original and two additional configurations
 
@@ -25,6 +25,10 @@ This repo includes the original and two additional configurations
 - `sysmonconfig-export-block.xml` the original config provided by @SwiftOnSecurity with some basic blocking rules usable since Sysmon v14 (WARNING: use it with care!)
 - `sysmonconfig-trace.xml` a config by @Cyb3rWard0g that logs just everything with a few examples for debugging or threat research purposes
 
+## Other Sysmon Configs
+
+- Olaf Hartong's [Sysmon Modular](https://github.com/olafhartong/sysmon-modular) - modular Sysmon config for easier maintenance and generation of specific configs
+
 ## Testing
 
 This configuration is focused on detection coverage. We have only one rather small testing environment to avoid problematic expressions that trigger too often. It is recommended to test the downloaded configuration on a small set of systems in your environment in any case.
@@ -65,10 +69,6 @@ Run with administrator rights
 sysmon.exe -u
 ```
 
-## Rule Development
-
-For rule development we use a very extensive [Sysmon config](https://github.com/OTRF/Blacksmith/blob/master/resources/configs/sysmon/sysmon.xml) provided by @Cyb3rWarD0g in our lab that logs almost any event on an end system.
-
 ## Credits
 
 Since we wanted to be able to receive new pull requests this repository, we had to squash all open(!) pull requests of the original reposiory into a single commit on this one.

From 63c1b1b75927271d862dceb10c062dfe63ae0862 Mon Sep 17 00:00:00 2001
From: phantinuss <79651203+phantinuss@users.noreply.github.com>
Date: Mon, 22 Aug 2022 12:31:06 +0200
Subject: [PATCH 093/149] fix: remove duplicate

---
 sysmonconfig-export-block.xml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 8cf05fac..c05e0c7f 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -1457,7 +1457,6 @@
 			<Image condition="image">wordpad.exe</Image>
 			<Image condition="image">wordview.exe</Image>
 			<Image condition="image">msohtmed.exe</Image>
-			<Image condition="image">mspub.exe</Image>
 			
 			<!-- LOLBINs that can be used to download executables -->
 			<Image condition="image">certutil.exe</Image>

From 935081850697e957bbf6c5629d725383b09d2e6e Mon Sep 17 00:00:00 2001
From: Florian Roth <venom14@gmail.com>
Date: Mon, 22 Aug 2022 20:33:28 +0200
Subject: [PATCH 094/149] refactor: disable expand.exe block

---
 sysmonconfig-export-block.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 8aff3ade..57df7e87 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -1464,7 +1464,7 @@
 			<!-- <Image condition="image">bitsadmin.exe</Image> (depends on the environment; comment in if you're sure that bitsadmin doesn't do that in your env) -->
 			<Image condition="image">Desktopimgdownldr.exe</Image>
 			<Image condition="image">esentutl.exe</Image>
-			<Image condition="image">expand.exe</Image>
+			<!-- <Image condition="image">expand.exe</Image> (depends on the environment; comment in if you're sure that expand doesn't do that in your env) -->
 			<Image condition="image">finger.exe</Image>
 
 			<!-- Executables that should never drop an executable to disk (but may after a previous process injection or if it's malware that uses a legitimate name)-->

From 71b62ae37050678524789f39c697f201c7206f56 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Wed, 7 Sep 2022 15:29:41 +0200
Subject: [PATCH 095/149] block: SysmonEnte downloads

---
 sysmonconfig-export-block.xml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 54c07b1c..d4aa3aa1 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -1445,6 +1445,7 @@
 			<Hashes condition="contains">IMPHASH=09D278F9DE118EF09163C6140255C690</Hashes> <!-- Dumpert -->
 			<Hashes condition="contains">IMPHASH=03866661686829D806989E2FC5A72606</Hashes> <!-- Dumpert -->
 			<Hashes condition="contains">IMPHASH=E57401FBDADCD4571FF385AB82BD5D6D</Hashes> <!-- Dumpert -->
+			<Hashes condition="contains">IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE</Hashes> <!-- SysmonEnte -->
 			
 			<!-- Microsoft Office Programs Dropping Executables -->
 			<Image condition="image">winword.exe</Image>

From bb1b41485cab2bd77e1cbe3cdab17055219a991a Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Wed, 7 Sep 2022 15:38:42 +0200
Subject: [PATCH 096/149] SysmonQuiet coverage

---
 sysmonconfig-export-block.xml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index d4aa3aa1..6028e9d1 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -1446,6 +1446,7 @@
 			<Hashes condition="contains">IMPHASH=03866661686829D806989E2FC5A72606</Hashes> <!-- Dumpert -->
 			<Hashes condition="contains">IMPHASH=E57401FBDADCD4571FF385AB82BD5D6D</Hashes> <!-- Dumpert -->
 			<Hashes condition="contains">IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE</Hashes> <!-- SysmonEnte -->
+			<Hashes condition="contains">IMPHASH=19584675D94829987952432E018D5056</Hashes> <!-- SysmonQuiet -->
 			
 			<!-- Microsoft Office Programs Dropping Executables -->
 			<Image condition="image">winword.exe</Image>

From e274ab61590c5cd87b50a291592d177ab5c18d61 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Wed, 7 Sep 2022 15:48:17 +0200
Subject: [PATCH 097/149] SharpEvtMute Hook and Filename IOCs

---
 sysmonconfig-export-block.xml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 6028e9d1..896dd4d2 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -1361,6 +1361,12 @@
 			<TargetFilename condition="end with">.rar.exe</TargetFilename>
 			<TargetFilename condition="end with">.7z.exe</TargetFilename>
 
+			<!-- Tools that tamper with Sysmon -->
+			<TargetFilename condition="end with">\EntenLoader.exe</TargetFilename>
+			<TargetFilename condition="end with">\SysmonQuiet.exe</TargetFilename>
+			<TargetFilename condition="end with">\SharpEvtMute.exe</TargetFilename>
+			<TargetFilename condition="end with">\EvtMuteHook.dll</TargetFilename>
+
 			<!-- Hacktool Blocks based on Imphashes -->
 			<Hashes condition="contains">IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932</Hashes> <!-- PetitPotam -->
 			<Hashes condition="contains">IMPHASH=3A19059BD7688CB88E70005F18EFC439</Hashes> <!-- PetitPotam -->
@@ -1447,6 +1453,7 @@
 			<Hashes condition="contains">IMPHASH=E57401FBDADCD4571FF385AB82BD5D6D</Hashes> <!-- Dumpert -->
 			<Hashes condition="contains">IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE</Hashes> <!-- SysmonEnte -->
 			<Hashes condition="contains">IMPHASH=19584675D94829987952432E018D5056</Hashes> <!-- SysmonQuiet -->
+			<Hashes condition="contains">IMPHASH=330768A4F172E10ACB6287B87289D83B</Hashes> <!-- ShaprEvtMute Hook -->
 			
 			<!-- Microsoft Office Programs Dropping Executables -->
 			<Image condition="image">winword.exe</Image>

From af1f4392d73d890f591274a7177e9db1ba8b54a2 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Thu, 15 Sep 2022 21:21:16 +0200
Subject: [PATCH 098/149] SharpEvtMute

---
 sysmonconfig-export-block.xml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 896dd4d2..69d78802 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -1453,7 +1453,9 @@
 			<Hashes condition="contains">IMPHASH=E57401FBDADCD4571FF385AB82BD5D6D</Hashes> <!-- Dumpert -->
 			<Hashes condition="contains">IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE</Hashes> <!-- SysmonEnte -->
 			<Hashes condition="contains">IMPHASH=19584675D94829987952432E018D5056</Hashes> <!-- SysmonQuiet -->
-			<Hashes condition="contains">IMPHASH=330768A4F172E10ACB6287B87289D83B</Hashes> <!-- ShaprEvtMute Hook -->
+			<Hashes condition="contains">MD5=7B17F15713FCF13C764535AA2BDF52AA</Hashes>													<!-- ShaprEvtMute -->
+			<Hashes condition="contains">SHA1=4E18320493042BCD7D21B53E258974BC460ACC78</Hashes>										<!-- ShaprEvtMute -->
+			<Hashes condition="contains">SHA256=477DFE485F5BD9540CC83E88FC04AAFB6DE49CF1ADC6BD857D5D6F4C1730A6D1</Hashes>	<!-- ShaprEvtMute -->
 			
 			<!-- Microsoft Office Programs Dropping Executables -->
 			<Image condition="image">winword.exe</Image>

From 6262d689361ac9a6d746184843f73280abf5fa4e Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Thu, 29 Sep 2022 10:25:00 +0200
Subject: [PATCH 099/149] feat: more Cobalt Strike named pipe patterns

---
 sysmonconfig-export-block.xml | 8 ++++++++
 sysmonconfig-export.xml       | 8 ++++++++
 2 files changed, 16 insertions(+)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 69d78802..d14c32b1 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -913,6 +913,14 @@
 				<PipeName condition="begin with">\postex_ssh_</PipeName>
 				<PipeName condition="begin with">\status_</PipeName>
 				<PipeName condition="begin with">\msagent_</PipeName>
+				<!-- more named pipe names https://redcanary.com/threat-detection-report/threats/cobalt-strike/ -->
+				<PipeName condition="begin with">mojo_</PipeName>
+				<PipeName condition="begin with">interprocess_</PipeName>
+				<PipeName condition="begin with">samr_</PipeName>
+				<PipeName condition="begin with">netlogon_</PipeName>
+				<PipeName condition="begin with">srvsvc_</PipeName>
+				<PipeName condition="begin with">lsarpc_</PipeName>
+				<PipeName condition="begin with">wkssvc_</PipeName>
 				<!-- Malleable C2 profiles https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 -->
 				<!-- some of these are not exact matches, but the corresponding Sigma rules use Regexp to match exactly -->
 				<PipeName condition="begin with">\mojo.5688.8052.183894939787088877</PipeName>
diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 17b21507..ca64e447 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -955,6 +955,14 @@
 				<PipeName condition="begin with">\postex_ssh_</PipeName>
 				<PipeName condition="begin with">\status_</PipeName>
 				<PipeName condition="begin with">\msagent_</PipeName>
+				<!-- more named pipe names https://redcanary.com/threat-detection-report/threats/cobalt-strike/ -->
+				<PipeName condition="begin with">mojo_</PipeName>
+				<PipeName condition="begin with">interprocess_</PipeName>
+				<PipeName condition="begin with">samr_</PipeName>
+				<PipeName condition="begin with">netlogon_</PipeName>
+				<PipeName condition="begin with">srvsvc_</PipeName>
+				<PipeName condition="begin with">lsarpc_</PipeName>
+				<PipeName condition="begin with">wkssvc_</PipeName>
 				<!-- Malleable C2 profiles https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 -->
 				<!-- some of these are not exact matches, but the corresponding Sigma rules use Regexp to match exactly -->
 				<PipeName condition="begin with">\mojo.5688.8052.183894939787088877</PipeName>

From d2e5c3dbf1e361f223d4fde91a651a2f4ea9952a Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Tue, 4 Oct 2022 12:46:01 +0200
Subject: [PATCH 100/149] refactor: reworked file write section

---
 sysmonconfig-export-block.xml | 58 +++++++++++++++++------------------
 sysmonconfig-export.xml       | 58 +++++++++++++++++------------------
 2 files changed, 58 insertions(+), 58 deletions(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index d14c32b1..016c13c4 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -490,40 +490,55 @@
 			<TargetFilename name="T1165" condition="contains">\Startup\</TargetFilename> <!--Microsoft:Changes to user's auto-launched files and shortcuts-->
 			<TargetFilename name="OutlookAttachment" condition="contains">\Content.Outlook\</TargetFilename> <!--Microsoft:Outlook: attachments-->
 			<TargetFilename name="Downloads" condition="contains">\Downloads\</TargetFilename> <!--Downloaded files. Does not include "Run" files in IE-->
+			<TargetFilename name="T1176" condition="end with">.crx</TargetFilename> <!--Chrome extension-->
 			<TargetFilename condition="end with">.application</TargetFilename> <!--Microsoft:ClickOnce: [ https://blog.netspi.com/all-you-need-is-one-a-clickonce-love-story/ ] -->
 			<TargetFilename condition="end with">.appref-ms</TargetFilename> <!--Microsoft:ClickOnce application | Credit @ion-storm -->
+			<TargetFilename condition="end with">.ashx</TargetFilename> <!-- possible dropped webshell -->
+			<TargetFilename condition="end with">.asp</TargetFilename> <!-- possible dropped webshell -->
+			<TargetFilename condition="end with">.aspx</TargetFilename> <!-- possible dropped webshell -->
 			<TargetFilename condition="end with">.bat</TargetFilename> <!--Batch scripting-->
 			<TargetFilename condition="end with">.chm</TargetFilename>
 			<TargetFilename condition="end with">.cmd</TargetFilename> <!--Batch scripting: Batch scripts can also use the .cmd extension | Credit: @mmazanec -->
 			<TargetFilename condition="end with">.cmdline</TargetFilename> <!--Microsoft:dotNet: Executed by cvtres.exe-->
-			<TargetFilename name="T1176" condition="end with">.crx</TargetFilename> <!--Chrome extension-->
+			<TargetFilename condition="end with">.dll</TargetFilename> <!--Microsoft:Office:Word: Macro-->
+			<TargetFilename condition="end with">.dmg</TargetFilename> <!--Phishing-->
 			<TargetFilename condition="end with">.dmp</TargetFilename> <!--Process dumps [ (fr) http://blog.gentilkiwi.com/securite/mimikatz/minidump ] -->
 			<TargetFilename condition="end with">.docm</TargetFilename> <!--Microsoft:Office:Word: Macro-->
-			<TargetFilename name="DLL" condition="end with">.dll</TargetFilename> <!--Microsoft:Office:Word: Macro-->
-			<TargetFilename name="EXE" condition="end with">.exe</TargetFilename> <!--Executable-->
-			<TargetFilename name="ProcessHostingdotNETCode" condition="end with">.exe.log</TargetFilename> <!-- [ https://github.com/bitsadmin/nopowershell ] | Credit: @SBousseaden [ https://twitter.com/SBousseaden/status/1137493597769687040 ] -->
+			<TargetFilename condition="end with">.exe.log</TargetFilename> <!-- [ https://github.com/bitsadmin/nopowershell ] | Credit: @SBousseaden [ https://twitter.com/SBousseaden/status/1137493597769687040 ] -->
+			<TargetFilename condition="end with">.exe</TargetFilename> <!--Executable-->
+			<TargetFilename condition="end with">.hta</TargetFilename> <!--Scripting-->
+			<TargetFilename condition="end with">.img</TargetFilename> <!--Phishing-->
+			<TargetFilename condition="end with">.iso</TargetFilename> <!--Phishing-->
 			<TargetFilename condition="end with">.jar</TargetFilename> <!--Java applets-->
 			<TargetFilename condition="end with">.jnlp</TargetFilename> <!--Java applets-->
-			<TargetFilename condition="end with">.jse</TargetFilename> <!--Scripting [ Example: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Mal~Phires-C/detailed-analysis.aspx ] -->
-			<TargetFilename condition="end with">.hta</TargetFilename> <!--Scripting-->
-			<TargetFilename condition="end with">.aspx</TargetFilename> <!--Scripting-->
-			<TargetFilename condition="end with">.asp</TargetFilename> <!--Scripting-->
 			<TargetFilename condition="end with">.job</TargetFilename> <!--Scheduled task-->
+			<TargetFilename condition="end with">.jse</TargetFilename> <!--Scripting [ Example: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Mal~Phires-C/detailed-analysis.aspx ] -->
+			<TargetFilename condition="end with">.jsp</TargetFilename> <!-- possible dropped webshell -->
+			<TargetFilename condition="end with">.jspx</TargetFilename> <!-- possible dropped webshell -->
+			<TargetFilename condition="end with">.kirbi</TargetFilename> <!--Mimikatz Kerberos Ticket Files-->
+			<TargetFilename condition="end with">.ocx</TargetFilename> <!--Microsoft:ActiveX-->
+			<TargetFilename condition="end with">.php</TargetFilename> <!-- possible dropped webshell -->
+			<TargetFilename condition="end with">.pl</TargetFilename> <!-- possible dropped webshell -->
+			<TargetFilename condition="end with">.ppt</TargetFilename> <!--Legacy Office files are often used for attacks-->
 			<TargetFilename condition="end with">.pptm</TargetFilename> <!--Microsoft:Office:Word: Macro-->
+			<TargetFilename condition="end with">.proj</TargetFilename><!--Microsoft:MSBuild:Script: [ https://twitter.com/subTee/status/885919612969394177 ] -->
 			<TargetFilename condition="end with">.ps1</TargetFilename> <!--PowerShell [ More information: http://www.hexacorn.com/blog/2014/08/27/beyond-good-ol-run-key-part-16/ ] -->
+			<TargetFilename condition="end with">.rar</TargetFilename> <!--Suspicious Archive Types-->
+			<TargetFilename condition="end with">.rtf</TargetFilename> <!--RTF files often 0day malware vectors when opened by Office-->
+			<TargetFilename condition="end with">.scr</TargetFilename> <!--System driver files-->
+			<TargetFilename condition="end with">.scf</TargetFilename>
 			<TargetFilename condition="end with">.sct</TargetFilename> <!--Scripting | Credit @bartblaze -->
+			<TargetFilename condition="end with">.sln</TargetFilename><!--Microsoft:MSBuild:Script: [ https://twitter.com/subTee/status/885919612969394177 ] -->
 			<TargetFilename condition="end with">.sys</TargetFilename> <!--System driver files-->
-			<TargetFilename condition="end with">.scr</TargetFilename> <!--System driver files-->
 			<TargetFilename condition="end with">.vbe</TargetFilename> <!--VisualBasicScripting-->
 			<TargetFilename condition="end with">.vbs</TargetFilename> <!--VisualBasicScripting-->
+			<TargetFilename condition="end with">.war</TargetFilename>
 			<TargetFilename condition="end with">.wsc</TargetFilename> <!--Scripting | Credit @bartblaze -->
 			<TargetFilename condition="end with">.wsf</TargetFilename> <!--Scripting | Credit @bartblaze -->
-			<TargetFilename condition="end with">.xlsm</TargetFilename> <!--Microsoft:Office:Word: Macro-->
-			<TargetFilename condition="end with">.ocx</TargetFilename> <!--Microsoft:ActiveX-->
-			<TargetFilename condition="end with">.kirbi</TargetFilename> <!--Mimikatz Kerberos Ticket Files-->
-			<TargetFilename condition="end with">proj</TargetFilename><!--Microsoft:MSBuild:Script: [ https://twitter.com/subTee/status/885919612969394177 ] -->
-			<TargetFilename condition="end with">.sln</TargetFilename><!--Microsoft:MSBuild:Script: [ https://twitter.com/subTee/status/885919612969394177 ] -->
+			<TargetFilename condition="end with">.wsh</TargetFilename>
+			<TargetFilename condition="end with">.xls</TargetFilename> <!--Legacy Office files are often used for attacks-->
 			<TargetFilename condition="end with">.xls</TargetFilename><!--Microsoft [ https://medium.com/@threathuntingteam/msxsl-exe-and-wmic-exe-a-way-to-proxy-code-execution-8d524f642b75 ] -->
+			<TargetFilename condition="end with">.xlsm</TargetFilename> <!--Microsoft:Office:Word: Macro-->
 			<TargetFilename name="DefaultUserModified" condition="begin with">C:\Users\Default</TargetFilename> <!--Windows: Changes to default user profile-->
 			<TargetFilename condition="begin with">C:\Windows\system32\Drivers</TargetFilename> <!--Microsoft: Drivers dropped here-->
 			<TargetFilename condition="begin with">C:\Windows\SysWOW64\Drivers</TargetFilename> <!--Microsoft: Drivers dropped here-->
@@ -542,17 +557,6 @@
 			<!--Windows application compatibility-->
 			<TargetFilename condition="begin with">C:\Windows\AppPatch\Custom</TargetFilename> <!--Windows: Application compatibility shims [ https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html ] -->
 			<TargetFilename condition="contains">VirtualStore</TargetFilename> <!--Windows: UAC virtualization [ https://blogs.msdn.microsoft.com/oldnewthing/20150902-00/?p=91681 ] -->
-			<!--Exploitable file names-->
-			<TargetFilename condition="end with">.xls</TargetFilename> <!--Legacy Office files are often used for attacks-->
-			<TargetFilename condition="end with">.ppt</TargetFilename> <!--Legacy Office files are often used for attacks-->
-			<TargetFilename condition="end with">.rtf</TargetFilename> <!--RTF files often 0day malware vectors when opened by Office-->
-			<!-- Possible dropped webshells -->
-			<TargetFilename condition="end with">.php</TargetFilename> <!-- possible dropped webshell -->
-			<TargetFilename condition="end with">.asp</TargetFilename> <!-- possible dropped webshell -->
-			<TargetFilename condition="end with">.aspx</TargetFilename> <!-- possible dropped webshell -->
-			<TargetFilename condition="end with">.ashx</TargetFilename> <!-- possible dropped webshell -->
-			<TargetFilename condition="end with">.jsp</TargetFilename> <!-- possible dropped webshell -->
-			<TargetFilename condition="end with">.pl</TargetFilename> <!-- possible dropped webshell -->
 			<TargetFilename condition="contains">\SAM-20</TargetFilename> <!-- Default output of HiveNightmare / SeriousSAM tools -->
 			<TargetFilename condition="contains">\SAM-haxx</TargetFilename> <!-- Default output of HiveNightmare / SeriousSAM tools -->
 			<TargetFilename condition="contains">\Sam.save</TargetFilename> <!-- Default output of HiveNightmare / SeriousSAM tools -->
@@ -949,10 +953,6 @@
 				<PipeName condition="begin with">\bc367</PipeName> <!-- Pacifier - https://download.bitdefender.com/resources/files/News/CaseStudies/study/115/Bitdefender-Whitepaper-PAC-A4-en-EN1.pdf -->
 				<PipeName condition="begin with">\bc31a7</PipeName> <!-- Pacifier - https://download.bitdefender.com/resources/files/News/CaseStudies/study/115/Bitdefender-Whitepaper-PAC-A4-en-EN1.pdf -->
 				<PipeName condition="begin with">\testPipe</PipeName> <!-- Emissary Panda Hyerbri - https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/ -->
-				<Rule groupRelation="and"> <!-- would be noisy otherwise as \Winsock2\CatalogchangeListener-???-0 is a legitimate pipe name -->
-					<PipeName condition="begin with">\Winsock2\CatalogChangeListener-</PipeName>
-					<PipeName condition="end with">-0,</PipeName>
-				</Rule>
 				<!-- these are standard pipes that appear frequently but the Sigma rules use RE to match on malicious pipes that use the common names as a prefix -->
 				<PipeName condition="begin with">\scerpc</PipeName>
 				<PipeName condition="begin with">\ntsvcs</PipeName>
diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index ca64e447..1e66eb87 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -532,40 +532,55 @@
 			<TargetFilename name="T1165" condition="contains">\Startup\</TargetFilename> <!--Microsoft:Changes to user's auto-launched files and shortcuts-->
 			<TargetFilename name="OutlookAttachment" condition="contains">\Content.Outlook\</TargetFilename> <!--Microsoft:Outlook: attachments-->
 			<TargetFilename name="Downloads" condition="contains">\Downloads\</TargetFilename> <!--Downloaded files. Does not include "Run" files in IE-->
+			<TargetFilename name="T1176" condition="end with">.crx</TargetFilename> <!--Chrome extension-->
 			<TargetFilename condition="end with">.application</TargetFilename> <!--Microsoft:ClickOnce: [ https://blog.netspi.com/all-you-need-is-one-a-clickonce-love-story/ ] -->
 			<TargetFilename condition="end with">.appref-ms</TargetFilename> <!--Microsoft:ClickOnce application | Credit @ion-storm -->
+			<TargetFilename condition="end with">.ashx</TargetFilename> <!-- possible dropped webshell -->
+			<TargetFilename condition="end with">.asp</TargetFilename> <!-- possible dropped webshell -->
+			<TargetFilename condition="end with">.aspx</TargetFilename> <!-- possible dropped webshell -->
 			<TargetFilename condition="end with">.bat</TargetFilename> <!--Batch scripting-->
 			<TargetFilename condition="end with">.chm</TargetFilename>
 			<TargetFilename condition="end with">.cmd</TargetFilename> <!--Batch scripting: Batch scripts can also use the .cmd extension | Credit: @mmazanec -->
 			<TargetFilename condition="end with">.cmdline</TargetFilename> <!--Microsoft:dotNet: Executed by cvtres.exe-->
-			<TargetFilename name="T1176" condition="end with">.crx</TargetFilename> <!--Chrome extension-->
+			<TargetFilename condition="end with">.dll</TargetFilename> <!--Microsoft:Office:Word: Macro-->
+			<TargetFilename condition="end with">.dmg</TargetFilename> <!--Phishing-->
 			<TargetFilename condition="end with">.dmp</TargetFilename> <!--Process dumps [ (fr) http://blog.gentilkiwi.com/securite/mimikatz/minidump ] -->
 			<TargetFilename condition="end with">.docm</TargetFilename> <!--Microsoft:Office:Word: Macro-->
-			<TargetFilename name="DLL" condition="end with">.dll</TargetFilename> <!--Microsoft:Office:Word: Macro-->
-			<TargetFilename name="EXE" condition="end with">.exe</TargetFilename> <!--Executable-->
-			<TargetFilename name="ProcessHostingdotNETCode" condition="end with">.exe.log</TargetFilename> <!-- [ https://github.com/bitsadmin/nopowershell ] | Credit: @SBousseaden [ https://twitter.com/SBousseaden/status/1137493597769687040 ] -->
+			<TargetFilename condition="end with">.exe.log</TargetFilename> <!-- [ https://github.com/bitsadmin/nopowershell ] | Credit: @SBousseaden [ https://twitter.com/SBousseaden/status/1137493597769687040 ] -->
+			<TargetFilename condition="end with">.exe</TargetFilename> <!--Executable-->
+			<TargetFilename condition="end with">.hta</TargetFilename> <!--Scripting-->
+			<TargetFilename condition="end with">.img</TargetFilename> <!--Phishing-->
+			<TargetFilename condition="end with">.iso</TargetFilename> <!--Phishing-->
 			<TargetFilename condition="end with">.jar</TargetFilename> <!--Java applets-->
 			<TargetFilename condition="end with">.jnlp</TargetFilename> <!--Java applets-->
-			<TargetFilename condition="end with">.jse</TargetFilename> <!--Scripting [ Example: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Mal~Phires-C/detailed-analysis.aspx ] -->
-			<TargetFilename condition="end with">.hta</TargetFilename> <!--Scripting-->
-			<TargetFilename condition="end with">.aspx</TargetFilename> <!--Scripting-->
-			<TargetFilename condition="end with">.asp</TargetFilename> <!--Scripting-->
 			<TargetFilename condition="end with">.job</TargetFilename> <!--Scheduled task-->
+			<TargetFilename condition="end with">.jse</TargetFilename> <!--Scripting [ Example: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Mal~Phires-C/detailed-analysis.aspx ] -->
+			<TargetFilename condition="end with">.jsp</TargetFilename> <!-- possible dropped webshell -->
+			<TargetFilename condition="end with">.jspx</TargetFilename> <!-- possible dropped webshell -->
+			<TargetFilename condition="end with">.kirbi</TargetFilename> <!--Mimikatz Kerberos Ticket Files-->
+			<TargetFilename condition="end with">.ocx</TargetFilename> <!--Microsoft:ActiveX-->
+			<TargetFilename condition="end with">.php</TargetFilename> <!-- possible dropped webshell -->
+			<TargetFilename condition="end with">.pl</TargetFilename> <!-- possible dropped webshell -->
+			<TargetFilename condition="end with">.ppt</TargetFilename> <!--Legacy Office files are often used for attacks-->
 			<TargetFilename condition="end with">.pptm</TargetFilename> <!--Microsoft:Office:Word: Macro-->
+			<TargetFilename condition="end with">.proj</TargetFilename><!--Microsoft:MSBuild:Script: [ https://twitter.com/subTee/status/885919612969394177 ] -->
 			<TargetFilename condition="end with">.ps1</TargetFilename> <!--PowerShell [ More information: http://www.hexacorn.com/blog/2014/08/27/beyond-good-ol-run-key-part-16/ ] -->
+			<TargetFilename condition="end with">.rar</TargetFilename> <!--Suspicious Archive Types-->
+			<TargetFilename condition="end with">.rtf</TargetFilename> <!--RTF files often 0day malware vectors when opened by Office-->
+			<TargetFilename condition="end with">.scr</TargetFilename> <!--System driver files-->
+			<TargetFilename condition="end with">.scf</TargetFilename>
 			<TargetFilename condition="end with">.sct</TargetFilename> <!--Scripting | Credit @bartblaze -->
+			<TargetFilename condition="end with">.sln</TargetFilename><!--Microsoft:MSBuild:Script: [ https://twitter.com/subTee/status/885919612969394177 ] -->
 			<TargetFilename condition="end with">.sys</TargetFilename> <!--System driver files-->
-			<TargetFilename condition="end with">.scr</TargetFilename> <!--System driver files-->
 			<TargetFilename condition="end with">.vbe</TargetFilename> <!--VisualBasicScripting-->
 			<TargetFilename condition="end with">.vbs</TargetFilename> <!--VisualBasicScripting-->
+			<TargetFilename condition="end with">.war</TargetFilename>
 			<TargetFilename condition="end with">.wsc</TargetFilename> <!--Scripting | Credit @bartblaze -->
 			<TargetFilename condition="end with">.wsf</TargetFilename> <!--Scripting | Credit @bartblaze -->
-			<TargetFilename condition="end with">.xlsm</TargetFilename> <!--Microsoft:Office:Word: Macro-->
-			<TargetFilename condition="end with">.ocx</TargetFilename> <!--Microsoft:ActiveX-->
-			<TargetFilename condition="end with">.kirbi</TargetFilename> <!--Mimikatz Kerberos Ticket Files-->
-			<TargetFilename condition="end with">proj</TargetFilename><!--Microsoft:MSBuild:Script: [ https://twitter.com/subTee/status/885919612969394177 ] -->
-			<TargetFilename condition="end with">.sln</TargetFilename><!--Microsoft:MSBuild:Script: [ https://twitter.com/subTee/status/885919612969394177 ] -->
+			<TargetFilename condition="end with">.wsh</TargetFilename>
+			<TargetFilename condition="end with">.xls</TargetFilename> <!--Legacy Office files are often used for attacks-->
 			<TargetFilename condition="end with">.xls</TargetFilename><!--Microsoft [ https://medium.com/@threathuntingteam/msxsl-exe-and-wmic-exe-a-way-to-proxy-code-execution-8d524f642b75 ] -->
+			<TargetFilename condition="end with">.xlsm</TargetFilename> <!--Microsoft:Office:Word: Macro-->
 			<TargetFilename name="DefaultUserModified" condition="begin with">C:\Users\Default</TargetFilename> <!--Windows: Changes to default user profile-->
 			<TargetFilename condition="begin with">C:\Windows\system32\Drivers</TargetFilename> <!--Microsoft: Drivers dropped here-->
 			<TargetFilename condition="begin with">C:\Windows\SysWOW64\Drivers</TargetFilename> <!--Microsoft: Drivers dropped here-->
@@ -584,17 +599,6 @@
 			<!--Windows application compatibility-->
 			<TargetFilename condition="begin with">C:\Windows\AppPatch\Custom</TargetFilename> <!--Windows: Application compatibility shims [ https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html ] -->
 			<TargetFilename condition="contains">VirtualStore</TargetFilename> <!--Windows: UAC virtualization [ https://blogs.msdn.microsoft.com/oldnewthing/20150902-00/?p=91681 ] -->
-			<!--Exploitable file names-->
-			<TargetFilename condition="end with">.xls</TargetFilename> <!--Legacy Office files are often used for attacks-->
-			<TargetFilename condition="end with">.ppt</TargetFilename> <!--Legacy Office files are often used for attacks-->
-			<TargetFilename condition="end with">.rtf</TargetFilename> <!--RTF files often 0day malware vectors when opened by Office-->
-			<!-- Possible dropped webshells -->
-			<TargetFilename condition="end with">.php</TargetFilename> <!-- possible dropped webshell -->
-			<TargetFilename condition="end with">.asp</TargetFilename> <!-- possible dropped webshell -->
-			<TargetFilename condition="end with">.aspx</TargetFilename> <!-- possible dropped webshell -->
-			<TargetFilename condition="end with">.ashx</TargetFilename> <!-- possible dropped webshell -->
-			<TargetFilename condition="end with">.jsp</TargetFilename> <!-- possible dropped webshell -->
-			<TargetFilename condition="end with">.pl</TargetFilename> <!-- possible dropped webshell -->
 			<TargetFilename condition="contains">\SAM-20</TargetFilename> <!-- Default output of HiveNightmare / SeriousSAM tools -->
 			<TargetFilename condition="contains">\SAM-haxx</TargetFilename> <!-- Default output of HiveNightmare / SeriousSAM tools -->
 			<TargetFilename condition="contains">\Sam.save</TargetFilename> <!-- Default output of HiveNightmare / SeriousSAM tools -->
@@ -991,10 +995,6 @@
 				<PipeName condition="begin with">\bc367</PipeName> <!-- Pacifier - https://download.bitdefender.com/resources/files/News/CaseStudies/study/115/Bitdefender-Whitepaper-PAC-A4-en-EN1.pdf -->
 				<PipeName condition="begin with">\bc31a7</PipeName> <!-- Pacifier - https://download.bitdefender.com/resources/files/News/CaseStudies/study/115/Bitdefender-Whitepaper-PAC-A4-en-EN1.pdf -->
 				<PipeName condition="begin with">\testPipe</PipeName> <!-- Emissary Panda Hyerbri - https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/ -->
-				<Rule groupRelation="and"> <!-- would be noisy otherwise as \Winsock2\CatalogchangeListener-???-0 is a legitimate pipe name -->
-					<PipeName condition="begin with">\Winsock2\CatalogChangeListener-</PipeName>
-					<PipeName condition="end with">-0,</PipeName>
-				</Rule>
 				<!-- these are standard pipes that appear frequently but the Sigma rules use RE to match on malicious pipes that use the common names as a prefix -->
 				<PipeName condition="begin with">\scerpc</PipeName>
 				<PipeName condition="begin with">\ntsvcs</PipeName>

From 6a904c174a94f9ae2f2d4c044a5b8252c9f1cd44 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Tue, 4 Oct 2022 16:10:43 +0200
Subject: [PATCH 101/149] fix: many events with standard pipe

---
 sysmonconfig-export-block.xml | 4 ++++
 sysmonconfig-export.xml       | 3 +++
 2 files changed, 7 insertions(+)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 016c13c4..b14319ac 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -893,6 +893,7 @@
 		<!--DATA: UtcTime, Configuration, ConfigurationFileHash-->
 		<!--Cannot be filtered.-->
 
+
 	<!--SYSMON EVENT ID 17 & 18 : PIPE CREATED / PIPE CONNECTED [PipeEvent]-->
 		<!--EVENT 17: "Pipe Created"-->
 		<!--EVENT 18: "Pipe Connected"-->
@@ -964,6 +965,9 @@
 					<EventType condition="is">ConnectPipe</EventType>
 					<PipeName condition="is">\MICROSOFT##WID\tsql\query</PipeName> <!-- https://github.com/SigmaHQ/sigma/pull/2128 -->
 				</Rule>
+				<Rule groupRelation="and"> <!-- Some interesting ConnectPipe events that we want to include -->
+					<PipeName condition="is not">\MsFteWds</PipeName> <!-- otherwise too many FPs with Explorer and SearchIndexer -->
+				</Rule>
 			</PipeEvent>
 		</RuleGroup>
 		<!-- Common Pipe Names to would appear very often in -->
diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 1e66eb87..a09c3071 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -1006,6 +1006,9 @@
 					<EventType condition="is">ConnectPipe</EventType>
 					<PipeName condition="is">\MICROSOFT##WID\tsql\query</PipeName> <!-- https://github.com/SigmaHQ/sigma/pull/2128 -->
 				</Rule>
+				<Rule groupRelation="and"> <!-- Some interesting ConnectPipe events that we want to include -->
+					<PipeName condition="is not">\MsFteWds</PipeName> <!-- otherwise too many FPs with Explorer and SearchIndexer -->
+				</Rule>
 			</PipeEvent>
 		</RuleGroup>
 		<!-- Common Pipe Names to would appear very often in -->

From f6e9b8f3f07da036b9038aa94740289a392e1493 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Thu, 6 Oct 2022 08:41:12 +0200
Subject: [PATCH 102/149] feat: block JuicyPotatoNG downloads

---
 sysmonconfig-export-block.xml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index b14319ac..3f80dc28 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -1400,6 +1400,7 @@
 			<Hashes condition="contains">IMPHASH=FCC251CCEAE90D22C392215CC9A2D5D6</Hashes> <!-- Mimikatz -->
 			<Hashes condition="contains">IMPHASH=23867A89C2B8FC733BE6CF5EF902F2D1</Hashes> <!-- JuicyPotato  -->
 			<Hashes condition="contains">IMPHASH=A37FF327F8D48E8A4D2F757E1B6E70BC</Hashes> <!-- JuicyPotato  -->
+			<Hashes condition="contains">IMPHASH=F9A28C458284584A93B14216308D31BD</Hashes> <!-- JuicyPotatoNG  -->
 			<Hashes condition="contains">IMPHASH=6118619783FC175BC7EBECFF0769B46E</Hashes> <!-- RoguePotato -->
 			<Hashes condition="contains">IMPHASH=959A83047E80AB68B368FDB3F4C6E4EA</Hashes> <!-- RoguePotato -->
 			<Hashes condition="contains">IMPHASH=563233BFA169ACC7892451F71AD5850A</Hashes> <!-- RoguePotato -->

From abd7e1fe7b10b4d67a30a79ce6c7da036d6b0e7b Mon Sep 17 00:00:00 2001
From: Steven Hardey <stevenhardey@users.noreply.github.com>
Date: Sun, 9 Oct 2022 06:19:53 +1100
Subject: [PATCH 103/149] Update sysmonconfig-export-block.xml

update extension GPO instructions
add additional msoft urls
---
 sysmonconfig-export-block.xml | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 3f80dc28..af9a662d 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -1009,9 +1009,10 @@
 
 		<!--OPERATIONS:	Most DNS traffic is web advertising. To significantly reduce DNS queries and malware ads, enable client-side advertising filtering via Group Policy. This is easy.
 				Internet Explorer: https://decentsecurity.com/adblocking-for-internet-explorer-deployment/
-				Chrome: https://decentsecurity.com/ublock-for-google-chrome-deployment/
-				Firefox: ToDo
-						Also note, this configuration is designed for United States computers. Your country's users will may need customization to reduce noise.
+				Chrome: https://support.google.com/chrome/a/answer/187202?hl=en#zippy=%2Cwindows
+					https://decentsecurity.com/ublockorigin-deployment-enterprise/
+				Firefox: https://github.com/mozilla/policy-templates/blob/master/windows/en-US/firefox.adml
+				Also note, this configuration is designed for United States computers. Your country's users will may need customization to reduce noise.
 			-->
 
 		<!--CONFIG:	DNS poisoning is an issue during threat investigations. Try to only exclude ROUTINE system-level queries you know are strongly validated with HTTPS or code signing.-->
@@ -1041,6 +1042,7 @@
 			<QueryName condition="is">localhost</QueryName>
 			<!--Microsoft-->
 			<QueryName condition="end with">-pushp.svc.ms</QueryName> <!--Microsoft: Doesn't appear to host customer content or subdomains-->
+			<QueryName condition="end with">.a-msedge.net</QueryName> <!--Microsoft: Doesn't appear to host customer content or subdomains-->
 			<QueryName condition="end with">.b-msedge.net</QueryName> <!--Microsoft: Doesn't appear to host customer content or subdomains-->
 			<QueryName condition="end with">.bing.com</QueryName> <!-- Microsoft | Microsoft default exclusion -->
 			<QueryName condition="end with">.hotmail.com</QueryName> <!--Microsoft | Microsoft default exclusion-->
@@ -1054,6 +1056,7 @@
 			<QueryName condition="end with">.msedge.net</QueryName> <!--Microsoft: Doesn't appear to host customer content or subdomains-->
 			<QueryName condition="end with">.msn.com</QueryName> <!--Microsoft | Microsoft default exclusion-->
 			<QueryName condition="end with">.msocdn.com</QueryName> <!--Microsoft-->
+			<QueryName condition="end with">.msftncsi.com</QueryName> <!--Microsoft: Network Connectivity Indicator-->
 			<QueryName condition="end with">.skype.com</QueryName> <!--Microsoft | Microsoft default exclusion-->
 			<QueryName condition="end with">.skype.net</QueryName> <!--Microsoft | Microsoft default exclusion-->
 			<QueryName condition="end with">.windows.com</QueryName> <!--Microsoft-->

From 452d448ffaa1f50b6f916c1498eb58a4d6e20830 Mon Sep 17 00:00:00 2001
From: phantinuss <79651203+phantinuss@users.noreply.github.com>
Date: Mon, 10 Oct 2022 11:34:02 +0200
Subject: [PATCH 104/149] chore: mirror changes from PR #35

---
 sysmonconfig-export.xml | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index a09c3071..724d51c4 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -1050,9 +1050,10 @@
 
 		<!--OPERATIONS:	Most DNS traffic is web advertising. To significantly reduce DNS queries and malware ads, enable client-side advertising filtering via Group Policy. This is easy.
 				Internet Explorer: https://decentsecurity.com/adblocking-for-internet-explorer-deployment/
-				Chrome: https://decentsecurity.com/ublock-for-google-chrome-deployment/
-				Firefox: ToDo
-						Also note, this configuration is designed for United States computers. Your country's users will may need customization to reduce noise.
+				Chrome: https://support.google.com/chrome/a/answer/187202?hl=en#zippy=%2Cwindows
+						https://decentsecurity.com/ublockorigin-deployment-enterprise/
+				Firefox: https://github.com/mozilla/policy-templates/blob/master/windows/en-US/firefox.adml
+				Also note, this configuration is designed for United States computers. Your country's users will may need customization to reduce noise.
 			-->
 
 		<!--CONFIG:	DNS poisoning is an issue during threat investigations. Try to only exclude ROUTINE system-level queries you know are strongly validated with HTTPS or code signing.-->
@@ -1082,6 +1083,7 @@
 			<QueryName condition="is">localhost</QueryName>
 			<!--Microsoft-->
 			<QueryName condition="end with">-pushp.svc.ms</QueryName> <!--Microsoft: Doesn't appear to host customer content or subdomains-->
+			<QueryName condition="end with">.a-msedge.net</QueryName> <!--Microsoft: Doesn't appear to host customer content or subdomains-->
 			<QueryName condition="end with">.b-msedge.net</QueryName> <!--Microsoft: Doesn't appear to host customer content or subdomains-->
 			<QueryName condition="end with">.bing.com</QueryName> <!-- Microsoft | Microsoft default exclusion -->
 			<QueryName condition="end with">.hotmail.com</QueryName> <!--Microsoft | Microsoft default exclusion-->
@@ -1095,6 +1097,7 @@
 			<QueryName condition="end with">.msedge.net</QueryName> <!--Microsoft: Doesn't appear to host customer content or subdomains-->
 			<QueryName condition="end with">.msn.com</QueryName> <!--Microsoft | Microsoft default exclusion-->
 			<QueryName condition="end with">.msocdn.com</QueryName> <!--Microsoft-->
+			<QueryName condition="end with">.msftncsi.com</QueryName> <!--Microsoft: Network Connectivity Indicator-->
 			<QueryName condition="end with">.skype.com</QueryName> <!--Microsoft | Microsoft default exclusion-->
 			<QueryName condition="end with">.skype.net</QueryName> <!--Microsoft | Microsoft default exclusion-->
 			<QueryName condition="end with">.windows.com</QueryName> <!--Microsoft-->

From 2af5f4e30e290ecfe1b28dd83d5cdb7e94a5efdd Mon Sep 17 00:00:00 2001
From: phantinuss <79651203+phantinuss@users.noreply.github.com>
Date: Fri, 21 Oct 2022 08:55:30 +0200
Subject: [PATCH 105/149] fix: remove unnecessary exclude block for FileDelete

---
 sysmonconfig-trace.xml | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/sysmonconfig-trace.xml b/sysmonconfig-trace.xml
index 775d498d..5db4493f 100644
--- a/sysmonconfig-trace.xml
+++ b/sysmonconfig-trace.xml
@@ -280,17 +280,13 @@
 				<Image condition="is">C:\Program Files (x86)\nxlog\nxlog.exe</Image>
 			</DnsQuery>
 		</RuleGroup>
-        <RuleGroup name="" groupRelation="or">
-			<!--Event ID 23 == File Delete-->
-			<FileDelete onmatch="include">
-            </FileDelete>
-		</RuleGroup>
 		<RuleGroup name="" groupRelation="or">
 			<!--Event ID 23 == File Delete-->
-			<FileDelete onmatch="exclude">
-				<Image condition="is">C:\windows\system32\mmc.exe</Image>
-            </FileDelete>
+			<FileDelete onmatch="include">
+				<!-- disabled in favor of ID 26 FileDeleteDetected -->
+			</FileDelete>
 		</RuleGroup>
+
 		<RuleGroup name="" groupRelation="or">
 			<!--Event ID 24 == Clipboard -->
 			<ClipboardChange onmatch="exclude" />

From c90917b9a082b733ee61d7b4ccd3a6e14e064033 Mon Sep 17 00:00:00 2001
From: phantinuss <79651203+phantinuss@users.noreply.github.com>
Date: Fri, 21 Oct 2022 11:12:55 +0200
Subject: [PATCH 106/149] Revert "fix: many events with standard pipe"

This reverts commit 6a904c174a94f9ae2f2d4c044a5b8252c9f1cd44.
---
 sysmonconfig-export-block.xml | 4 ----
 sysmonconfig-export.xml       | 3 ---
 2 files changed, 7 deletions(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index af9a662d..53d39c7f 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -893,7 +893,6 @@
 		<!--DATA: UtcTime, Configuration, ConfigurationFileHash-->
 		<!--Cannot be filtered.-->
 
-
 	<!--SYSMON EVENT ID 17 & 18 : PIPE CREATED / PIPE CONNECTED [PipeEvent]-->
 		<!--EVENT 17: "Pipe Created"-->
 		<!--EVENT 18: "Pipe Connected"-->
@@ -965,9 +964,6 @@
 					<EventType condition="is">ConnectPipe</EventType>
 					<PipeName condition="is">\MICROSOFT##WID\tsql\query</PipeName> <!-- https://github.com/SigmaHQ/sigma/pull/2128 -->
 				</Rule>
-				<Rule groupRelation="and"> <!-- Some interesting ConnectPipe events that we want to include -->
-					<PipeName condition="is not">\MsFteWds</PipeName> <!-- otherwise too many FPs with Explorer and SearchIndexer -->
-				</Rule>
 			</PipeEvent>
 		</RuleGroup>
 		<!-- Common Pipe Names to would appear very often in -->
diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 724d51c4..cf05402f 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -1006,9 +1006,6 @@
 					<EventType condition="is">ConnectPipe</EventType>
 					<PipeName condition="is">\MICROSOFT##WID\tsql\query</PipeName> <!-- https://github.com/SigmaHQ/sigma/pull/2128 -->
 				</Rule>
-				<Rule groupRelation="and"> <!-- Some interesting ConnectPipe events that we want to include -->
-					<PipeName condition="is not">\MsFteWds</PipeName> <!-- otherwise too many FPs with Explorer and SearchIndexer -->
-				</Rule>
 			</PipeEvent>
 		</RuleGroup>
 		<!-- Common Pipe Names to would appear very often in -->

From 13588c0121cba04c4d38761171b5ca86fa54412b Mon Sep 17 00:00:00 2001
From: Paul Hager <28906717+pH-T@users.noreply.github.com>
Date: Fri, 21 Oct 2022 12:49:01 +0200
Subject: [PATCH 107/149] fix: fixed pipename beginswith clauses

---
 sysmonconfig-export-block.xml | 14 +++++++-------
 sysmonconfig-export.xml       | 14 +++++++-------
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 53d39c7f..fd4e8ff3 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -918,13 +918,13 @@
 				<PipeName condition="begin with">\status_</PipeName>
 				<PipeName condition="begin with">\msagent_</PipeName>
 				<!-- more named pipe names https://redcanary.com/threat-detection-report/threats/cobalt-strike/ -->
-				<PipeName condition="begin with">mojo_</PipeName>
-				<PipeName condition="begin with">interprocess_</PipeName>
-				<PipeName condition="begin with">samr_</PipeName>
-				<PipeName condition="begin with">netlogon_</PipeName>
-				<PipeName condition="begin with">srvsvc_</PipeName>
-				<PipeName condition="begin with">lsarpc_</PipeName>
-				<PipeName condition="begin with">wkssvc_</PipeName>
+				<PipeName condition="begin with">\mojo_</PipeName>
+				<PipeName condition="begin with">\interprocess_</PipeName>
+				<PipeName condition="begin with">\samr_</PipeName>
+				<PipeName condition="begin with">\netlogon_</PipeName>
+				<PipeName condition="begin with">\srvsvc_</PipeName>
+				<PipeName condition="begin with">\lsarpc_</PipeName>
+				<PipeName condition="begin with">\wkssvc_</PipeName>
 				<!-- Malleable C2 profiles https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 -->
 				<!-- some of these are not exact matches, but the corresponding Sigma rules use Regexp to match exactly -->
 				<PipeName condition="begin with">\mojo.5688.8052.183894939787088877</PipeName>
diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index cf05402f..6563fb65 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -960,13 +960,13 @@
 				<PipeName condition="begin with">\status_</PipeName>
 				<PipeName condition="begin with">\msagent_</PipeName>
 				<!-- more named pipe names https://redcanary.com/threat-detection-report/threats/cobalt-strike/ -->
-				<PipeName condition="begin with">mojo_</PipeName>
-				<PipeName condition="begin with">interprocess_</PipeName>
-				<PipeName condition="begin with">samr_</PipeName>
-				<PipeName condition="begin with">netlogon_</PipeName>
-				<PipeName condition="begin with">srvsvc_</PipeName>
-				<PipeName condition="begin with">lsarpc_</PipeName>
-				<PipeName condition="begin with">wkssvc_</PipeName>
+				<PipeName condition="begin with">\mojo_</PipeName>
+				<PipeName condition="begin with">\interprocess_</PipeName>
+				<PipeName condition="begin with">\samr_</PipeName>
+				<PipeName condition="begin with">\netlogon_</PipeName>
+				<PipeName condition="begin with">\srvsvc_</PipeName>
+				<PipeName condition="begin with">\lsarpc_</PipeName>
+				<PipeName condition="begin with">\wkssvc_</PipeName>
 				<!-- Malleable C2 profiles https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 -->
 				<!-- some of these are not exact matches, but the corresponding Sigma rules use Regexp to match exactly -->
 				<PipeName condition="begin with">\mojo.5688.8052.183894939787088877</PipeName>

From fd6830b0d56a7fcfe9cf608c6d30d3fd1b722213 Mon Sep 17 00:00:00 2001
From: Paul Hager <28906717+pH-T@users.noreply.github.com>
Date: Fri, 21 Oct 2022 12:50:13 +0200
Subject: [PATCH 108/149] feat: new havoc c2 pipenames

---
 sysmonconfig-export-block.xml | 3 +++
 sysmonconfig-export.xml       | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index fd4e8ff3..e93bd209 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -925,6 +925,9 @@
 				<PipeName condition="begin with">\srvsvc_</PipeName>
 				<PipeName condition="begin with">\lsarpc_</PipeName>
 				<PipeName condition="begin with">\wkssvc_</PipeName>
+				<!-- Havoc C2 default -->
+				<PipeName condition="begin with">\demon_pipe</PipeName>
+				<PipeName condition="begin with">\mojo.</PipeName>
 				<!-- Malleable C2 profiles https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 -->
 				<!-- some of these are not exact matches, but the corresponding Sigma rules use Regexp to match exactly -->
 				<PipeName condition="begin with">\mojo.5688.8052.183894939787088877</PipeName>
diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 6563fb65..2cbdc827 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -967,6 +967,9 @@
 				<PipeName condition="begin with">\srvsvc_</PipeName>
 				<PipeName condition="begin with">\lsarpc_</PipeName>
 				<PipeName condition="begin with">\wkssvc_</PipeName>
+				<!-- Havoc C2 default -->
+				<PipeName condition="begin with">\demon_pipe</PipeName>
+				<PipeName condition="begin with">\mojo.</PipeName>
 				<!-- Malleable C2 profiles https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 -->
 				<!-- some of these are not exact matches, but the corresponding Sigma rules use Regexp to match exactly -->
 				<PipeName condition="begin with">\mojo.5688.8052.183894939787088877</PipeName>

From 7b41eb3dfea5dd251c1b4858387da57ead1364dd Mon Sep 17 00:00:00 2001
From: pH-T <28906717+pH-T@users.noreply.github.com>
Date: Mon, 24 Oct 2022 12:54:04 +0200
Subject: [PATCH 109/149] Apply suggestions from code review

Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
---
 sysmonconfig-export-block.xml | 1 -
 sysmonconfig-export.xml       | 1 -
 2 files changed, 2 deletions(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index e93bd209..58724ae9 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -927,7 +927,6 @@
 				<PipeName condition="begin with">\wkssvc_</PipeName>
 				<!-- Havoc C2 default -->
 				<PipeName condition="begin with">\demon_pipe</PipeName>
-				<PipeName condition="begin with">\mojo.</PipeName>
 				<!-- Malleable C2 profiles https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 -->
 				<!-- some of these are not exact matches, but the corresponding Sigma rules use Regexp to match exactly -->
 				<PipeName condition="begin with">\mojo.5688.8052.183894939787088877</PipeName>
diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 2cbdc827..eb9f3a99 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -969,7 +969,6 @@
 				<PipeName condition="begin with">\wkssvc_</PipeName>
 				<!-- Havoc C2 default -->
 				<PipeName condition="begin with">\demon_pipe</PipeName>
-				<PipeName condition="begin with">\mojo.</PipeName>
 				<!-- Malleable C2 profiles https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 -->
 				<!-- some of these are not exact matches, but the corresponding Sigma rules use Regexp to match exactly -->
 				<PipeName condition="begin with">\mojo.5688.8052.183894939787088877</PipeName>

From 2c6ce88371b8c8d24e0227bfbb6806a25bde8fe7 Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Thu, 27 Oct 2022 01:25:01 +0200
Subject: [PATCH 110/149] Update Config

---
 sysmonconfig-export-block.xml | 8 +++++++-
 sysmonconfig-export.xml       | 8 +++++++-
 sysmonconfig-trace.xml        | 7 ++++++-
 3 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 58724ae9..5142dab1 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -727,7 +727,13 @@
 			<TargetObject name="T1089,Tamper-Defender" condition="end with">\DisableAntiSpyware</TargetObject> <!--Windows:Defender: State modified via registry-->
 			<TargetObject name="T1089,Tamper-Defender" condition="end with">\DisableAntiVirus</TargetObject> <!--Windows:Defender: State modified via registry-->
 			<TargetObject name="T1089,Tamper-Defender" condition="end with">\SpynetReporting</TargetObject> <!--Windows:Defender: State modified via registry-->
-			<TargetObject name="T1089,Tamper-Defender" condition="end with">DisableRealtimeMonitoring</TargetObject> <!--Windows:Defender: State modified via registry-->
+			<TargetObject name="T1089,Tamper-Defender" condition="end with">\DisableRealtimeMonitoring</TargetObject> <!--Windows:Defender: State modified via registry-->
+			<TargetObject name="T1089,Tamper-Defender" condition="end with">\DisableBehaviorMonitoring</TargetObject> <!--Windows:Defender: State modified via registry-->
+			<TargetObject name="T1089,Tamper-Defender" condition="end with">\DisableIOAVProtection</TargetObject> <!--Windows:Defender: State modified via registry-->
+			<TargetObject name="T1089,Tamper-Defender" condition="end with">\DisableOnAccessProtection</TargetObject> <!--Windows:Defender: State modified via registry-->
+			<TargetObject name="T1089,Tamper-Defender" condition="end with">\DisableScanOnRealtimeEnable</TargetObject> <!--Windows:Defender: State modified via registry-->
+			<TargetObject name="T1089,Tamper-Defender" condition="end with">\Reporting\DisableEnhancedNotifications</TargetObject> <!--Windows:Defender: State modified via registry-->
+			<TargetObject name="T1089,Tamper-Defender" condition="end with">\SpyNet\DisableBlockAtFirstSeen</TargetObject> <!--Windows:Defender: State modified via registry-->
 			<TargetObject name="T1089,Tamper-Defender" condition="end with">\SubmitSamplesConsent</TargetObject> <!--Windows:Defender: State modified via registry-->
 			<TargetObject name="T1089,Tamper-Defender" condition="begin with">HKLM\Software\Microsoft\Windows Defender\Exclusions</TargetObject> <!--Windows:Defender: State modified via registry-->
 			<TargetObject name="T1562,Tamper-Defender" condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender</TargetObject> <!--Windows:Defender: Monitor any modified via registry-->
diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index eb9f3a99..be3f834a 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -769,7 +769,13 @@
 			<TargetObject name="T1089,Tamper-Defender" condition="end with">\DisableAntiSpyware</TargetObject> <!--Windows:Defender: State modified via registry-->
 			<TargetObject name="T1089,Tamper-Defender" condition="end with">\DisableAntiVirus</TargetObject> <!--Windows:Defender: State modified via registry-->
 			<TargetObject name="T1089,Tamper-Defender" condition="end with">\SpynetReporting</TargetObject> <!--Windows:Defender: State modified via registry-->
-			<TargetObject name="T1089,Tamper-Defender" condition="end with">DisableRealtimeMonitoring</TargetObject> <!--Windows:Defender: State modified via registry-->
+			<TargetObject name="T1089,Tamper-Defender" condition="end with">\DisableRealtimeMonitoring</TargetObject> <!--Windows:Defender: State modified via registry-->
+			<TargetObject name="T1089,Tamper-Defender" condition="end with">\DisableBehaviorMonitoring</TargetObject> <!--Windows:Defender: State modified via registry-->
+			<TargetObject name="T1089,Tamper-Defender" condition="end with">\DisableIOAVProtection</TargetObject> <!--Windows:Defender: State modified via registry-->
+			<TargetObject name="T1089,Tamper-Defender" condition="end with">\DisableOnAccessProtection</TargetObject> <!--Windows:Defender: State modified via registry-->
+			<TargetObject name="T1089,Tamper-Defender" condition="end with">\DisableScanOnRealtimeEnable</TargetObject> <!--Windows:Defender: State modified via registry-->
+			<TargetObject name="T1089,Tamper-Defender" condition="end with">\Reporting\DisableEnhancedNotifications</TargetObject> <!--Windows:Defender: State modified via registry-->
+			<TargetObject name="T1089,Tamper-Defender" condition="end with">\SpyNet\DisableBlockAtFirstSeen</TargetObject> <!--Windows:Defender: State modified via registry-->
 			<TargetObject name="T1089,Tamper-Defender" condition="end with">\SubmitSamplesConsent</TargetObject> <!--Windows:Defender: State modified via registry-->
 			<TargetObject name="T1089,Tamper-Defender" condition="begin with">HKLM\Software\Microsoft\Windows Defender\Exclusions</TargetObject> <!--Windows:Defender: State modified via registry-->
 			<TargetObject name="T1562,Tamper-Defender" condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender</TargetObject> <!--Windows:Defender: Monitor any modified via registry-->
diff --git a/sysmonconfig-trace.xml b/sysmonconfig-trace.xml
index 5db4493f..0055b905 100644
--- a/sysmonconfig-trace.xml
+++ b/sysmonconfig-trace.xml
@@ -102,6 +102,9 @@
 				<Image condition="is">C:\Program Files\VMware\VMware Tools\TPAutoConnect.exe</Image>
 				<Image condition="is">C:\Program Files\Windows Defender\NisSrv.exe</Image>
 				<Image condition="is">C:\Program Files\Windows Defender\MsMpEng.exe</Image>
+				<Image condition="is">C:\Program Files\Aurora-Agent\aurora-agent-64.exe</Image>
+				<Image condition="is">C:\Program Files\Git\mingw64\bin\git.exe</Image>
+				<Image condition="is">C:\Program Files\Git\cmd\git.exe</Image>
 				<Image condition="end with">\onedrivesetup.exe</Image>
 				<Image condition="end with">\onedrive.exe</Image>
 				<Image condition="end with">\skypeapp.exe</Image>
@@ -158,6 +161,7 @@
 				<TargetImage condition="begin with">C:\Packages\Plugins\</TargetImage> <!--Azure ARM Extensions -->
 				<TargetImage condition="begin with">C:\WindowsAzure\</TargetImage> <!--Azure -->
 				<TargetImage condition="begin with">C:\Program Files\WindowsApps\</TargetImage>
+				<SourceImage condition="begin with">C:\Program Files\WindowsApps\</SourceImage>
 				<TargetImage condition="begin with">C:\Program Files\Windows Defender Advanced Threat Protection\</TargetImage>
 				<SourceImage condition="begin with">C:\Program Files\Windows Defender Advanced Threat Protection\</SourceImage>
 				<SourceImage condition="begin with">C:\ProgramData\Microsoft\Windows Defender\platform\</SourceImage>
@@ -170,6 +174,8 @@
 				<TargetImage condition="end with">\mmc.exe</TargetImage>
 				<TargetImage condition="end with">\Microsoft.Tri.Sensor.exe</TargetImage> <!-- Microsoft Defender for Identity Sensor -->
 				<TargetImage condition="end with">\Microsoft.Tri.Sensor.Updater.exe</TargetImage> <!-- Microsoft Defender for Identity Sensor -->
+				<SourceImage condition="end with">\AppData\Local\Programs\Microsoft VS Code\Code.exe</SourceImage>
+				<TargetImage condition="end with">\AppData\Local\Programs\Microsoft VS Code\Code.exe</TargetImage>
 				<Rule name="RuntimeBroker" groupRelation="and">
 					<SourceImage condition="is">C:\Windows\System32\RuntimeBroker.exe</SourceImage>
 					<TargetImage condition="is">C:\windows\Explorer.EXE</TargetImage>
@@ -229,7 +235,6 @@
 				<Image condition="end with">\Microsoft.Tri.Sensor.Updater.exe</Image> <!-- Microsoft Defender for Identity Sensor -->
 				<Image condition="end with">\TiWorker.exe</Image>
 				<Image condition="is">C:\Windows\system32\compattelrunner.exe</Image>
-				<Image condition="is">C:\Windows\Sysmon64.exe</Image>
 				<TargetObject condition="is">\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\Microsoft Print to PDF\PrinterDriverData</TargetObject>
 				<TargetObject condition="end with">\LanguageList</TargetObject>
 				<TargetObject condition="end with">\Windows.UI.SettingsAppThreshold.pri</TargetObject>

From f67d8d3d05ba098bddd3ec75dd23b6f87de37b6c Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Thu, 27 Oct 2022 01:31:57 +0200
Subject: [PATCH 111/149] Add missing backslashes in "end with"

---
 sysmonconfig-export-block.xml | 6 +++---
 sysmonconfig-export.xml       | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 5142dab1..32023409 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -338,7 +338,7 @@
 		<NetworkConnect onmatch="exclude">
 			<!--SECTION: Microsoft-->
 			<Image condition="begin with">C:\ProgramData\Microsoft\Windows Defender\Platform\</Image>
-			<Image condition="end with">AppData\Local\Microsoft\Teams\current\Teams.exe</Image> <!--Microsoft: Teams-->
+			<Image condition="end with">\AppData\Local\Microsoft\Teams\current\Teams.exe</Image> <!--Microsoft: Teams-->
 			<DestinationHostname condition="is">microsoft.com</DestinationHostname> <!--Microsoft:Update delivery-->
 			<DestinationHostname condition="end with">.microsoft.com</DestinationHostname> <!--Microsoft:Update delivery-->
 			<DestinationHostname condition="end with">microsoft.com.akadns.net</DestinationHostname> <!--Microsoft:Update delivery-->
@@ -645,7 +645,7 @@
 			<!--RDP-->
 			<TargetObject name="RDP port change" condition="end with">Control\Terminal Server\WinStations\RDP-Tcp\PortNumber</TargetObject> <!--Windows: RDP port change under Control [ https://blog.menasec.net/2019/02/of-rdp-hijacking-part1-remote-desktop.html ]-->
 			<TargetObject name="RDP port change" condition="end with">Control\Terminal Server\fSingleSessionPerUser</TargetObject> <!--Windows: Allow same user to have mutliple RDP sessions, to hide from admin being impersonated-->
-			<TargetObject name="ModifyRemoteDesktopState" condition="end with">fDenyTSConnections</TargetObject> <!--Windows: Attacker turning on RDP-->
+			<TargetObject name="ModifyRemoteDesktopState" condition="end with">\fDenyTSConnections</TargetObject> <!--Windows: Attacker turning on RDP-->
 			<TargetObject condition="end with">LastLoggedOnUser</TargetObject> <!--Windows: Changing last-logged in user-->
 			<TargetObject name="ModifyRemoteDesktopPort" condition="end with">RDP-tcp\PortNumber</TargetObject> <!--Windows: Changing RDP port to evade IDS-->
 			<TargetObject condition="end with">Services\PortProxy\v4tov4</TargetObject> <!--Windows: Changing RDP port to evade IDS-->
@@ -770,7 +770,7 @@
 			<TargetObject condition="contains">\Keyboard Layout\Preload</TargetObject> <!--Microsoft:Windows: Keyboard layout loaded into user session [ https://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index ] -->
 			<TargetObject condition="contains">\Keyboard Layout\Substitutes</TargetObject> <!--Microsoft:Windows: Keyboard layout loaded into user session [ https://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index ] -->
 			<!--Suspicious sources-->
-			<Image name="Suspicious,ImageBeginWithBackslash" condition="end with">regedit.exe</Image> <!--Users and helpdesk staff making system modifications -->
+			<Image name="Suspicious,ImageBeginWithBackslash" condition="end with">\regedit.exe</Image> <!--Users and helpdesk staff making system modifications -->
 			<Image name="Suspicious,ImageBeginWithBackslash" condition="begin with">\</Image> <!--Devices and VSC shouldn't be executing changes | Credit: @SBousseaden @ionstorm @neu5ron @PerchedSystems [ https://twitter.com/SwiftOnSecurity/status/1133167323991486464 ] -->
 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\</TargetObject> <!--Microsoft:Windows:UAC: Detect malware changes to UAC prompt level-->
 			<TargetObject condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\</TargetObject> <!--Microsoft:Defender: Detect changes to Defender administrative settings to monitor for disablement-->
diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index be3f834a..609ae997 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -382,7 +382,7 @@
 		<NetworkConnect onmatch="exclude">
 			<!--SECTION: Microsoft-->
 			<Image condition="begin with">C:\ProgramData\Microsoft\Windows Defender\Platform\</Image>
-			<Image condition="end with">AppData\Local\Microsoft\Teams\current\Teams.exe</Image> <!--Microsoft: Teams-->
+			<Image condition="end with">\AppData\Local\Microsoft\Teams\current\Teams.exe</Image> <!--Microsoft: Teams-->
 			<DestinationHostname condition="is">microsoft.com</DestinationHostname> <!--Microsoft:Update delivery-->
 			<DestinationHostname condition="end with">.microsoft.com</DestinationHostname> <!--Microsoft:Update delivery-->
 			<DestinationHostname condition="end with">microsoft.com.akadns.net</DestinationHostname> <!--Microsoft:Update delivery-->
@@ -687,7 +687,7 @@
 			<!--RDP-->
 			<TargetObject name="RDP port change" condition="end with">Control\Terminal Server\WinStations\RDP-Tcp\PortNumber</TargetObject> <!--Windows: RDP port change under Control [ https://blog.menasec.net/2019/02/of-rdp-hijacking-part1-remote-desktop.html ]-->
 			<TargetObject name="RDP port change" condition="end with">Control\Terminal Server\fSingleSessionPerUser</TargetObject> <!--Windows: Allow same user to have mutliple RDP sessions, to hide from admin being impersonated-->
-			<TargetObject name="ModifyRemoteDesktopState" condition="end with">fDenyTSConnections</TargetObject> <!--Windows: Attacker turning on RDP-->
+			<TargetObject name="ModifyRemoteDesktopState" condition="end with">\fDenyTSConnections</TargetObject> <!--Windows: Attacker turning on RDP-->
 			<TargetObject condition="end with">LastLoggedOnUser</TargetObject> <!--Windows: Changing last-logged in user-->
 			<TargetObject name="ModifyRemoteDesktopPort" condition="end with">RDP-tcp\PortNumber</TargetObject> <!--Windows: Changing RDP port to evade IDS-->
 			<TargetObject condition="end with">Services\PortProxy\v4tov4</TargetObject> <!--Windows: Changing RDP port to evade IDS-->
@@ -812,7 +812,7 @@
 			<TargetObject condition="contains">\Keyboard Layout\Preload</TargetObject> <!--Microsoft:Windows: Keyboard layout loaded into user session [ https://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index ] -->
 			<TargetObject condition="contains">\Keyboard Layout\Substitutes</TargetObject> <!--Microsoft:Windows: Keyboard layout loaded into user session [ https://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index ] -->
 			<!--Suspicious sources-->
-			<Image name="Suspicious,ImageBeginWithBackslash" condition="end with">regedit.exe</Image> <!--Users and helpdesk staff making system modifications -->
+			<Image name="Suspicious,ImageBeginWithBackslash" condition="end with">\regedit.exe</Image> <!--Users and helpdesk staff making system modifications -->
 			<Image name="Suspicious,ImageBeginWithBackslash" condition="begin with">\</Image> <!--Devices and VSC shouldn't be executing changes | Credit: @SBousseaden @ionstorm @neu5ron @PerchedSystems [ https://twitter.com/SwiftOnSecurity/status/1133167323991486464 ] -->
 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\</TargetObject> <!--Microsoft:Windows:UAC: Detect malware changes to UAC prompt level-->
 			<TargetObject condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\</TargetObject> <!--Microsoft:Defender: Detect changes to Defender administrative settings to monitor for disablement-->

From 834388e5fad0f958f2e4141d9e1b6ff4d4cbe771 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Sun, 4 Dec 2022 14:25:36 +0100
Subject: [PATCH 112/149] feat: include SysmonEOP.exe blocks

---
 sysmonconfig-export-block.xml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 3f80dc28..a6dfa2f5 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -6,7 +6,7 @@
 	WARNING: THIS CONFIG INCLUDES BLOCKING RULES THAT MAY CAUSE ISSUES ENDSYSTEMS!
 	         Test this configuration intensively before using it on productive systems
 
-	LAST CHANGE: 18.08.2022
+	LAST CHANGE: 04.12.2022
 
 	REQUIRED: Sysmon version 14 or higher (due to changes in syntax and bug-fixes)
 		https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
@@ -1378,6 +1378,7 @@
 			<TargetFilename condition="end with">\SysmonQuiet.exe</TargetFilename>
 			<TargetFilename condition="end with">\SharpEvtMute.exe</TargetFilename>
 			<TargetFilename condition="end with">\EvtMuteHook.dll</TargetFilename>
+			<TargetFilename condition="end with">\SysmonEOP.exe</TargetFilename>
 
 			<!-- Hacktool Blocks based on Imphashes -->
 			<Hashes condition="contains">IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932</Hashes> <!-- PetitPotam -->
@@ -1466,6 +1467,8 @@
 			<Hashes condition="contains">IMPHASH=E57401FBDADCD4571FF385AB82BD5D6D</Hashes> <!-- Dumpert -->
 			<Hashes condition="contains">IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE</Hashes> <!-- SysmonEnte -->
 			<Hashes condition="contains">IMPHASH=19584675D94829987952432E018D5056</Hashes> <!-- SysmonQuiet -->
+			<Hashes condition="contains">IMPHASH=22F4089EB8ABA31E1BB162C6D9BF72E5</Hashes> <!-- SysmonEOP exploiting CVE-2022-41120 -->
+			<Hashes condition="contains">IMPHASH=5123FA4C4384D431CD0D893EEB49BBEC</Hashes> <!-- SysmonEOP exploiting CVE-2022-41120 -->
 			<Hashes condition="contains">MD5=7B17F15713FCF13C764535AA2BDF52AA</Hashes>													<!-- ShaprEvtMute -->
 			<Hashes condition="contains">SHA1=4E18320493042BCD7D21B53E258974BC460ACC78</Hashes>										<!-- ShaprEvtMute -->
 			<Hashes condition="contains">SHA256=477DFE485F5BD9540CC83E88FC04AAFB6DE49CF1ADC6BD857D5D6F4C1730A6D1</Hashes>	<!-- ShaprEvtMute -->

From 47aed63699cf8534710c89d847dc2e7a82e8c58a Mon Sep 17 00:00:00 2001
From: frack113 <62423083+frack113@users.noreply.github.com>
Date: Fri, 13 Jan 2023 12:24:51 +0100
Subject: [PATCH 113/149] Exclude aurora agent

---
 sysmonconfig-export-block.xml | 1 +
 sysmonconfig-export.xml       | 1 +
 sysmonconfig-trace.xml        | 1 +
 3 files changed, 3 insertions(+)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 80a0daf7..a8b398df 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -474,6 +474,7 @@
 
 	<RuleGroup name="" groupRelation="or">
 		<ProcessAccess onmatch="exclude">
+			<SourceImage condition="contains any">aurora-agent.exe;aurora-agent-64.exe</SourceImage>
 			<!-- NOTE: Potentially noisy ProcessAccess Events in your environment can be excluded here -->
 		</ProcessAccess>
 	</RuleGroup>
diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 609ae997..b5b761da 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -516,6 +516,7 @@
 
 	<RuleGroup name="" groupRelation="or">
 		<ProcessAccess onmatch="exclude">
+			<SourceImage condition="contains any">aurora-agent.exe;aurora-agent-64.exe</SourceImage>
 			<!-- NOTE: Potentially noisy ProcessAccess Events in your environment can be excluded here -->
 		</ProcessAccess>
 	</RuleGroup>
diff --git a/sysmonconfig-trace.xml b/sysmonconfig-trace.xml
index 0055b905..56d65858 100644
--- a/sysmonconfig-trace.xml
+++ b/sysmonconfig-trace.xml
@@ -190,6 +190,7 @@
 				<SourceImage condition="end with">\Ninite.exe</SourceImage>
 				<TargetImage condition="end with">\Ninite.exe</TargetImage>
 				<GrantedAccess condition="is">0x1000</GrantedAccess>
+				<SourceImage condition="contains any">aurora-agent.exe;aurora-agent-64.exe</SourceImage>
 			</ProcessAccess>
 		</RuleGroup>
 		<RuleGroup name="" groupRelation="or">

From f78b00c0c587f250689e0d520b53d6cd51232c70 Mon Sep 17 00:00:00 2001
From: frack113 <62423083+frack113@users.noreply.github.com>
Date: Fri, 13 Jan 2023 12:29:02 +0100
Subject: [PATCH 114/149] Exclude aurora agent x86

---
 sysmonconfig-trace.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sysmonconfig-trace.xml b/sysmonconfig-trace.xml
index 56d65858..5770a8aa 100644
--- a/sysmonconfig-trace.xml
+++ b/sysmonconfig-trace.xml
@@ -138,6 +138,7 @@
 				<SourceImage condition="image">Sysmon64.exe</SourceImage>
 				<SourceImage condition="image">GoogleUpdate.exe</SourceImage>
 				<SourceImage condition="image">aurora-agent-64.exe</SourceImage>
+				<SourceImage condition="image">aurora-agent.exe</SourceImage>
 				<SourceImage condition="end with">\Google\Chrome\Application\chrome.exe</SourceImage>
 				<SourceImage condition="is">C:\Program Files\Windows Defender\MsMpEng.exe</SourceImage>
 				<Rule name="MsMpEngVersion" groupRelation="and">
@@ -190,7 +191,6 @@
 				<SourceImage condition="end with">\Ninite.exe</SourceImage>
 				<TargetImage condition="end with">\Ninite.exe</TargetImage>
 				<GrantedAccess condition="is">0x1000</GrantedAccess>
-				<SourceImage condition="contains any">aurora-agent.exe;aurora-agent-64.exe</SourceImage>
 			</ProcessAccess>
 		</RuleGroup>
 		<RuleGroup name="" groupRelation="or">

From c2e2f1301433f12548596c0cf0d073ec95e00181 Mon Sep 17 00:00:00 2001
From: frack113 <62423083+frack113@users.noreply.github.com>
Date: Fri, 13 Jan 2023 12:50:57 +0100
Subject: [PATCH 115/149] Exclude aurora agent path

---
 sysmonconfig-export-block.xml | 3 ++-
 sysmonconfig-export.xml       | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index a8b398df..a72d2633 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -474,7 +474,8 @@
 
 	<RuleGroup name="" groupRelation="or">
 		<ProcessAccess onmatch="exclude">
-			<SourceImage condition="contains any">aurora-agent.exe;aurora-agent-64.exe</SourceImage>
+			<SourceImage condition="image">C:\Program Files\Aurora-Agent\aurora-agent.exe</SourceImage>
+			<SourceImage condition="image">C:\Program Files\Aurora-Agent\aurora-agent-64.exe</SourceImage>
 			<!-- NOTE: Potentially noisy ProcessAccess Events in your environment can be excluded here -->
 		</ProcessAccess>
 	</RuleGroup>
diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index b5b761da..b63d27e9 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -516,7 +516,8 @@
 
 	<RuleGroup name="" groupRelation="or">
 		<ProcessAccess onmatch="exclude">
-			<SourceImage condition="contains any">aurora-agent.exe;aurora-agent-64.exe</SourceImage>
+			<SourceImage condition="image">C:\Program Files\Aurora-Agent\aurora-agent.exe</SourceImage>
+			<SourceImage condition="image">C:\Program Files\Aurora-Agent\aurora-agent-64.exe</SourceImage>
 			<!-- NOTE: Potentially noisy ProcessAccess Events in your environment can be excluded here -->
 		</ProcessAccess>
 	</RuleGroup>

From 2dff95f0e118b81950991f7ea9b392d9651f8244 Mon Sep 17 00:00:00 2001
From: phantinuss <79651203+phantinuss@users.noreply.github.com>
Date: Fri, 13 Jan 2023 13:11:45 +0100
Subject: [PATCH 116/149] chore: remove boilerplate text (1)

---
 sysmonconfig-export-block.xml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index a72d2633..6ed28d0b 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -476,7 +476,6 @@
 		<ProcessAccess onmatch="exclude">
 			<SourceImage condition="image">C:\Program Files\Aurora-Agent\aurora-agent.exe</SourceImage>
 			<SourceImage condition="image">C:\Program Files\Aurora-Agent\aurora-agent-64.exe</SourceImage>
-			<!-- NOTE: Potentially noisy ProcessAccess Events in your environment can be excluded here -->
 		</ProcessAccess>
 	</RuleGroup>
 

From 5e7c3173577fe96cd81bb2c5eb6a6d1ab0a6c79a Mon Sep 17 00:00:00 2001
From: phantinuss <79651203+phantinuss@users.noreply.github.com>
Date: Fri, 13 Jan 2023 13:12:13 +0100
Subject: [PATCH 117/149] chore: remove boilerplate text (2)

---
 sysmonconfig-export.xml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index b63d27e9..a3233242 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -518,7 +518,6 @@
 		<ProcessAccess onmatch="exclude">
 			<SourceImage condition="image">C:\Program Files\Aurora-Agent\aurora-agent.exe</SourceImage>
 			<SourceImage condition="image">C:\Program Files\Aurora-Agent\aurora-agent-64.exe</SourceImage>
-			<!-- NOTE: Potentially noisy ProcessAccess Events in your environment can be excluded here -->
 		</ProcessAccess>
 	</RuleGroup>
 

From ee64e180222522551f19b60565ad1abf8788218a Mon Sep 17 00:00:00 2001
From: frack113 <62423083+frack113@users.noreply.github.com>
Date: Fri, 13 Jan 2023 13:28:27 +0100
Subject: [PATCH 118/149] Apply suggestions from code review

Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
---
 sysmonconfig-export-block.xml | 4 ++--
 sysmonconfig-export.xml       | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 6ed28d0b..8f53412f 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -474,8 +474,8 @@
 
 	<RuleGroup name="" groupRelation="or">
 		<ProcessAccess onmatch="exclude">
-			<SourceImage condition="image">C:\Program Files\Aurora-Agent\aurora-agent.exe</SourceImage>
-			<SourceImage condition="image">C:\Program Files\Aurora-Agent\aurora-agent-64.exe</SourceImage>
+			<SourceImage condition="is">C:\Program Files\Aurora-Agent\aurora-agent.exe</SourceImage>
+			<SourceImage condition="is">C:\Program Files\Aurora-Agent\aurora-agent-64.exe</SourceImage>
 		</ProcessAccess>
 	</RuleGroup>
 
diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index a3233242..92a5034c 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -516,8 +516,8 @@
 
 	<RuleGroup name="" groupRelation="or">
 		<ProcessAccess onmatch="exclude">
-			<SourceImage condition="image">C:\Program Files\Aurora-Agent\aurora-agent.exe</SourceImage>
-			<SourceImage condition="image">C:\Program Files\Aurora-Agent\aurora-agent-64.exe</SourceImage>
+			<SourceImage condition="is">C:\Program Files\Aurora-Agent\aurora-agent.exe</SourceImage>
+			<SourceImage condition="is">C:\Program Files\Aurora-Agent\aurora-agent-64.exe</SourceImage>
 		</ProcessAccess>
 	</RuleGroup>
 

From 4348699acff71afe0f6f8485c479e9546789bbc9 Mon Sep 17 00:00:00 2001
From: phantinuss <79651203+phantinuss@users.noreply.github.com>
Date: Fri, 13 Jan 2023 14:23:08 +0100
Subject: [PATCH 119/149] chore: workflow: switch python3 with nodejs installer
 as test data

---
 .github/workflows/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index cf31f6ad..9102e321 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -84,7 +84,7 @@ jobs:
       run: Get-WinEvent -ListLog Microsoft-Windows-Sysmon*
 
     - name: Install some Choco Packages
-      run: choco install ninja adobereader googlechrome firefox python3
+      run: choco install ninja adobereader googlechrome firefox nodejs
 
     - name: Download User Sim
       run: Invoke-WebRequest https://github.com/humpalum/sim-user/releases/download/latest/5minuser.exe  -OutFile .\5minuser.exe

From a3014ed573700dca8652e95095fc8e961b982563 Mon Sep 17 00:00:00 2001
From: phantinuss <79651203+phantinuss@users.noreply.github.com>
Date: Fri, 13 Jan 2023 14:27:52 +0100
Subject: [PATCH 120/149] chore: workflow: update to node16

---
 .github/workflows/main.yml | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 9102e321..ed2cc487 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -15,8 +15,8 @@ jobs:
   msbuild:
     runs-on: 'windows-latest'
     steps:
-    - name: Checkout open-sysmon-conf
-      uses: actions/checkout@v2
+    - name: Checkout sysmon-config
+      uses: actions/checkout@v3
 
     - name: Download Sysmon
       run: Invoke-WebRequest http://live.sysinternals.com/tools/sysmon.exe -OutFile .\sysmon.exe
@@ -33,8 +33,8 @@ jobs:
   msbuild-trace:
     runs-on: 'windows-latest'
     steps:
-    - name: Checkout open-sysmon-conf
-      uses: actions/checkout@v2
+    - name: Checkout sysmon-config
+      uses: actions/checkout@v3
 
     - name: Download Sysmon
       run: Invoke-WebRequest http://live.sysinternals.com/tools/sysmon.exe -OutFile .\sysmon.exe
@@ -51,8 +51,8 @@ jobs:
   msbuild-block:
     runs-on: 'windows-latest'
     steps:
-    - name: Checkout open-sysmon-conf
-      uses: actions/checkout@v2
+    - name: Checkout sysmon-config
+      uses: actions/checkout@v3
 
     - name: Download Sysmon
       run: Invoke-WebRequest http://live.sysinternals.com/tools/sysmon.exe -OutFile .\sysmon.exe
@@ -69,8 +69,8 @@ jobs:
   busySystem:
     runs-on: 'windows-latest'
     steps:
-    - name: Checkout open-sysmon-conf
-      uses: actions/checkout@v2
+    - name: Checkout sysmon-config
+      uses: actions/checkout@v3
 
     - name: Download Sysmon
       run: Invoke-WebRequest http://live.sysinternals.com/tools/sysmon.exe -OutFile .\sysmon.exe

From ddc07ee4a3a485481f869e2bde33dff094d2f47e Mon Sep 17 00:00:00 2001
From: frack113 <62423083+frack113@users.noreply.github.com>
Date: Fri, 13 Jan 2023 12:24:51 +0100
Subject: [PATCH 121/149] Exclude aurora agent

---
 sysmonconfig-export-block.xml | 1 +
 sysmonconfig-export.xml       | 1 +
 sysmonconfig-trace.xml        | 1 +
 3 files changed, 3 insertions(+)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 80a0daf7..a8b398df 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -474,6 +474,7 @@
 
 	<RuleGroup name="" groupRelation="or">
 		<ProcessAccess onmatch="exclude">
+			<SourceImage condition="contains any">aurora-agent.exe;aurora-agent-64.exe</SourceImage>
 			<!-- NOTE: Potentially noisy ProcessAccess Events in your environment can be excluded here -->
 		</ProcessAccess>
 	</RuleGroup>
diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 609ae997..b5b761da 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -516,6 +516,7 @@
 
 	<RuleGroup name="" groupRelation="or">
 		<ProcessAccess onmatch="exclude">
+			<SourceImage condition="contains any">aurora-agent.exe;aurora-agent-64.exe</SourceImage>
 			<!-- NOTE: Potentially noisy ProcessAccess Events in your environment can be excluded here -->
 		</ProcessAccess>
 	</RuleGroup>
diff --git a/sysmonconfig-trace.xml b/sysmonconfig-trace.xml
index 0055b905..56d65858 100644
--- a/sysmonconfig-trace.xml
+++ b/sysmonconfig-trace.xml
@@ -190,6 +190,7 @@
 				<SourceImage condition="end with">\Ninite.exe</SourceImage>
 				<TargetImage condition="end with">\Ninite.exe</TargetImage>
 				<GrantedAccess condition="is">0x1000</GrantedAccess>
+				<SourceImage condition="contains any">aurora-agent.exe;aurora-agent-64.exe</SourceImage>
 			</ProcessAccess>
 		</RuleGroup>
 		<RuleGroup name="" groupRelation="or">

From 120c110a1e868a5f8713f25a588ab9486204eb66 Mon Sep 17 00:00:00 2001
From: frack113 <62423083+frack113@users.noreply.github.com>
Date: Fri, 13 Jan 2023 12:29:02 +0100
Subject: [PATCH 122/149] Exclude aurora agent x86

---
 sysmonconfig-trace.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sysmonconfig-trace.xml b/sysmonconfig-trace.xml
index 56d65858..5770a8aa 100644
--- a/sysmonconfig-trace.xml
+++ b/sysmonconfig-trace.xml
@@ -138,6 +138,7 @@
 				<SourceImage condition="image">Sysmon64.exe</SourceImage>
 				<SourceImage condition="image">GoogleUpdate.exe</SourceImage>
 				<SourceImage condition="image">aurora-agent-64.exe</SourceImage>
+				<SourceImage condition="image">aurora-agent.exe</SourceImage>
 				<SourceImage condition="end with">\Google\Chrome\Application\chrome.exe</SourceImage>
 				<SourceImage condition="is">C:\Program Files\Windows Defender\MsMpEng.exe</SourceImage>
 				<Rule name="MsMpEngVersion" groupRelation="and">
@@ -190,7 +191,6 @@
 				<SourceImage condition="end with">\Ninite.exe</SourceImage>
 				<TargetImage condition="end with">\Ninite.exe</TargetImage>
 				<GrantedAccess condition="is">0x1000</GrantedAccess>
-				<SourceImage condition="contains any">aurora-agent.exe;aurora-agent-64.exe</SourceImage>
 			</ProcessAccess>
 		</RuleGroup>
 		<RuleGroup name="" groupRelation="or">

From b427c6c80b28966b2025bbc2e430f5a97b747cf1 Mon Sep 17 00:00:00 2001
From: frack113 <62423083+frack113@users.noreply.github.com>
Date: Fri, 13 Jan 2023 12:50:57 +0100
Subject: [PATCH 123/149] Exclude aurora agent path

---
 sysmonconfig-export-block.xml | 3 ++-
 sysmonconfig-export.xml       | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index a8b398df..a72d2633 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -474,7 +474,8 @@
 
 	<RuleGroup name="" groupRelation="or">
 		<ProcessAccess onmatch="exclude">
-			<SourceImage condition="contains any">aurora-agent.exe;aurora-agent-64.exe</SourceImage>
+			<SourceImage condition="image">C:\Program Files\Aurora-Agent\aurora-agent.exe</SourceImage>
+			<SourceImage condition="image">C:\Program Files\Aurora-Agent\aurora-agent-64.exe</SourceImage>
 			<!-- NOTE: Potentially noisy ProcessAccess Events in your environment can be excluded here -->
 		</ProcessAccess>
 	</RuleGroup>
diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index b5b761da..b63d27e9 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -516,7 +516,8 @@
 
 	<RuleGroup name="" groupRelation="or">
 		<ProcessAccess onmatch="exclude">
-			<SourceImage condition="contains any">aurora-agent.exe;aurora-agent-64.exe</SourceImage>
+			<SourceImage condition="image">C:\Program Files\Aurora-Agent\aurora-agent.exe</SourceImage>
+			<SourceImage condition="image">C:\Program Files\Aurora-Agent\aurora-agent-64.exe</SourceImage>
 			<!-- NOTE: Potentially noisy ProcessAccess Events in your environment can be excluded here -->
 		</ProcessAccess>
 	</RuleGroup>

From 353f14188e277ea87f345f8ff4834c58beb3579d Mon Sep 17 00:00:00 2001
From: phantinuss <79651203+phantinuss@users.noreply.github.com>
Date: Fri, 13 Jan 2023 13:11:45 +0100
Subject: [PATCH 124/149] chore: remove boilerplate text (1)

---
 sysmonconfig-export-block.xml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index a72d2633..6ed28d0b 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -476,7 +476,6 @@
 		<ProcessAccess onmatch="exclude">
 			<SourceImage condition="image">C:\Program Files\Aurora-Agent\aurora-agent.exe</SourceImage>
 			<SourceImage condition="image">C:\Program Files\Aurora-Agent\aurora-agent-64.exe</SourceImage>
-			<!-- NOTE: Potentially noisy ProcessAccess Events in your environment can be excluded here -->
 		</ProcessAccess>
 	</RuleGroup>
 

From ccd5e5a3e4a0296f898e7507a4cf4ab52ce788aa Mon Sep 17 00:00:00 2001
From: phantinuss <79651203+phantinuss@users.noreply.github.com>
Date: Fri, 13 Jan 2023 13:12:13 +0100
Subject: [PATCH 125/149] chore: remove boilerplate text (2)

---
 sysmonconfig-export.xml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index b63d27e9..a3233242 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -518,7 +518,6 @@
 		<ProcessAccess onmatch="exclude">
 			<SourceImage condition="image">C:\Program Files\Aurora-Agent\aurora-agent.exe</SourceImage>
 			<SourceImage condition="image">C:\Program Files\Aurora-Agent\aurora-agent-64.exe</SourceImage>
-			<!-- NOTE: Potentially noisy ProcessAccess Events in your environment can be excluded here -->
 		</ProcessAccess>
 	</RuleGroup>
 

From 935685e5b2689a6e1bbe81bbf4ccebff92d45a91 Mon Sep 17 00:00:00 2001
From: frack113 <62423083+frack113@users.noreply.github.com>
Date: Fri, 13 Jan 2023 13:28:27 +0100
Subject: [PATCH 126/149] Apply suggestions from code review

Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
---
 sysmonconfig-export-block.xml | 4 ++--
 sysmonconfig-export.xml       | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 6ed28d0b..8f53412f 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -474,8 +474,8 @@
 
 	<RuleGroup name="" groupRelation="or">
 		<ProcessAccess onmatch="exclude">
-			<SourceImage condition="image">C:\Program Files\Aurora-Agent\aurora-agent.exe</SourceImage>
-			<SourceImage condition="image">C:\Program Files\Aurora-Agent\aurora-agent-64.exe</SourceImage>
+			<SourceImage condition="is">C:\Program Files\Aurora-Agent\aurora-agent.exe</SourceImage>
+			<SourceImage condition="is">C:\Program Files\Aurora-Agent\aurora-agent-64.exe</SourceImage>
 		</ProcessAccess>
 	</RuleGroup>
 
diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index a3233242..92a5034c 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -516,8 +516,8 @@
 
 	<RuleGroup name="" groupRelation="or">
 		<ProcessAccess onmatch="exclude">
-			<SourceImage condition="image">C:\Program Files\Aurora-Agent\aurora-agent.exe</SourceImage>
-			<SourceImage condition="image">C:\Program Files\Aurora-Agent\aurora-agent-64.exe</SourceImage>
+			<SourceImage condition="is">C:\Program Files\Aurora-Agent\aurora-agent.exe</SourceImage>
+			<SourceImage condition="is">C:\Program Files\Aurora-Agent\aurora-agent-64.exe</SourceImage>
 		</ProcessAccess>
 	</RuleGroup>
 

From 9e25076b687fa31af8c585c5df8168796070f91b Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Fri, 10 Feb 2023 00:05:40 +0100
Subject: [PATCH 127/149] feat: add onenote app to blocklist

---
 sysmonconfig-export-block.xml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 8f53412f..ee871a28 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -1493,6 +1493,11 @@
 			<Image condition="image">wordview.exe</Image>
 			<Image condition="image">msohtmed.exe</Image>
 			
+			<!-- OneNote Application Dropping Executables -->
+			<Image condition="image">onenote.exe</Image>
+			<Image condition="image">onenotem.exe</Image>
+			<Image condition="image">onenoteim.exe</Image>
+			
 			<!-- LOLBINs that can be used to download executables -->
 			<Image condition="image">certutil.exe</Image>
 			<Image condition="image">certoc.exe</Image>

From ae41115c861e28c9a6da9af79b886c3fa1440a51 Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Wed, 12 Apr 2023 04:13:29 +0200
Subject: [PATCH 128/149] Fixes #48

---
 sysmonconfig-trace.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sysmonconfig-trace.xml b/sysmonconfig-trace.xml
index 5770a8aa..8796d9e1 100644
--- a/sysmonconfig-trace.xml
+++ b/sysmonconfig-trace.xml
@@ -236,7 +236,7 @@
 				<Image condition="end with">\Microsoft.Tri.Sensor.Updater.exe</Image> <!-- Microsoft Defender for Identity Sensor -->
 				<Image condition="end with">\TiWorker.exe</Image>
 				<Image condition="is">C:\Windows\system32\compattelrunner.exe</Image>
-				<TargetObject condition="is">\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\Microsoft Print to PDF\PrinterDriverData</TargetObject>
+				<TargetObject condition="end with">\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\Microsoft Print to PDF\PrinterDriverData</TargetObject>
 				<TargetObject condition="end with">\LanguageList</TargetObject>
 				<TargetObject condition="end with">\Windows.UI.SettingsAppThreshold.pri</TargetObject>
 				<TargetObject condition="end with">\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications</TargetObject>

From 1276443f635bf034d754d716f8294cad49575848 Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Wed, 12 Apr 2023 04:14:28 +0200
Subject: [PATCH 129/149] Fixes #49

---
 sysmonconfig-trace.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sysmonconfig-trace.xml b/sysmonconfig-trace.xml
index 8796d9e1..d2c3286c 100644
--- a/sysmonconfig-trace.xml
+++ b/sysmonconfig-trace.xml
@@ -12,7 +12,7 @@
    <!-- Capture all hashes -->
    <HashAlgorithms>*</HashAlgorithms>
    <DnsLookup>False</DnsLookup>
-   <ArchiveDirectory>Archive</ArchiveDirectory>
+   <!-- <ArchiveDirectory>Archive</ArchiveDirectory> -->
    <CaptureClipboard/>
    <EventFiltering>
    		<RuleGroup name="" groupRelation="or">

From 0dc42ba746473d7acd58aaa8ca112321a3b7d699 Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Wed, 12 Apr 2023 04:16:08 +0200
Subject: [PATCH 130/149] Fixes #43

---
 sysmonconfig-export-block.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index ee871a28..98e8d102 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -1512,7 +1512,7 @@
 			<!-- Executables that should never drop an executable to disk (but may after a previous process injection or if it's malware that uses a legitimate name)-->
 			<Image condition="image">notepad.exe</Image>
 			<Image condition="image">AcroRd32.exe</Image>
-			<Image condition="image">RdrCEF.exe</Image>
+			<Image condition="image">RdrCEF.exe</Image> <!-- RdrCEF was seen dropping a DLL in temp (Example: \AppData\Local\Temp\acrocef_low\4616_1623006624_platform_specific\win_x86\widevinecdm.dll). Comment out this entry if you experience issues (https://github.com/Neo23x0/sysmon-config/issues/43) -->
 			<Image condition="image">mshta.exe</Image>
 			<Image condition="image">hh.exe</Image>
 			<Image condition="image">calc.exe</Image>

From 9718f92091cbd622fb49bb3b2e0e0536dd335334 Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Wed, 12 Apr 2023 04:56:53 +0200
Subject: [PATCH 131/149] Fixes #50

---
 sysmonconfig-export-block.xml | 6 ++++++
 sysmonconfig-export.xml       | 7 +++++++
 2 files changed, 13 insertions(+)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 98e8d102..97c8daba 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -246,6 +246,8 @@
 			<!--Suspicious Windows tools-->
 			<Image condition="image">at.exe</Image> <!--Windows: Remote task scheduling, removed in Win10 | Credit @ion-storm -->
 			<Image condition="image">certutil.exe</Image> <!--Windows: Certificate tool can contact outbound | Credit @ion-storm @FVT [ https://twitter.com/FVT/status/834433734602530817 ] -->
+			<Image condition="image">calc.exe</Image>
+			<Image condition="image">CalculatorApp.exe</Image>
 			<Image condition="image">cmd.exe</Image> <!--Windows: Remote command prompt-->
 			<Image condition="image">cmstp.exe</Image> <!--Windows: Connection manager profiles can launch executables from WebDAV [ https://twitter.com/NickTyrer/status/958450014111633408 ] | Credit @NickTyrer @Oddvarmoe @KyleHanslovan @subTee -->
 			<Image condition="image">cscript.exe</Image> <!--WindowsScriptingHost: | Credit @Cyb3rOps [ https://gist.github.com/Neo23x0/a4b4af9481e01e749409 ] -->
@@ -265,6 +267,7 @@
 			<Image condition="image">net1.exe</Image> <!--Windows: Launched by "net.exe", but it may not detect connections either -->
 			<Image condition="image">notepad.exe</Image> <!--Windows: [ https://secrary.com/ReversingMalware/CoinMiner/ ] [ https://blog.cobaltstrike.com/2013/08/08/why-is-notepad-exe-connecting-to-the-internet/ ] -->
 			<Image condition="image">nslookup.exe</Image> <!--Windows: Retrieve data over DNS -->
+			<Image condition="image">pwsh.exe</Image> <!--Windows: PowerShell 7 -->
 			<Image condition="image">powershell.exe</Image> <!--Windows: PowerShell interface-->
 			<Image condition="image">powershell_ise.exe</Image> <!--Windows: PowerShell interface-->
 			<Image condition="image">qprocess.exe</Image> <!--Windows: [ https://www.first.org/resources/papers/conf2017/APT-Log-Analysis-Tracking-Attack-Tools-by-Audit-Policy-and-Sysmon.pdf ] -->
@@ -491,6 +494,7 @@
 			<TargetFilename name="T1165" condition="contains">\Startup\</TargetFilename> <!--Microsoft:Changes to user's auto-launched files and shortcuts-->
 			<TargetFilename name="OutlookAttachment" condition="contains">\Content.Outlook\</TargetFilename> <!--Microsoft:Outlook: attachments-->
 			<TargetFilename name="Downloads" condition="contains">\Downloads\</TargetFilename> <!--Downloaded files. Does not include "Run" files in IE-->
+			<TargetFilename name="Public" condition="contains">C:\Users\Public\</TargetFilename>
 			<TargetFilename name="T1176" condition="end with">.crx</TargetFilename> <!--Chrome extension-->
 			<TargetFilename condition="end with">.application</TargetFilename> <!--Microsoft:ClickOnce: [ https://blog.netspi.com/all-you-need-is-one-a-clickonce-love-story/ ] -->
 			<TargetFilename condition="end with">.appref-ms</TargetFilename> <!--Microsoft:ClickOnce application | Credit @ion-storm -->
@@ -504,6 +508,7 @@
 			<TargetFilename condition="end with">.dll</TargetFilename> <!--Microsoft:Office:Word: Macro-->
 			<TargetFilename condition="end with">.dmg</TargetFilename> <!--Phishing-->
 			<TargetFilename condition="end with">.dmp</TargetFilename> <!--Process dumps [ (fr) http://blog.gentilkiwi.com/securite/mimikatz/minidump ] -->
+			<TargetFilename condition="end with">.dump</TargetFilename>
 			<TargetFilename condition="end with">.docm</TargetFilename> <!--Microsoft:Office:Word: Macro-->
 			<TargetFilename condition="end with">.exe.log</TargetFilename> <!-- [ https://github.com/bitsadmin/nopowershell ] | Credit: @SBousseaden [ https://twitter.com/SBousseaden/status/1137493597769687040 ] -->
 			<TargetFilename condition="end with">.exe</TargetFilename> <!--Executable-->
@@ -551,6 +556,7 @@
 			<TargetFilename condition="begin with">C:\Windows\SysWOW64\Wbem</TargetFilename> <!--Microsoft:WMI: [ More information: http://2014.hackitoergosum.org/slides/day1_WMI_Shell_Andrei_Dumitrescu.pdf ] -->
 			<TargetFilename condition="begin with">C:\Windows\system32\WindowsPowerShell</TargetFilename> <!--Microsoft:Powershell: Look for modifications for persistence [ https://www.malwarearchaeology.com/cheat-sheets ] -->
 			<TargetFilename condition="begin with">C:\Windows\SysWOW64\WindowsPowerShell</TargetFilename> <!--Microsoft:Powershell: Look for modifications for persistence [ https://www.malwarearchaeology.com/cheat-sheets ] -->
+			<TargetFilename condition="begin with">C:\Program Files\PowerShell\7\</TargetFilename>
 			<TargetFilename name="T1053" condition="begin with">C:\Windows\Tasks\</TargetFilename> <!--Microsoft:ScheduledTasks [ https://attack.mitre.org/wiki/Technique/T1053 ] -->
 			<TargetFilename name="T1053" condition="begin with">C:\Windows\system32\Tasks</TargetFilename> <!--Microsoft:ScheduledTasks [ https://attack.mitre.org/wiki/Technique/T1053 ] -->
 			<TargetFilename name="T1053" condition="begin with">C:\Windows\SysWOW64\Tasks</TargetFilename> <!--Microsoft:ScheduledTasks [ https://attack.mitre.org/wiki/Technique/T1053 ] -->
diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 92a5034c..156ffbcb 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -290,6 +290,8 @@
 			<!--Suspicious Windows tools-->
 			<Image condition="image">at.exe</Image> <!--Windows: Remote task scheduling, removed in Win10 | Credit @ion-storm -->
 			<Image condition="image">certutil.exe</Image> <!--Windows: Certificate tool can contact outbound | Credit @ion-storm @FVT [ https://twitter.com/FVT/status/834433734602530817 ] -->
+			<Image condition="image">calc.exe</Image>
+			<Image condition="image">CalculatorApp.exe</Image>
 			<Image condition="image">cmd.exe</Image> <!--Windows: Remote command prompt-->
 			<Image condition="image">cmstp.exe</Image> <!--Windows: Connection manager profiles can launch executables from WebDAV [ https://twitter.com/NickTyrer/status/958450014111633408 ] | Credit @NickTyrer @Oddvarmoe @KyleHanslovan @subTee -->
 			<Image condition="image">cscript.exe</Image> <!--WindowsScriptingHost: | Credit @Cyb3rOps [ https://gist.github.com/Neo23x0/a4b4af9481e01e749409 ] -->
@@ -309,6 +311,7 @@
 			<Image condition="image">net1.exe</Image> <!--Windows: Launched by "net.exe", but it may not detect connections either -->
 			<Image condition="image">notepad.exe</Image> <!--Windows: [ https://secrary.com/ReversingMalware/CoinMiner/ ] [ https://blog.cobaltstrike.com/2013/08/08/why-is-notepad-exe-connecting-to-the-internet/ ] -->
 			<Image condition="image">nslookup.exe</Image> <!--Windows: Retrieve data over DNS -->
+			<Image condition="image">pwsh.exe</Image> <!--Windows: PowerShell 7 -->
 			<Image condition="image">powershell.exe</Image> <!--Windows: PowerShell interface-->
 			<Image condition="image">powershell_ise.exe</Image> <!--Windows: PowerShell interface-->
 			<Image condition="image">qprocess.exe</Image> <!--Windows: [ https://www.first.org/resources/papers/conf2017/APT-Log-Analysis-Tracking-Attack-Tools-by-Audit-Policy-and-Sysmon.pdf ] -->
@@ -533,6 +536,7 @@
 			<TargetFilename name="T1165" condition="contains">\Startup\</TargetFilename> <!--Microsoft:Changes to user's auto-launched files and shortcuts-->
 			<TargetFilename name="OutlookAttachment" condition="contains">\Content.Outlook\</TargetFilename> <!--Microsoft:Outlook: attachments-->
 			<TargetFilename name="Downloads" condition="contains">\Downloads\</TargetFilename> <!--Downloaded files. Does not include "Run" files in IE-->
+			<TargetFilename name="Public" condition="contains">C:\Users\Public\</TargetFilename>
 			<TargetFilename name="T1176" condition="end with">.crx</TargetFilename> <!--Chrome extension-->
 			<TargetFilename condition="end with">.application</TargetFilename> <!--Microsoft:ClickOnce: [ https://blog.netspi.com/all-you-need-is-one-a-clickonce-love-story/ ] -->
 			<TargetFilename condition="end with">.appref-ms</TargetFilename> <!--Microsoft:ClickOnce application | Credit @ion-storm -->
@@ -546,6 +550,7 @@
 			<TargetFilename condition="end with">.dll</TargetFilename> <!--Microsoft:Office:Word: Macro-->
 			<TargetFilename condition="end with">.dmg</TargetFilename> <!--Phishing-->
 			<TargetFilename condition="end with">.dmp</TargetFilename> <!--Process dumps [ (fr) http://blog.gentilkiwi.com/securite/mimikatz/minidump ] -->
+			<TargetFilename condition="end with">.dump</TargetFilename>
 			<TargetFilename condition="end with">.docm</TargetFilename> <!--Microsoft:Office:Word: Macro-->
 			<TargetFilename condition="end with">.exe.log</TargetFilename> <!-- [ https://github.com/bitsadmin/nopowershell ] | Credit: @SBousseaden [ https://twitter.com/SBousseaden/status/1137493597769687040 ] -->
 			<TargetFilename condition="end with">.exe</TargetFilename> <!--Executable-->
@@ -593,6 +598,7 @@
 			<TargetFilename condition="begin with">C:\Windows\SysWOW64\Wbem</TargetFilename> <!--Microsoft:WMI: [ More information: http://2014.hackitoergosum.org/slides/day1_WMI_Shell_Andrei_Dumitrescu.pdf ] -->
 			<TargetFilename condition="begin with">C:\Windows\system32\WindowsPowerShell</TargetFilename> <!--Microsoft:Powershell: Look for modifications for persistence [ https://www.malwarearchaeology.com/cheat-sheets ] -->
 			<TargetFilename condition="begin with">C:\Windows\SysWOW64\WindowsPowerShell</TargetFilename> <!--Microsoft:Powershell: Look for modifications for persistence [ https://www.malwarearchaeology.com/cheat-sheets ] -->
+			<TargetFilename condition="begin with">C:\Program Files\PowerShell\7\</TargetFilename>
 			<TargetFilename name="T1053" condition="begin with">C:\Windows\Tasks\</TargetFilename> <!--Microsoft:ScheduledTasks [ https://attack.mitre.org/wiki/Technique/T1053 ] -->
 			<TargetFilename name="T1053" condition="begin with">C:\Windows\system32\Tasks</TargetFilename> <!--Microsoft:ScheduledTasks [ https://attack.mitre.org/wiki/Technique/T1053 ] -->
 			<TargetFilename name="T1053" condition="begin with">C:\Windows\SysWOW64\Tasks</TargetFilename> <!--Microsoft:ScheduledTasks [ https://attack.mitre.org/wiki/Technique/T1053 ] -->
@@ -911,6 +917,7 @@
 			<TargetFilename condition="contains">Startup</TargetFilename> <!--ADS startup | Example: [ https://www.hybrid-analysis.com/sample/a314f6106633fba4b70f9d6ddbee452e8f8f44a72117749c21243dc93c7ed3ac?environmentId=100 ] -->
 			<TargetFilename condition="end with">.bat</TargetFilename> <!--Batch scripting-->
 			<TargetFilename condition="end with">.cmd</TargetFilename> <!--Batch scripting | Credit @ion-storm -->
+			<TargetFilename condition="end with">.chm</TargetFilename> <!--Batch scripting | Credit @ion-storm -->
 			<TargetFilename condition="end with">.doc</TargetFilename> <!--Office doc potentially with macro -->
 			<TargetFilename condition="end with">.hta</TargetFilename> <!--Scripting-->
 			<TargetFilename condition="end with">.jse</TargetFilename> <!--Registry File-->

From d6c7c57fa9c04f14088f837bdaa7f96ce6cf5463 Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Wed, 19 Apr 2023 12:23:02 +0200
Subject: [PATCH 132/149] feat: update sysmon config

---
 sysmonconfig-export-block.xml | 16 ++++++++++++++--
 sysmonconfig-export.xml       | 17 +++++++++++++++--
 2 files changed, 29 insertions(+), 4 deletions(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 97c8daba..75256d2e 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -284,6 +284,12 @@
 			<Image condition="image">tasklist.exe</Image> <!--Windows: List processes, has remote ability -->
 			<Image condition="image">wmic.exe</Image> <!--WindowsManagementInstrumentation: Credit @Cyb3rOps [ https://gist.github.com/Neo23x0/a4b4af9481e01e749409 ] -->
 			<Image condition="image">wscript.exe</Image> <!--WindowsScriptingHost: | Credit @arekfurt -->
+			<Image condition="image">mstsc.exe</Image>
+			<Image condition="image">wsl.exe</Image>
+			<Image condition="image">winget.exe</Image>
+			<Image condition="image">WindowsTerminal.exe</Image>
+			<Image condition="image">wt.exe</Image>
+			<Image condition="image">winlogon.exe</Image>
 			<!--Live of the Land Binaries and scripts (LOLBAS) -->
 			<Image condition="image">bitsadmin.exe</Image> <!-- Windows: Background Intelligent Transfer Service - Can download from URLs -->
 			<Image condition="image">esentutl.exe</Image> <!-- Windows: Database utilities for the ESE - Can fetch from UNC paths -->
@@ -315,6 +321,7 @@
 			<Image condition="image">winexesvc.exe</Image> <!-- Winexe service executable | Credit @Cyb3rOps -->
 			<Image condition="image">nmap.exe</Image>
 			<Image condition="image">psinfo.exe</Image>
+			<Image condition="image">RDCMan.exe</Image>
 			<!--Ports: Suspicious-->
 			<DestinationPort name="SSH" condition="is">22</DestinationPort> <!--SSH protocol, monitor admin connections-->
 			<DestinationPort name="Telnet" condition="is">23</DestinationPort> <!--Telnet protocol, monitor admin connections, insecure-->
@@ -405,8 +412,11 @@
 		<!--DATA: UtcTime, ProcessGuid, ProcessId, Image, ImageLoaded, Hashes, Signed, Signature, SignatureStatus-->
 	<RuleGroup name="" groupRelation="or">
 		<ImageLoad onmatch="include">
-			<ImageLoaded condition="begin with">C:\Users\Public\</ImageLoaded>
 			<ImageLoaded condition="begin with">C:\PerfLogs\</ImageLoaded>
+			<ImageLoaded condition="begin with">C:\Users\Public\</ImageLoaded>
+			<ImageLoaded condition="is">C:\Windows\System32\WLBSCTRL.dll</ImageLoaded> <!-- SCM DLL sideloading -->
+			<ImageLoaded condition="is">C:\Windows\System32\TSMSISrv.dll</ImageLoaded> <!-- SCM DLL sideloading -->
+			<ImageLoaded condition="is">C:\Windows\System32\TSVIPSrv.dll</ImageLoaded> <!-- SCM DLL sideloading -->
 			<!--NOTE: Using "include" with no rules means nothing in this section will be logged-->
 		</ImageLoad>
 	</RuleGroup>
@@ -510,6 +520,7 @@
 			<TargetFilename condition="end with">.dmp</TargetFilename> <!--Process dumps [ (fr) http://blog.gentilkiwi.com/securite/mimikatz/minidump ] -->
 			<TargetFilename condition="end with">.dump</TargetFilename>
 			<TargetFilename condition="end with">.docm</TargetFilename> <!--Microsoft:Office:Word: Macro-->
+			<TargetFilename condition="end with">.evtx</TargetFilename> <!--Eventlog-->
 			<TargetFilename condition="end with">.exe.log</TargetFilename> <!-- [ https://github.com/bitsadmin/nopowershell ] | Credit: @SBousseaden [ https://twitter.com/SBousseaden/status/1137493597769687040 ] -->
 			<TargetFilename condition="end with">.exe</TargetFilename> <!--Executable-->
 			<TargetFilename condition="end with">.hta</TargetFilename> <!--Scripting-->
@@ -538,11 +549,12 @@
 			<TargetFilename condition="end with">.sys</TargetFilename> <!--System driver files-->
 			<TargetFilename condition="end with">.vbe</TargetFilename> <!--VisualBasicScripting-->
 			<TargetFilename condition="end with">.vbs</TargetFilename> <!--VisualBasicScripting-->
+			<TargetFilename condition="end with">.vhd</TargetFilename>
+			<TargetFilename condition="end with">.vhdx</TargetFilename>
 			<TargetFilename condition="end with">.war</TargetFilename>
 			<TargetFilename condition="end with">.wsc</TargetFilename> <!--Scripting | Credit @bartblaze -->
 			<TargetFilename condition="end with">.wsf</TargetFilename> <!--Scripting | Credit @bartblaze -->
 			<TargetFilename condition="end with">.wsh</TargetFilename>
-			<TargetFilename condition="end with">.xls</TargetFilename> <!--Legacy Office files are often used for attacks-->
 			<TargetFilename condition="end with">.xls</TargetFilename><!--Microsoft [ https://medium.com/@threathuntingteam/msxsl-exe-and-wmic-exe-a-way-to-proxy-code-execution-8d524f642b75 ] -->
 			<TargetFilename condition="end with">.xlsm</TargetFilename> <!--Microsoft:Office:Word: Macro-->
 			<TargetFilename name="DefaultUserModified" condition="begin with">C:\Users\Default</TargetFilename> <!--Windows: Changes to default user profile-->
diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 156ffbcb..af1bd646 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -81,7 +81,6 @@
 			<!--SECTION: Microsoft Windows-->
 			<CommandLine condition="is">"C:\Windows\system32\cscript.exe" /nologo "MonitorKnowledgeDiscovery.vbs"</CommandLine>
 			<CommandLine condition="begin with"> "C:\Windows\system32\wermgr.exe" "-queuereporting_svc" </CommandLine> <!--Windows:Windows error reporting/telemetry-->
-			<CommandLine condition="begin with">C:\Windows\system32\DllHost.exe /Processid</CommandLine> <!--Windows-->
 			<CommandLine condition="begin with">C:\Windows\system32\wbem\wmiprvse.exe -Embedding</CommandLine> <!--Windows: WMI provider host-->
 			<CommandLine condition="begin with">C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding</CommandLine> <!--Windows: WMI provider host-->
 			<CommandLine condition="is">C:\Windows\system32\wermgr.exe -upload</CommandLine> <!--Windows:Windows error reporting/telemetry-->
@@ -328,6 +327,12 @@
 			<Image condition="image">tasklist.exe</Image> <!--Windows: List processes, has remote ability -->
 			<Image condition="image">wmic.exe</Image> <!--WindowsManagementInstrumentation: Credit @Cyb3rOps [ https://gist.github.com/Neo23x0/a4b4af9481e01e749409 ] -->
 			<Image condition="image">wscript.exe</Image> <!--WindowsScriptingHost: | Credit @arekfurt -->
+			<Image condition="image">mstsc.exe</Image>
+			<Image condition="image">wsl.exe</Image>
+			<Image condition="image">winget.exe</Image>
+			<Image condition="image">WindowsTerminal.exe</Image>
+			<Image condition="image">wt.exe</Image>
+			<Image condition="image">winlogon.exe</Image>
 			<!--Live of the Land Binaries and scripts (LOLBAS) -->
 			<Image condition="image">bitsadmin.exe</Image> <!-- Windows: Background Intelligent Transfer Service - Can download from URLs -->
 			<Image condition="image">esentutl.exe</Image> <!-- Windows: Database utilities for the ESE - Can fetch from UNC paths -->
@@ -359,6 +364,7 @@
 			<Image condition="image">winexesvc.exe</Image> <!-- Winexe service executable | Credit @Cyb3rOps -->
 			<Image condition="image">nmap.exe</Image>
 			<Image condition="image">psinfo.exe</Image>
+			<Image condition="image">RDCMan.exe</Image>
 			<!--Ports: Suspicious-->
 			<DestinationPort name="SSH" condition="is">22</DestinationPort> <!--SSH protocol, monitor admin connections-->
 			<DestinationPort name="Telnet" condition="is">23</DestinationPort> <!--Telnet protocol, monitor admin connections, insecure-->
@@ -450,6 +456,11 @@
 	<RuleGroup name="" groupRelation="or">
 		<ImageLoad onmatch="include">
 			<!--NOTE: Using "include" with no rules means nothing in this section will be logged-->
+			<ImageLoaded condition="begin with">C:\PerfLogs\</ImageLoaded>
+			<ImageLoaded condition="begin with">C:\Users\Public\</ImageLoaded>
+			<ImageLoaded condition="is">C:\Windows\System32\WLBSCTRL.dll</ImageLoaded> <!-- SCM DLL sideloading -->
+			<ImageLoaded condition="is">C:\Windows\System32\TSMSISrv.dll</ImageLoaded> <!-- SCM DLL sideloading -->
+			<ImageLoaded condition="is">C:\Windows\System32\TSVIPSrv.dll</ImageLoaded> <!-- SCM DLL sideloading -->
 		</ImageLoad>
 	</RuleGroup>
 
@@ -552,6 +563,7 @@
 			<TargetFilename condition="end with">.dmp</TargetFilename> <!--Process dumps [ (fr) http://blog.gentilkiwi.com/securite/mimikatz/minidump ] -->
 			<TargetFilename condition="end with">.dump</TargetFilename>
 			<TargetFilename condition="end with">.docm</TargetFilename> <!--Microsoft:Office:Word: Macro-->
+			<TargetFilename condition="end with">.evtx</TargetFilename> <!--Eventlog-->
 			<TargetFilename condition="end with">.exe.log</TargetFilename> <!-- [ https://github.com/bitsadmin/nopowershell ] | Credit: @SBousseaden [ https://twitter.com/SBousseaden/status/1137493597769687040 ] -->
 			<TargetFilename condition="end with">.exe</TargetFilename> <!--Executable-->
 			<TargetFilename condition="end with">.hta</TargetFilename> <!--Scripting-->
@@ -580,11 +592,12 @@
 			<TargetFilename condition="end with">.sys</TargetFilename> <!--System driver files-->
 			<TargetFilename condition="end with">.vbe</TargetFilename> <!--VisualBasicScripting-->
 			<TargetFilename condition="end with">.vbs</TargetFilename> <!--VisualBasicScripting-->
+			<TargetFilename condition="end with">.vhd</TargetFilename>
+			<TargetFilename condition="end with">.vhdx</TargetFilename>
 			<TargetFilename condition="end with">.war</TargetFilename>
 			<TargetFilename condition="end with">.wsc</TargetFilename> <!--Scripting | Credit @bartblaze -->
 			<TargetFilename condition="end with">.wsf</TargetFilename> <!--Scripting | Credit @bartblaze -->
 			<TargetFilename condition="end with">.wsh</TargetFilename>
-			<TargetFilename condition="end with">.xls</TargetFilename> <!--Legacy Office files are often used for attacks-->
 			<TargetFilename condition="end with">.xls</TargetFilename><!--Microsoft [ https://medium.com/@threathuntingteam/msxsl-exe-and-wmic-exe-a-way-to-proxy-code-execution-8d524f642b75 ] -->
 			<TargetFilename condition="end with">.xlsm</TargetFilename> <!--Microsoft:Office:Word: Macro-->
 			<TargetFilename name="DefaultUserModified" condition="begin with">C:\Users\Default</TargetFilename> <!--Windows: Changes to default user profile-->

From b7666047365005ed54424aba61bb3ee2c18fb81f Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Fri, 21 Apr 2023 02:15:48 +0200
Subject: [PATCH 133/149] feat: remove driver filters

---
 sysmonconfig-export-block.xml | 3 ---
 sysmonconfig-export.xml       | 3 ---
 sysmonconfig-trace.xml        | 5 -----
 3 files changed, 11 deletions(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 75256d2e..a1a834d9 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -399,9 +399,6 @@
 		<!--DATA: UtcTime, ImageLoaded, Hashes, Signed, Signature, SignatureStatus-->
 	<RuleGroup name="" groupRelation="or">
 		<DriverLoad onmatch="exclude">
-			<Signature condition="contains">microsoft</Signature> <!--Exclude signed Microsoft drivers-->
-			<Signature condition="contains">windows</Signature> <!--Exclude signed Microsoft drivers-->
-			<Signature condition="begin with">Intel </Signature> <!--Exclude signed Intel drivers-->
 		</DriverLoad>
 	</RuleGroup>
 
diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index af1bd646..6fc1bbe1 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -442,9 +442,6 @@
 		<!--DATA: UtcTime, ImageLoaded, Hashes, Signed, Signature, SignatureStatus-->
 	<RuleGroup name="" groupRelation="or">
 		<DriverLoad onmatch="exclude">
-			<Signature condition="contains">microsoft</Signature> <!--Exclude signed Microsoft drivers-->
-			<Signature condition="contains">windows</Signature> <!--Exclude signed Microsoft drivers-->
-			<Signature condition="begin with">Intel </Signature> <!--Exclude signed Intel drivers-->
 		</DriverLoad>
 	</RuleGroup>
 
diff --git a/sysmonconfig-trace.xml b/sysmonconfig-trace.xml
index d2c3286c..c408fba0 100644
--- a/sysmonconfig-trace.xml
+++ b/sysmonconfig-trace.xml
@@ -82,11 +82,6 @@
 		<RuleGroup name="" groupRelation="or">
 			<!-- Event ID 6 == Driver Loaded. Log all drivers except those with the following signatures -->
 			<DriverLoad onmatch="exclude">
-				<Signature condition="contains">microsoft</Signature>
-				<Signature condition="contains">windows</Signature>
-				<Signature condition="contains">symantec</Signature>
-				<Signature condition="is">VMware</Signature>
-				<Signature condition="begin with">Intel </Signature>
 			</DriverLoad>
 		</RuleGroup>
 		<RuleGroup name="" groupRelation="or">

From 94a324a53d12f304f045bdb6657d70188b097a62 Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Thu, 27 Apr 2023 14:41:04 +0200
Subject: [PATCH 134/149] fix: apply suggestions from code review

Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
---
 sysmonconfig-export-block.xml | 3 +++
 sysmonconfig-export.xml       | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index a1a834d9..84c9b9ca 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -399,6 +399,9 @@
 		<!--DATA: UtcTime, ImageLoaded, Hashes, Signed, Signature, SignatureStatus-->
 	<RuleGroup name="" groupRelation="or">
 		<DriverLoad onmatch="exclude">
+			<!-- include if needed <Signature condition="contains">microsoft</Signature> Exclude signed Microsoft drivers-->
+			<!-- include if needed <Signature condition="contains">windows</Signature> Exclude signed Microsoft drivers-->
+			<!-- include if needed <Signature condition="begin with">Intel </Signature> Exclude signed Intel drivers-->
 		</DriverLoad>
 	</RuleGroup>
 
diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 6fc1bbe1..114a5829 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -442,6 +442,9 @@
 		<!--DATA: UtcTime, ImageLoaded, Hashes, Signed, Signature, SignatureStatus-->
 	<RuleGroup name="" groupRelation="or">
 		<DriverLoad onmatch="exclude">
+			<!-- include if needed <Signature condition="contains">microsoft</Signature> Exclude signed Microsoft drivers-->
+			<!-- include if needed <Signature condition="contains">windows</Signature> Exclude signed Microsoft drivers-->
+			<!-- include if needed <Signature condition="begin with">Intel </Signature> Exclude signed Intel drivers-->
 		</DriverLoad>
 	</RuleGroup>
 

From 0ee029adab6835461dd1f6e3032691c9c214b763 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Fri, 5 May 2023 10:01:15 +0200
Subject: [PATCH 135/149] new hacktool blocks

---
 sysmonconfig-export-block.xml | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index ee871a28..6648f148 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -1409,7 +1409,7 @@
 			<Hashes condition="contains">IMPHASH=FCC251CCEAE90D22C392215CC9A2D5D6</Hashes> <!-- Mimikatz -->
 			<Hashes condition="contains">IMPHASH=23867A89C2B8FC733BE6CF5EF902F2D1</Hashes> <!-- JuicyPotato  -->
 			<Hashes condition="contains">IMPHASH=A37FF327F8D48E8A4D2F757E1B6E70BC</Hashes> <!-- JuicyPotato  -->
-			<Hashes condition="contains">IMPHASH=F9A28C458284584A93B14216308D31BD</Hashes> <!-- JuicyPotatoNG  -->
+			<Hashes condition="contains">IMPHASH=F9A28C458284584A93B14216308D31BD</Hashes> <!-- JuicyPotatoNG -->
 			<Hashes condition="contains">IMPHASH=6118619783FC175BC7EBECFF0769B46E</Hashes> <!-- RoguePotato -->
 			<Hashes condition="contains">IMPHASH=959A83047E80AB68B368FDB3F4C6E4EA</Hashes> <!-- RoguePotato -->
 			<Hashes condition="contains">IMPHASH=563233BFA169ACC7892451F71AD5850A</Hashes> <!-- RoguePotato -->
@@ -1471,12 +1471,15 @@
 			<Hashes condition="contains">IMPHASH=E96A73C7BF33A464C510EDE582318BF2</Hashes> <!-- WCE -->
 			<Hashes condition="contains">IMPHASH=32089B8851BBF8BC2D014E9F37288C83</Hashes> <!-- Sliver Stagers -->
 			<Hashes condition="contains">IMPHASH=09D278F9DE118EF09163C6140255C690</Hashes> <!-- Dumpert -->
-			<Hashes condition="contains">IMPHASH=03866661686829D806989E2FC5A72606</Hashes> <!-- Dumpert -->
-			<Hashes condition="contains">IMPHASH=E57401FBDADCD4571FF385AB82BD5D6D</Hashes> <!-- Dumpert -->
+			<Hashes condition="contains">IMPHASH=03866661686829d806989e2fc5a72606</Hashes> <!-- Dumpert -->
+			<Hashes condition="contains">IMPHASH=e57401fbdadcd4571ff385ab82bd5d6d</Hashes> <!-- Dumpert -->
 			<Hashes condition="contains">IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE</Hashes> <!-- SysmonEnte -->
 			<Hashes condition="contains">IMPHASH=19584675D94829987952432E018D5056</Hashes> <!-- SysmonQuiet -->
-			<Hashes condition="contains">IMPHASH=22F4089EB8ABA31E1BB162C6D9BF72E5</Hashes> <!-- SysmonEOP exploiting CVE-2022-41120 -->
-			<Hashes condition="contains">IMPHASH=5123FA4C4384D431CD0D893EEB49BBEC</Hashes> <!-- SysmonEOP exploiting CVE-2022-41120 -->
+			<Hashes condition="contains">IMPHASH=330768A4F172E10ACB6287B87289D83B</Hashes> <!-- ShaprEvtMute Hook -->
+			<Hashes condition="contains">IMPHASH=885C99CCFBE77D1CBFCB9C4E7C1A3313</Hashes> <!-- Forkatz -->
+			<Hashes condition="contains">IMPHASH=22A22BC9E4E0D2F189F1EA01748816AC</Hashes> <!-- PPLKiller -->
+			<Hashes condition="contains">IMPHASH=7FA30E6BB7E8E8A69155636E50BF1B28</Hashes> <!-- PPLKiller -->
+			<Hashes condition="contains">IMPHASH=96DF3A3731912449521F6F8D183279B1</Hashes> <!-- Backstab -->
 			<Hashes condition="contains">MD5=7B17F15713FCF13C764535AA2BDF52AA</Hashes>													<!-- ShaprEvtMute -->
 			<Hashes condition="contains">SHA1=4E18320493042BCD7D21B53E258974BC460ACC78</Hashes>										<!-- ShaprEvtMute -->
 			<Hashes condition="contains">SHA256=477DFE485F5BD9540CC83E88FC04AAFB6DE49CF1ADC6BD857D5D6F4C1730A6D1</Hashes>	<!-- ShaprEvtMute -->

From 65e6fff3bc31058cc7059248e3a4885debf48599 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Fri, 5 May 2023 13:18:00 +0200
Subject: [PATCH 136/149] Update sysmonconfig-export-block.xml

---
 sysmonconfig-export-block.xml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 6648f148..20b79b7d 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -1480,6 +1480,8 @@
 			<Hashes condition="contains">IMPHASH=22A22BC9E4E0D2F189F1EA01748816AC</Hashes> <!-- PPLKiller -->
 			<Hashes condition="contains">IMPHASH=7FA30E6BB7E8E8A69155636E50BF1B28</Hashes> <!-- PPLKiller -->
 			<Hashes condition="contains">IMPHASH=96DF3A3731912449521F6F8D183279B1</Hashes> <!-- Backstab -->
+			<Hashes condition="contains">IMPHASH=7E6CF3FF4576581271AC8A313B2AAB46</Hashes> <!-- Backstab -->
+			<Hashes condition="contains">IMPHASH=51791678F351C03A0EB4E2A7B05C6E17</Hashes> <!-- Backstab -->
 			<Hashes condition="contains">MD5=7B17F15713FCF13C764535AA2BDF52AA</Hashes>													<!-- ShaprEvtMute -->
 			<Hashes condition="contains">SHA1=4E18320493042BCD7D21B53E258974BC460ACC78</Hashes>										<!-- ShaprEvtMute -->
 			<Hashes condition="contains">SHA256=477DFE485F5BD9540CC83E88FC04AAFB6DE49CF1ADC6BD857D5D6F4C1730A6D1</Hashes>	<!-- ShaprEvtMute -->

From 46fd40f5dc31b43a066dcd44d11fa65e3f57ce17 Mon Sep 17 00:00:00 2001
From: Dugu Qiubai <36287452+cospirho@users.noreply.github.com>
Date: Mon, 15 May 2023 13:36:50 -0400
Subject: [PATCH 137/149] Remove duplicates sysmonconfig-export

---
 sysmonconfig-export.xml | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 114a5829..8c5b6019 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -314,7 +314,6 @@
 			<Image condition="image">powershell.exe</Image> <!--Windows: PowerShell interface-->
 			<Image condition="image">powershell_ise.exe</Image> <!--Windows: PowerShell interface-->
 			<Image condition="image">qprocess.exe</Image> <!--Windows: [ https://www.first.org/resources/papers/conf2017/APT-Log-Analysis-Tracking-Attack-Tools-by-Audit-Policy-and-Sysmon.pdf ] -->
-			<Image condition="image">qwinsta.exe</Image> <!--Windows: Query remote sessions | Credit @ion-storm -->
 			<Image condition="image">qwinsta.exe</Image> <!--Windows: Remotely query login sessions on a server or workstation | Credit @ion-storm -->
 			<Image condition="image">reg.exe</Image> <!--Windows: Remote Registry editing ability | Credit @ion-storm -->
 			<Image condition="image">regsvcs.exe</Image> <!--Windows: [ https://www.hybrid-analysis.com/sample/3f94d7080e6c5b8f59eeecc3d44f7e817b31562caeba21d02ad705a0bfc63d67?environmentId=100 ] -->
@@ -829,8 +828,6 @@
 			<TargetObject name="InvDB-CompileTimeClaim" condition="end with">\LinkDate</TargetObject> <!-- Compile time of EXE, may not be reliable [ https://en.wikipedia.org/wiki/Link_time ] -->
 			<TargetObject name="InvDB" condition="contains">Compatibility Assistant\Store\</TargetObject> <!-- Inventory -->
 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports</TargetObject> <!--Microsoft:Windows: Printer port changes as used in CVE-2020-1048 [ https://windows-internals.com/printdemon-cve-2020-1048/ ] -->
-			<TargetObject condition="contains">\Keyboard Layout\Preload</TargetObject> <!--Microsoft:Windows: Keyboard layout loaded into user session [ https://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index ] -->
-			<TargetObject condition="contains">\Keyboard Layout\Substitutes</TargetObject> <!--Microsoft:Windows: Keyboard layout loaded into user session [ https://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index ] -->
 			<!--Suspicious sources-->
 			<Image name="Suspicious,ImageBeginWithBackslash" condition="end with">\regedit.exe</Image> <!--Users and helpdesk staff making system modifications -->
 			<Image name="Suspicious,ImageBeginWithBackslash" condition="begin with">\</Image> <!--Devices and VSC shouldn't be executing changes | Credit: @SBousseaden @ionstorm @neu5ron @PerchedSystems [ https://twitter.com/SwiftOnSecurity/status/1133167323991486464 ] -->
@@ -843,7 +840,6 @@
 			<TargetObject condition="contains">Microsoft\Cryptography\Providers\Trust\</TargetObject> <!-- Important trust registry values to monitor -->
 			<TargetObject condition="contains">WOW6432Node\Microsoft\Cryptography\Providers\Trust\</TargetObject> <!-- Important trust registry values to monitor -->
 			<TargetObject condition="contains">Control\Print\Environments\Windows x64\Drivers</TargetObject> <!-- PrinterNightmare coverage -->
-			<TargetObject name="Context,ContactedDomain" condition="end with">\EnableBHO</TargetObject> <!--Microsoft:Office: Contacted domains stored here 'HKEY_CURRENT_USER\<SID>\SOFTWARE\Microsoft\Office\16.0\Common\Internet\Server Cache\<domain>\EnableBHO' -->
 		</RegistryEvent>
 	</RuleGroup>
 
@@ -1177,7 +1173,6 @@
 			<QueryName condition="is">cdnjs.cloudflare.com</QueryName> <!--Cloudflare: Hosts popular javascript libraries-->
 			<QueryName condition="is">fonts.googleapis.com</QueryName> <!--Google fonts-->
 			<QueryName condition="end with">.typekit.net</QueryName> <!--Adobe fonts-->
-			<QueryName condition="is">cdnjs.cloudflare.com</QueryName>
 			<QueryName condition="end with">.stackassets.com</QueryName> <!--Stack Overflow-->
 			<QueryName condition="end with">.steamcontent.com</QueryName>
 			<QueryName condition="is">play.google.com</QueryName>
@@ -1203,7 +1198,6 @@
 			<QueryName condition="end with">.advertising.com</QueryName> <!--Ads | Microsoft default exclusion-->
 			<QueryName condition="end with">.agkn.com</QueryName> <!--Ads | [ https://www.home.neustar/privacy ] -->
 			<QueryName condition="end with">.amazon-adsystem.com</QueryName> <!--Ads-->
-			<QueryName condition="end with">.amazon-adsystem.com</QueryName> <!--Ads-->
 			<QueryName condition="end with">.analytics.yahoo.com</QueryName> <!--Ads:Yahoo-->
 			<QueryName condition="end with">.aol.com</QueryName> <!--Ads | Microsoft default exclusion -->
 			<QueryName condition="end with">.betrad.com</QueryName> <!--Ads | Microsoft default exclusion-->
@@ -1291,7 +1285,6 @@
 			<!--SocialNet-->
 			<QueryName condition="end with">.pscp.tv</QueryName> <!--Twitter:Periscope-->
 			<!--OSCP/CRL Common-->
-			<QueryName condition="end with">.amazontrust.com</QueryName>
 			<QueryName condition="end with">.digicert.com</QueryName>
 			<QueryName condition="end with">.globalsign.com</QueryName>
 			<QueryName condition="end with">.globalsign.net</QueryName>
@@ -1311,20 +1304,15 @@
 			<QueryName condition="is">ocsp.msocsp.com</QueryName> <!--Microsoft:OCSP-->
 			<QueryName condition="is">pki.goog</QueryName>
 			<QueryName condition="end with">.pki.goog</QueryName>
-			<QueryName condition="is">ocsp.godaddy.com</QueryName>
 			<QueryName condition="is">amazontrust.com</QueryName>
 			<QueryName condition="end with">.amazontrust.com</QueryName>
 			<QueryName condition="is">ocsp.sectigo.com</QueryName>
 			<QueryName condition="is">pki-goog.l.google.com</QueryName>
-			<QueryName condition="end with">.usertrust.com</QueryName>
-			<QueryName condition="is">ocsp.comodoca.com</QueryName>
 			<QueryName condition="is">ocsp.verisign.com</QueryName>
-			<QueryName condition="is">ocsp.entrust.net</QueryName>
 			<QueryName condition="is">ocsp.identrust.com</QueryName>
 			<QueryName condition="end with">.ocsp.identrust.com</QueryName>
 			<QueryName condition="is">status.rapidssl.com</QueryName>
 			<QueryName condition="is">status.thawte.com</QueryName>
-			<QueryName condition="is">ocsp.int-x3.letsencrypt.org</QueryName>
 			<!-- SECTION: PRTG -->
 			<Image condition="is">C:\Program Files (x86)\PRTG Network Monitor\PRTG Probe.exe</Image>
 		</DnsQuery>

From cea856d7d4332d5a12c3e92c1e652b295be57cd5 Mon Sep 17 00:00:00 2001
From: Dugu Qiubai <36287452+cospirho@users.noreply.github.com>
Date: Mon, 15 May 2023 13:49:45 -0400
Subject: [PATCH 138/149] Remove duplicates sysmonconfig-export-block

---
 sysmonconfig-export-block.xml | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 7e9dcc5b..42c1c9f1 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -271,7 +271,6 @@
 			<Image condition="image">powershell.exe</Image> <!--Windows: PowerShell interface-->
 			<Image condition="image">powershell_ise.exe</Image> <!--Windows: PowerShell interface-->
 			<Image condition="image">qprocess.exe</Image> <!--Windows: [ https://www.first.org/resources/papers/conf2017/APT-Log-Analysis-Tracking-Attack-Tools-by-Audit-Policy-and-Sysmon.pdf ] -->
-			<Image condition="image">qwinsta.exe</Image> <!--Windows: Query remote sessions | Credit @ion-storm -->
 			<Image condition="image">qwinsta.exe</Image> <!--Windows: Remotely query login sessions on a server or workstation | Credit @ion-storm -->
 			<Image condition="image">reg.exe</Image> <!--Windows: Remote Registry editing ability | Credit @ion-storm -->
 			<Image condition="image">regsvcs.exe</Image> <!--Windows: [ https://www.hybrid-analysis.com/sample/3f94d7080e6c5b8f59eeecc3d44f7e817b31562caeba21d02ad705a0bfc63d67?environmentId=100 ] -->
@@ -786,8 +785,6 @@
 			<TargetObject name="InvDB-CompileTimeClaim" condition="end with">\LinkDate</TargetObject> <!-- Compile time of EXE, may not be reliable [ https://en.wikipedia.org/wiki/Link_time ] -->
 			<TargetObject name="InvDB" condition="contains">Compatibility Assistant\Store\</TargetObject> <!-- Inventory -->
 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports</TargetObject> <!--Microsoft:Windows: Printer port changes as used in CVE-2020-1048 [ https://windows-internals.com/printdemon-cve-2020-1048/ ] -->
-			<TargetObject condition="contains">\Keyboard Layout\Preload</TargetObject> <!--Microsoft:Windows: Keyboard layout loaded into user session [ https://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index ] -->
-			<TargetObject condition="contains">\Keyboard Layout\Substitutes</TargetObject> <!--Microsoft:Windows: Keyboard layout loaded into user session [ https://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index ] -->
 			<!--Suspicious sources-->
 			<Image name="Suspicious,ImageBeginWithBackslash" condition="end with">\regedit.exe</Image> <!--Users and helpdesk staff making system modifications -->
 			<Image name="Suspicious,ImageBeginWithBackslash" condition="begin with">\</Image> <!--Devices and VSC shouldn't be executing changes | Credit: @SBousseaden @ionstorm @neu5ron @PerchedSystems [ https://twitter.com/SwiftOnSecurity/status/1133167323991486464 ] -->
@@ -800,7 +797,6 @@
 			<TargetObject condition="contains">Microsoft\Cryptography\Providers\Trust\</TargetObject> <!-- Important trust registry values to monitor -->
 			<TargetObject condition="contains">WOW6432Node\Microsoft\Cryptography\Providers\Trust\</TargetObject> <!-- Important trust registry values to monitor -->
 			<TargetObject condition="contains">Control\Print\Environments\Windows x64\Drivers</TargetObject> <!-- PrinterNightmare coverage -->
-			<TargetObject name="Context,ContactedDomain" condition="end with">\EnableBHO</TargetObject> <!--Microsoft:Office: Contacted domains stored here 'HKEY_CURRENT_USER\<SID>\SOFTWARE\Microsoft\Office\16.0\Common\Internet\Server Cache\<domain>\EnableBHO' -->
 		</RegistryEvent>
 	</RuleGroup>
 
@@ -1133,7 +1129,6 @@
 			<QueryName condition="is">cdnjs.cloudflare.com</QueryName> <!--Cloudflare: Hosts popular javascript libraries-->
 			<QueryName condition="is">fonts.googleapis.com</QueryName> <!--Google fonts-->
 			<QueryName condition="end with">.typekit.net</QueryName> <!--Adobe fonts-->
-			<QueryName condition="is">cdnjs.cloudflare.com</QueryName>
 			<QueryName condition="end with">.stackassets.com</QueryName> <!--Stack Overflow-->
 			<QueryName condition="end with">.steamcontent.com</QueryName>
 			<QueryName condition="is">play.google.com</QueryName>
@@ -1159,7 +1154,6 @@
 			<QueryName condition="end with">.advertising.com</QueryName> <!--Ads | Microsoft default exclusion-->
 			<QueryName condition="end with">.agkn.com</QueryName> <!--Ads | [ https://www.home.neustar/privacy ] -->
 			<QueryName condition="end with">.amazon-adsystem.com</QueryName> <!--Ads-->
-			<QueryName condition="end with">.amazon-adsystem.com</QueryName> <!--Ads-->
 			<QueryName condition="end with">.analytics.yahoo.com</QueryName> <!--Ads:Yahoo-->
 			<QueryName condition="end with">.aol.com</QueryName> <!--Ads | Microsoft default exclusion -->
 			<QueryName condition="end with">.betrad.com</QueryName> <!--Ads | Microsoft default exclusion-->
@@ -1247,7 +1241,6 @@
 			<!--SocialNet-->
 			<QueryName condition="end with">.pscp.tv</QueryName> <!--Twitter:Periscope-->
 			<!--OSCP/CRL Common-->
-			<QueryName condition="end with">.amazontrust.com</QueryName>
 			<QueryName condition="end with">.digicert.com</QueryName>
 			<QueryName condition="end with">.globalsign.com</QueryName>
 			<QueryName condition="end with">.globalsign.net</QueryName>
@@ -1267,20 +1260,15 @@
 			<QueryName condition="is">ocsp.msocsp.com</QueryName> <!--Microsoft:OCSP-->
 			<QueryName condition="is">pki.goog</QueryName>
 			<QueryName condition="end with">.pki.goog</QueryName>
-			<QueryName condition="is">ocsp.godaddy.com</QueryName>
 			<QueryName condition="is">amazontrust.com</QueryName>
 			<QueryName condition="end with">.amazontrust.com</QueryName>
 			<QueryName condition="is">ocsp.sectigo.com</QueryName>
 			<QueryName condition="is">pki-goog.l.google.com</QueryName>
-			<QueryName condition="end with">.usertrust.com</QueryName>
-			<QueryName condition="is">ocsp.comodoca.com</QueryName>
 			<QueryName condition="is">ocsp.verisign.com</QueryName>
-			<QueryName condition="is">ocsp.entrust.net</QueryName>
 			<QueryName condition="is">ocsp.identrust.com</QueryName>
 			<QueryName condition="end with">.ocsp.identrust.com</QueryName>
 			<QueryName condition="is">status.rapidssl.com</QueryName>
 			<QueryName condition="is">status.thawte.com</QueryName>
-			<QueryName condition="is">ocsp.int-x3.letsencrypt.org</QueryName>
 			<!-- SECTION: PRTG -->
 			<Image condition="is">C:\Program Files (x86)\PRTG Network Monitor\PRTG Probe.exe</Image>
 		</DnsQuery>

From 43f8ebf814cce4aba310f6b1a1b07d5cc760cf4a Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Wed, 28 Jun 2023 19:21:58 +0200
Subject: [PATCH 139/149] new FileExecutableDetected Block

---
 sysmonconfig-export.xml | 193 +++++++++++++++++++++++++++++++++++++++-
 1 file changed, 192 insertions(+), 1 deletion(-)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 114a5829..dae91b24 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -55,7 +55,7 @@
 
 -->
 
-<Sysmon schemaversion="4.50">
+<Sysmon schemaversion="4.90">
 	<!--SYSMON META CONFIG-->
 	<HashAlgorithms>md5,sha256,IMPHASH</HashAlgorithms> <!-- Both MD5 and SHA256 are the industry-standard algorithms. Remove IMPHASH if you do not use DLL import fingerprinting. -->
 	<CheckRevocation/> <!-- Check loaded drivers, log if their code-signing certificate has been revoked, in case malware stole one to sign a kernel driver -->
@@ -1398,5 +1398,196 @@
 			Sysinternals forum or over Twitter (@markrussinovich)."-->
 		<!--Cannot be filtered.-->
 
+	<!--SYSMON EVENT ID 29 : FILE EXE DETECTED [FileExecutableDetected]-->
+		<!--EVENT 29: "File Executable Detected"-->
+		<!--COMMENT:	This event is generated when an executable gets written to disk
+			[ https://medium.com/@olafhartong/sysmon-15-0-file-executable-detected-40fd64349f36 ]
+		-->
+
+	<RuleGroup name="Suspicious / Malicious Exe Download" groupRelation="or">
+		<FileExecutableDetected onmatch="include">
+			<!-- Executables dropped to suspicious folders : harder matches -->
+			<TargetFilename condition="begin with">C:\Users\Public\</TargetFilename> <!-- often used staging directories; could cause false positives --> 
+			<TargetFilename condition="begin with">C:\Perflogs\</TargetFilename> <!-- often used staging directories --> 
+			<TargetFilename condition="begin with">C:\Windows\Fonts\</TargetFilename> <!-- often used staging directories --> 
+			<TargetFilename condition="begin with">C:\Windows\debug\</TargetFilename> <!-- often used staging directories --> 
+			<TargetFilename condition="begin with">C:\Windows\Tasks\</TargetFilename> <!-- often used staging directories --> 
+			<TargetFilename condition="begin with">C:\Windows\tracing\</TargetFilename> <!-- often used staging directories --> 
+			<TargetFilename condition="begin with">C:\Windows\Help\</TargetFilename> <!-- often used staging directories --> 
+			<TargetFilename condition="begin with">C:\Windows\Logs\</TargetFilename> <!-- often used staging directories --> 
+			<TargetFilename condition="begin with">C:\Windows\System32\spool\SERVERS\</TargetFilename> <!-- often used in exploits against print spooler --> 
+			<TargetFilename condition="begin with">C:\Windows\System32\spool\PRINTERS\</TargetFilename> <!-- often used in exploits against print spooler --> 
+			<TargetFilename condition="begin with">C:\Windows\Help\</TargetFilename> <!-- often used staging directories --> 
+			<TargetFilename condition="contains all">C:\Users\;\Music\</TargetFilename> <!-- often used staging directories in User folders --> 
+			<TargetFilename condition="contains all">C:\Users\;\Pictures\</TargetFilename> <!-- often used staging directories in User folders --> 
+			<TargetFilename condition="contains all">C:\Users\;\Videos\</TargetFilename> <!-- often used staging directories in User folders --> 
+			<TargetFilename condition="contains all">C:\Users\;\Contacts\</TargetFilename> <!-- often used staging directories in User folders -->
+			<!-- Executables dropped to disk : softer matches -->
+			<TargetFilename condition="contains">\Appdata\Local\Temp\</TargetFilename> <!--User Temp folder-->
+			<TargetFilename condition="contains">\Appdata\Local\Microsoft\Windows\INetCache\Content.Outlook\</TargetFilename> <!--Microsoft Outlook Temp folder-->
+			
+			<!-- Executables double extensions -->
+			<TargetFilename condition="end with">.pdf.exe</TargetFilename>
+			<TargetFilename condition="end with">.doc.exe</TargetFilename>
+			<TargetFilename condition="end with">.docx.exe</TargetFilename>
+			<TargetFilename condition="end with">.xls.exe</TargetFilename>
+			<TargetFilename condition="end with">.xlsx.exe</TargetFilename>
+			<TargetFilename condition="end with">.xlsm.exe</TargetFilename>
+			<TargetFilename condition="end with">.docm.exe</TargetFilename>
+			<TargetFilename condition="end with">.ppt.exe</TargetFilename>
+			<TargetFilename condition="end with">.pptx.exe</TargetFilename>
+			<TargetFilename condition="end with">.txt.exe</TargetFilename>
+			<TargetFilename condition="end with">.rtf.exe</TargetFilename>
+			<TargetFilename condition="end with">.htm.exe</TargetFilename>
+			<TargetFilename condition="end with">.html.exe</TargetFilename>
+			<TargetFilename condition="end with">.iso.exe</TargetFilename>
+			<TargetFilename condition="end with">.zip.exe</TargetFilename>
+			<TargetFilename condition="end with">.rar.exe</TargetFilename>
+			<TargetFilename condition="end with">.7z.exe</TargetFilename>
+
+			<!-- Tools that tamper with Sysmon -->
+			<TargetFilename condition="end with">\EntenLoader.exe</TargetFilename>
+			<TargetFilename condition="end with">\SysmonQuiet.exe</TargetFilename>
+			<TargetFilename condition="end with">\SharpEvtMute.exe</TargetFilename>
+			<TargetFilename condition="end with">\EvtMuteHook.dll</TargetFilename>
+			<TargetFilename condition="end with">\SysmonEOP.exe</TargetFilename>
+
+			<!-- Hacktool Blocks based on Imphashes -->
+			<Hashes condition="contains">IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932</Hashes> <!-- PetitPotam -->
+			<Hashes condition="contains">IMPHASH=3A19059BD7688CB88E70005F18EFC439</Hashes> <!-- PetitPotam -->
+			<Hashes condition="contains">IMPHASH=bf6223a49e45d99094406777eb6004ba</Hashes> <!-- PetitPotam -->
+			<Hashes condition="contains">IMPHASH=0C106686A31BFE2BA931AE1CF6E9DBC6</Hashes> <!-- Mimikatz -->
+			<Hashes condition="contains">IMPHASH=0D1447D4B3259B3C2A1D4CFB7ECE13C3</Hashes> <!-- Mimikatz -->
+			<Hashes condition="contains">IMPHASH=1B0369A1E06271833F78FFA70FFB4EAF</Hashes> <!-- Mimikatz -->
+			<Hashes condition="contains">IMPHASH=4C1B52A19748428E51B14C278D0F58E3</Hashes> <!-- Mimikatz -->
+			<Hashes condition="contains">IMPHASH=4D927A711F77D62CEBD4F322CB57EC6F</Hashes> <!-- Mimikatz -->
+			<Hashes condition="contains">IMPHASH=66EE036DF5FC1004D9ED5E9A94A1086A</Hashes> <!-- Mimikatz -->
+			<Hashes condition="contains">IMPHASH=672B13F4A0B6F27D29065123FE882DFC</Hashes> <!-- Mimikatz -->
+			<Hashes condition="contains">IMPHASH=6BBD59CEA665C4AFCC2814C1327EC91F</Hashes> <!-- Mimikatz -->
+			<Hashes condition="contains">IMPHASH=725BB81DC24214F6ECACC0CFB36AD30D</Hashes> <!-- Mimikatz -->
+			<Hashes condition="contains">IMPHASH=9528A0E91E28FBB88AD433FEABCA2456</Hashes> <!-- Mimikatz -->
+			<Hashes condition="contains">IMPHASH=9DA6D5D77BE11712527DCAB86DF449A3</Hashes> <!-- Mimikatz -->
+			<Hashes condition="contains">IMPHASH=A6E01BC1AB89F8D91D9EAB72032AAE88</Hashes> <!-- Mimikatz -->
+			<Hashes condition="contains">IMPHASH=B24C5EDDAEA4FE50C6A96A2A133521E4</Hashes> <!-- Mimikatz -->
+			<Hashes condition="contains">IMPHASH=D21BBC50DCC169D7B4D0F01962793154</Hashes> <!-- Mimikatz -->
+			<Hashes condition="contains">IMPHASH=FCC251CCEAE90D22C392215CC9A2D5D6</Hashes> <!-- Mimikatz -->
+			<Hashes condition="contains">IMPHASH=23867A89C2B8FC733BE6CF5EF902F2D1</Hashes> <!-- JuicyPotato  -->
+			<Hashes condition="contains">IMPHASH=A37FF327F8D48E8A4D2F757E1B6E70BC</Hashes> <!-- JuicyPotato  -->
+			<Hashes condition="contains">IMPHASH=F9A28C458284584A93B14216308D31BD</Hashes> <!-- JuicyPotatoNG -->
+			<Hashes condition="contains">IMPHASH=6118619783FC175BC7EBECFF0769B46E</Hashes> <!-- RoguePotato -->
+			<Hashes condition="contains">IMPHASH=959A83047E80AB68B368FDB3F4C6E4EA</Hashes> <!-- RoguePotato -->
+			<Hashes condition="contains">IMPHASH=563233BFA169ACC7892451F71AD5850A</Hashes> <!-- RoguePotato -->
+			<Hashes condition="contains">IMPHASH=87575CB7A0E0700EB37F2E3668671A08</Hashes> <!-- RoguePotato -->
+			<Hashes condition="contains">IMPHASH=13F08707F759AF6003837A150A371BA1</Hashes> <!-- Pwdump -->
+			<Hashes condition="contains">IMPHASH=1781F06048A7E58B323F0B9259BE798B</Hashes> <!-- Pwdump -->
+			<Hashes condition="contains">IMPHASH=233F85F2D4BC9D6521A6CAAE11A1E7F5</Hashes> <!-- Pwdump -->
+			<Hashes condition="contains">IMPHASH=24AF2584CBF4D60BBE5C6D1B31B3BE6D</Hashes> <!-- Pwdump -->
+			<Hashes condition="contains">IMPHASH=632969DDF6DBF4E0F53424B75E4B91F2</Hashes> <!-- Pwdump -->
+			<Hashes condition="contains">IMPHASH=713C29B396B907ED71A72482759ED757</Hashes> <!-- Pwdump -->
+			<Hashes condition="contains">IMPHASH=749A7BB1F0B4C4455949C0B2BF7F9E9F</Hashes> <!-- Pwdump -->
+			<Hashes condition="contains">IMPHASH=8628B2608957A6B0C6330AC3DE28CE2E</Hashes> <!-- Pwdump -->
+			<Hashes condition="contains">IMPHASH=8B114550386E31895DFAB371E741123D</Hashes> <!-- Pwdump -->
+			<Hashes condition="contains">IMPHASH=94CB940A1A6B65BED4D5A8F849CE9793</Hashes> <!-- PwDumpX -->
+			<Hashes condition="contains">IMPHASH=9D68781980370E00E0BD939EE5E6C141</Hashes> <!-- Pwdump -->
+			<Hashes condition="contains">IMPHASH=B18A1401FF8F444056D29450FBC0A6CE</Hashes> <!-- Pwdump -->
+			<Hashes condition="contains">IMPHASH=CB567F9498452721D77A451374955F5F</Hashes> <!-- Pwdump -->
+			<Hashes condition="contains">IMPHASH=730073214094CD328547BF1F72289752</Hashes> <!-- Htran -->
+			<Hashes condition="contains">IMPHASH=17B461A082950FC6332228572138B80C</Hashes> <!-- Cobalt Strike beacons -->
+			<Hashes condition="contains">IMPHASH=DC25EE78E2EF4D36FAA0BADF1E7461C9</Hashes> <!-- Cobalt Strike beacons -->
+			<Hashes condition="contains">IMPHASH=819B19D53CA6736448F9325A85736792</Hashes> <!-- Cobalt Strike beacons -->
+			<Hashes condition="contains">IMPHASH=829DA329CE140D873B4A8BDE2CBFAA7E</Hashes> <!-- Cobalt Strike beacons -->
+			<Hashes condition="contains">IMPHASH=C547F2E66061A8DFFB6F5A3FF63C0A74</Hashes> <!-- PPLDump -->
+			<Hashes condition="contains">IMPHASH=0588081AB0E63BA785938467E1B10CCA</Hashes> <!-- PPLDump -->
+			<Hashes condition="contains">IMPHASH=0D9EC08BAC6C07D9987DFD0F1506587C</Hashes> <!-- NanoDump -->
+			<Hashes condition="contains">IMPHASH=BC129092B71C89B4D4C8CDF8EA590B29</Hashes> <!-- NanoDump -->
+			<Hashes condition="contains">IMPHASH=4DA924CF622D039D58BCE71CDF05D242</Hashes> <!-- NanoDump -->
+			<Hashes condition="contains">IMPHASH=E7A3A5C377E2D29324093377D7DB1C66</Hashes> <!-- NanoDump -->
+			<Hashes condition="contains">IMPHASH=9A9DBEC5C62F0380B4FA5FD31DEFFEDF</Hashes> <!-- NanoDump -->
+			<Hashes condition="contains">IMPHASH=AF8A3976AD71E5D5FDFB67DDB8DADFCE</Hashes> <!-- NanoDump -->
+			<Hashes condition="contains">IMPHASH=0C477898BBF137BBD6F2A54E3B805FF4</Hashes> <!-- NanoDump -->
+			<Hashes condition="contains">IMPHASH=0CA9F02B537BCEA20D4EA5EB1A9FE338</Hashes> <!-- NanoDump -->
+			<Hashes condition="contains">IMPHASH=3AB3655E5A14D4EEFC547F4781BF7F9E</Hashes> <!-- NanoDump -->
+			<Hashes condition="contains">IMPHASH=E6F9D5152DA699934B30DAAB206471F6</Hashes> <!-- NanoDump -->
+			<Hashes condition="contains">IMPHASH=3AD59991CCF1D67339B319B15A41B35D</Hashes> <!-- NanoDump -->
+			<Hashes condition="contains">IMPHASH=FFDD59E0318B85A3E480874D9796D872</Hashes> <!-- NanoDump -->
+			<Hashes condition="contains">IMPHASH=0CF479628D7CC1EA25EC7998A92F5051</Hashes> <!-- NanoDump -->
+			<Hashes condition="contains">IMPHASH=07A2D4DCBD6CB2C6A45E6B101F0B6D51</Hashes> <!-- NanoDump -->
+			<Hashes condition="contains">IMPHASH=D6D0F80386E1380D05CB78E871BC72B1</Hashes> <!-- NanoDump -->
+			<Hashes condition="contains">IMPHASH=38D9E015591BBFD4929E0D0F47FA0055</Hashes> <!-- HandleKatz -->
+			<Hashes condition="contains">IMPHASH=0E2216679CA6E1094D63322E3412D650</Hashes> <!-- HandleKatz -->
+			<Hashes condition="contains">IMPHASH=ADA161BF41B8E5E9132858CB54CAB5FB</Hashes> <!-- DripLoader -->
+			<Hashes condition="contains">IMPHASH=2A1BC4913CD5ECB0434DF07CB675B798</Hashes> <!-- DripLoader -->
+			<Hashes condition="contains">IMPHASH=11083E75553BAAE21DC89CE8F9A195E4</Hashes> <!-- DripLoader -->
+			<Hashes condition="contains">IMPHASH=A23D29C9E566F2FA8FFBB79267F5DF80</Hashes> <!-- DripLoader -->
+			<Hashes condition="contains">IMPHASH=4A07F944A83E8A7C2525EFA35DD30E2F</Hashes> <!-- CreateMiniDump -->
+			<Hashes condition="contains">IMPHASH=767637C23BB42CD5D7397CF58B0BE688</Hashes> <!-- UACMe Akagi -->
+			<Hashes condition="contains">IMPHASH=14C4E4C72BA075E9069EE67F39188AD8</Hashes> <!-- UACMe Akagi -->
+			<Hashes condition="contains">IMPHASH=3C782813D4AFCE07BBFC5A9772ACDBDC</Hashes> <!-- UACMe Akagi -->
+			<Hashes condition="contains">IMPHASH=7D010C6BB6A3726F327F7E239166D127</Hashes> <!-- UACMe Akagi -->
+			<Hashes condition="contains">IMPHASH=89159BA4DD04E4CE5559F132A9964EB3</Hashes> <!-- UACMe Akagi -->
+			<Hashes condition="contains">IMPHASH=6F33F4A5FC42B8CEC7314947BD13F30F</Hashes> <!-- UACMe Akagi -->
+			<Hashes condition="contains">IMPHASH=5834ED4291BDEB928270428EBBAF7604</Hashes> <!-- UACMe Akagi -->
+			<Hashes condition="contains">IMPHASH=5A8A8A43F25485E7EE1B201EDCBC7A38</Hashes> <!-- UACMe Akagi -->
+			<Hashes condition="contains">IMPHASH=DC7D30B90B2D8ABF664FBED2B1B59894</Hashes> <!-- UACMe Akagi -->
+			<Hashes condition="contains">IMPHASH=41923EA1F824FE63EA5BEB84DB7A3E74</Hashes> <!-- UACMe Akagi -->
+			<Hashes condition="contains">IMPHASH=3DE09703C8E79ED2CA3F01074719906B</Hashes> <!-- UACMe Akagi -->
+			<Hashes condition="contains">IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F</Hashes> <!-- WCE -->
+			<Hashes condition="contains">IMPHASH=E96A73C7BF33A464C510EDE582318BF2</Hashes> <!-- WCE -->
+			<Hashes condition="contains">IMPHASH=32089B8851BBF8BC2D014E9F37288C83</Hashes> <!-- Sliver Stagers -->
+			<Hashes condition="contains">IMPHASH=09D278F9DE118EF09163C6140255C690</Hashes> <!-- Dumpert -->
+			<Hashes condition="contains">IMPHASH=03866661686829d806989e2fc5a72606</Hashes> <!-- Dumpert -->
+			<Hashes condition="contains">IMPHASH=e57401fbdadcd4571ff385ab82bd5d6d</Hashes> <!-- Dumpert -->
+			<Hashes condition="contains">IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE</Hashes> <!-- SysmonEnte -->
+			<Hashes condition="contains">IMPHASH=19584675D94829987952432E018D5056</Hashes> <!-- SysmonQuiet -->
+			<Hashes condition="contains">IMPHASH=330768A4F172E10ACB6287B87289D83B</Hashes> <!-- ShaprEvtMute Hook -->
+			<Hashes condition="contains">IMPHASH=885C99CCFBE77D1CBFCB9C4E7C1A3313</Hashes> <!-- Forkatz -->
+			<Hashes condition="contains">IMPHASH=22A22BC9E4E0D2F189F1EA01748816AC</Hashes> <!-- PPLKiller -->
+			<Hashes condition="contains">IMPHASH=7FA30E6BB7E8E8A69155636E50BF1B28</Hashes> <!-- PPLKiller -->
+			<Hashes condition="contains">IMPHASH=96DF3A3731912449521F6F8D183279B1</Hashes> <!-- Backstab -->
+			<Hashes condition="contains">IMPHASH=7E6CF3FF4576581271AC8A313B2AAB46</Hashes> <!-- Backstab -->
+			<Hashes condition="contains">IMPHASH=51791678F351C03A0EB4E2A7B05C6E17</Hashes> <!-- Backstab -->
+			<Hashes condition="contains">MD5=7B17F15713FCF13C764535AA2BDF52AA</Hashes>													<!-- ShaprEvtMute -->
+			<Hashes condition="contains">SHA1=4E18320493042BCD7D21B53E258974BC460ACC78</Hashes>										<!-- ShaprEvtMute -->
+			<Hashes condition="contains">SHA256=477DFE485F5BD9540CC83E88FC04AAFB6DE49CF1ADC6BD857D5D6F4C1730A6D1</Hashes>	<!-- ShaprEvtMute -->
+			
+			<!-- Microsoft Office Programs Dropping Executables -->
+			<Image condition="image">winword.exe</Image>
+			<Image condition="image">excel.exe</Image>
+			<Image condition="image">powerpnt.exe</Image>
+			<Image condition="image">msaccess.exe</Image>
+			<Image condition="image">mspub.exe</Image>
+			<Image condition="image">eqnedt32.exe</Image>
+			<Image condition="image">visio.exe</Image>
+			<Image condition="image">wordpad.exe</Image>
+			<Image condition="image">wordview.exe</Image>
+			<Image condition="image">msohtmed.exe</Image>
+			
+			<!-- OneNote Application Dropping Executables -->
+			<Image condition="image">onenote.exe</Image>
+			<Image condition="image">onenotem.exe</Image>
+			<Image condition="image">onenoteim.exe</Image>
+			
+			<!-- LOLBINs that can be used to download executables -->
+			<Image condition="image">certutil.exe</Image>
+			<Image condition="image">certoc.exe</Image>
+			<Image condition="image">CertReq.exe</Image>
+			<!-- <Image condition="image">bitsadmin.exe</Image> (depends on the environment; comment in if you're sure that bitsadmin doesn't do that in your env) -->
+			<Image condition="image">Desktopimgdownldr.exe</Image>
+			<Image condition="image">esentutl.exe</Image>
+			<!-- <Image condition="image">expand.exe</Image> (depends on the environment; comment in if you're sure that expand doesn't do that in your env) -->
+			<Image condition="image">finger.exe</Image>
+			<Image condition="image">presentationhost.exe</Image>
+
+			<!-- Executables that should never drop an executable to disk (but may after a previous process injection or if it's malware that uses a legitimate name)-->
+			<Image condition="image">notepad.exe</Image>
+			<Image condition="image">AcroRd32.exe</Image>
+			<Image condition="image">RdrCEF.exe</Image> <!-- RdrCEF was seen dropping a DLL in temp (Example: \AppData\Local\Temp\acrocef_low\4616_1623006624_platform_specific\win_x86\widevinecdm.dll). Comment out this entry if you experience issues (https://github.com/Neo23x0/sysmon-config/issues/43) -->
+			<Image condition="image">mshta.exe</Image>
+			<Image condition="image">hh.exe</Image>
+			<Image condition="image">calc.exe</Image>
+			<Image condition="image">mspaint.exe</Image>
+		</FileExecutableDetected>
+	</RuleGroup>
+
 	</EventFiltering>
 </Sysmon>

From 87be34c83911b2cb20d49120306b940242cde613 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Wed, 28 Jun 2023 22:28:15 +0200
Subject: [PATCH 140/149] loldrivers rules

---
 sysmonconfig-export.xml | 1584 ++++++++++++++++++++++++++++++++++++++-
 1 file changed, 1583 insertions(+), 1 deletion(-)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 5d26e3b5..09429012 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -1440,7 +1440,7 @@
 			<TargetFilename condition="end with">\EvtMuteHook.dll</TargetFilename>
 			<TargetFilename condition="end with">\SysmonEOP.exe</TargetFilename>
 
-			<!-- Hacktool Blocks based on Imphashes -->
+			<!-- Hacktools based on Imphashes -->
 			<Hashes condition="contains">IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932</Hashes> <!-- PetitPotam -->
 			<Hashes condition="contains">IMPHASH=3A19059BD7688CB88E70005F18EFC439</Hashes> <!-- PetitPotam -->
 			<Hashes condition="contains">IMPHASH=bf6223a49e45d99094406777eb6004ba</Hashes> <!-- PetitPotam -->
@@ -1534,6 +1534,7 @@
 			<Hashes condition="contains">IMPHASH=96DF3A3731912449521F6F8D183279B1</Hashes> <!-- Backstab -->
 			<Hashes condition="contains">IMPHASH=7E6CF3FF4576581271AC8A313B2AAB46</Hashes> <!-- Backstab -->
 			<Hashes condition="contains">IMPHASH=51791678F351C03A0EB4E2A7B05C6E17</Hashes> <!-- Backstab -->
+			<Hashes condition="contains">IMPHASH=25CE42B079282632708FC846129E98A5</Hashes> <!-- Forensia -->
 			<Hashes condition="contains">MD5=7B17F15713FCF13C764535AA2BDF52AA</Hashes>													<!-- ShaprEvtMute -->
 			<Hashes condition="contains">SHA1=4E18320493042BCD7D21B53E258974BC460ACC78</Hashes>										<!-- ShaprEvtMute -->
 			<Hashes condition="contains">SHA256=477DFE485F5BD9540CC83E88FC04AAFB6DE49CF1ADC6BD857D5D6F4C1730A6D1</Hashes>	<!-- ShaprEvtMute -->
@@ -1577,5 +1578,1586 @@
 		</FileExecutableDetected>
 	</RuleGroup>
 
+	<!-- LOL DRIVER Sysmon Rules -->
+		<!--COMMENT: The following rule groups were imported from the LOLDrivers project
+
+			Note: We use only the SHA256 hash of the drivers for performance reasons, since this config generates MD5 and SHA256 hashes (see <HashAlgorithms>)
+
+			Syncronisation date: 28.06.2023
+			[ https://github.com/magicsword-io/LOLDrivers/tree/main/detections/sysmon ]
+		-->
+
+		<RuleGroup name="Malicious Driver Load" groupRelation="or">
+			<DriverLoad onmatch="include">
+                <Hashes condition="contains">SHA256=56066ed07bad3b5c1474e8fae5ee2543d17d7977369b34450bd0775517e3b25c</Hashes>
+                <Hashes condition="contains">SHA256=06a0ec9a316eb89cb041b1907918e3ad3b03842ec65f004f6fa74d57955573a4</Hashes>
+                <Hashes condition="contains">SHA256=86047bb1969d1db455493955fd450d18c62a3f36294d0a6c3732c88dfbcc4f62</Hashes>
+                <Hashes condition="contains">SHA256=06c5ebd0371342d18bc81a96f5e5ce28de64101e3c2fd0161d0b54d8368d2f1f</Hashes>
+                <Hashes condition="contains">SHA256=8dafe5f3d0527b66f6857559e3c81872699003e0f2ffda9202a1b5e29db2002e</Hashes>
+                <Hashes condition="contains">SHA256=81c7bb39100d358f8286da5e9aa838606c98dfcc263e9a82ed91cd438cb130d1</Hashes>
+                <Hashes condition="contains">SHA256=6661320f779337b95bbbe1943ee64afb2101c92f92f3d1571c1bf4201c38c724</Hashes>
+                <Hashes condition="contains">SHA256=ea50f22daade04d3ca06dedb497b905215cba31aae7b4cab4b533fda0c5be620</Hashes>
+                <Hashes condition="contains">SHA256=0440ef40c46fdd2b5d86e7feef8577a8591de862cfd7928cdbcc8f47b8fa3ffc</Hashes>
+                <Hashes condition="contains">SHA256=c0d88db11d0f529754d290ed5f4c34b4dba8c4f2e5c4148866daabeab0d25f9c</Hashes>
+                <Hashes condition="contains">SHA256=e1cb86386757b947b39086cc8639da988f6e8018ca9995dd669bdc03c8d39d7d</Hashes>
+                <Hashes condition="contains">SHA256=18c909a2b8c5e16821d6ef908f56881aa0ecceeaccb5fa1e54995935fcfd12f7</Hashes>
+                <Hashes condition="contains">SHA256=139f8412a7c6fdc43dcfbbcdba256ee55654eb36a40f338249d5162a1f69b988</Hashes>
+                <Hashes condition="contains">SHA256=b0eb4d999e4e0e7c2e33ff081e847c87b49940eb24a9e0794c6aa9516832c427</Hashes>
+                <Hashes condition="contains">SHA256=1485c0ed3e875cbdfc6786a5bd26d18ea9d31727deb8df290a1c00c780419a4e</Hashes>
+                <Hashes condition="contains">SHA256=6b5cf41512255237064e9274ca8f8a3fef820c45aa6067c9c6a0e6f5751a0421</Hashes>
+                <Hashes condition="contains">SHA256=0d10c4b2f56364b475b60bd2933273c8b1ed2176353e59e65f968c61e93b7d99</Hashes>
+                <Hashes condition="contains">SHA256=ad938d15ecfd70083c474e1642a88b078c3cea02cdbddf66d4fb1c01b9b29d9a</Hashes>
+                <Hashes condition="contains">SHA256=89698cad598a56f9e45efffd15d1841e494a2409cc12279150a03842cd6bb7f3</Hashes>
+                <Hashes condition="contains">SHA256=5f6fec8f7890d032461b127332759c88a1b7360aa10c6bd38482572f59d2ba8b</Hashes>
+                <Hashes condition="contains">SHA256=fa9abb3e7e06f857be191a1e049dd37642ec41fb2520c105df2227fcac3de5d5</Hashes>
+                <Hashes condition="contains">SHA256=05b146a48a69dd62a02759487e769bd30d39f16374bc76c86453b4ae59e7ffa4</Hashes>
+                <Hashes condition="contains">SHA256=6994b32e3f3357f4a1d0abe81e8b62dd54e36b17816f2f1a80018584200a1b77</Hashes>
+                <Hashes condition="contains">SHA256=6908ebf52eb19c6719a0b508d1e2128f198d10441551cbfb9f4031d382f5229f</Hashes>
+                <Hashes condition="contains">SHA256=32882949ea084434a376451ff8364243a50485a3b4af2f2240bb5f20c164543d</Hashes>
+                <Hashes condition="contains">SHA256=fd223833abffa9cd6cc1848d77599673643585925a7ee51259d67c44d361cce8</Hashes>
+                <Hashes condition="contains">SHA256=6839fcae985774427c65fe38e773aa96ec451a412caa5354ad9e2b9b54ffe6c1</Hashes>
+                <Hashes condition="contains">SHA256=f9f2091fccb289bcf6a945f6b38676ec71dedb32f3674262928ccaf840ca131a</Hashes>
+                <Hashes condition="contains">SHA256=7a7e8df7173387aec593e4fe2b45520ea3156c5f810d2bb1b2784efd1c922376</Hashes>
+                <Hashes condition="contains">SHA256=96bf3ee7c6673b69c6aa173bb44e21fa636b1c2c73f4356a7599c121284a51cc</Hashes>
+                <Hashes condition="contains">SHA256=b9dad0131c51e2645e761b74a71ebad2bf175645fa9f42a4ab0e6921b83306e3</Hashes>
+                <Hashes condition="contains">SHA256=e6a7b0bc01a627a7d0ffb07faddb3a4dd96b6f5208ac26107bdaeb3ab1ec8217</Hashes>
+                <Hashes condition="contains">SHA256=200f98655d1f46d2599c2c8605ebb7e335fee3883a32135ca1a81e09819bc64a</Hashes>
+                <Hashes condition="contains">SHA256=8d9a2363b757d3f127b9c6ed8f7b8b018e652369bc070aa3500b3a978feaa6ce</Hashes>
+                <Hashes condition="contains">SHA256=c8f9e1ad7b8cce62fba349a00bc168c849d42cfb2ca5b2c6cc4b51d054e0c497</Hashes>
+                <Hashes condition="contains">SHA256=23e89fd30a1c7db37f3ea81b779ce9acf8a4294397cbb54cff350d54afcfd931</Hashes>
+                <Hashes condition="contains">SHA256=575e58b62afab094c20c296604dc3b7dd2e1a50f5978d8ee24b7dca028e97316</Hashes>
+                <Hashes condition="contains">SHA256=5b932eab6c67f62f097a3249477ac46d80ddccdc52654f8674060b4ddf638e5d</Hashes>
+                <Hashes condition="contains">SHA256=e6f764c3b5580cd1675cbf184938ad5a201a8c096607857869bd7c3399df0d12</Hashes>
+                <Hashes condition="contains">SHA256=9bb09752cf3a464455422909edef518ac18fe63cf5e1e8d9d6c2e68db62e0c87</Hashes>
+                <Hashes condition="contains">SHA256=f8236fc01d4efaa48f032e301be2ebba4036b2cd945982a29046eca03944d2ae</Hashes>
+                <Hashes condition="contains">SHA256=e7af7bcb86bd6bab1835f610671c3921441965a839673ac34444cf0ce7b2164e</Hashes>
+                <Hashes condition="contains">SHA256=9b1b15a3aacb0e786a608726c3abfc94968915cedcbd239ddf903c4a54bfcf0c</Hashes>
+                <Hashes condition="contains">SHA256=f936ec4c8164cbd31add659b61c16cb3a717eac90e74d89c47afb96b60120280</Hashes>
+                <Hashes condition="contains">SHA256=9c2f3e9811f7d0c7463eaa1ee6f39c23f902f3797b80891590b43bbe0fdf0e51</Hashes>
+                <Hashes condition="contains">SHA256=b8807e365be2813b7eccd2e4c49afb0d1e131086715638b7a6307cd7d7e9556c</Hashes>
+                <Hashes condition="contains">SHA256=50819a1add4c81c0d53203592d6803f022443440935ff8260ff3b6d5253c0c76</Hashes>
+                <Hashes condition="contains">SHA256=52d5c35325ce701516f8b04380c9fbdb78ec6bcc13b444f758fdb03d545b0677</Hashes>
+                <Hashes condition="contains">SHA256=7f4555a940ce1156c9bcea9a2a0b801f9a5e44ec9400b61b14a7b1a6404ffdf6</Hashes>
+                <Hashes condition="contains">SHA256=8e035beb02a411f8a9e92d4cf184ad34f52bbd0a81a50c222cdd4706e4e45104</Hashes>
+                <Hashes condition="contains">SHA256=8578bff36e3b02cc71495b647db88c67c3c5ca710b5a2bd539148550595d0330</Hashes>
+                <Hashes condition="contains">SHA256=4734a0a5d88f44a4939b8d812364cab6ca5f611b9b8ceebe27df6c1ed3a6d8a4</Hashes>
+                <Hashes condition="contains">SHA256=88076e98d45ed3adf0c5355411fe8ca793eb7cec1a1c61f5e1ec337eae267463</Hashes>
+                <Hashes condition="contains">SHA256=749b0e8c8c8b7dda8c2063c708047cfe95afa0a4d86886b31a12f3018396e67c</Hashes>
+                <Hashes condition="contains">SHA256=49c827cf48efb122a9d6fd87b426482b7496ccd4a2dbca31ebbf6b2b80c98530</Hashes>
+                <Hashes condition="contains">SHA256=d7c81b0f3c14844f6424e8bdd31a128e773cb96cccef6d05cbff473f0ccb9f9c</Hashes>
+                <Hashes condition="contains">SHA256=f6c316e2385f2694d47e936b0ac4bc9b55e279d530dd5e805f0d963cb47c3c0d</Hashes>
+                <Hashes condition="contains">SHA256=5c1585b1a1c956c7755429544f3596515dfdf928373620c51b0606a520c6245a</Hashes>
+                <Hashes condition="contains">SHA256=5bc3994612624da168750455b363f2964e1861dba4f1c305df01b970ac02a7ae</Hashes>
+                <Hashes condition="contains">SHA256=bb2422e96ea993007f25c71d55b2eddfa1e940c89e895abb50dd07d7c17ca1df</Hashes>
+                <Hashes condition="contains">SHA256=42b22faa489b5de936db33f12184f6233198bdf851a18264d31210207827ba25</Hashes>
+                <Hashes condition="contains">SHA256=f461414a2596555cece5cfee65a3c22648db0082ca211f6238af8230e41b3212</Hashes>
+                <Hashes condition="contains">SHA256=770f33259d6fb10f4a32d8a57d0d12953e8455c72bb7b60cb39ce505c507013a</Hashes>
+			</DriverLoad>
+		</RuleGroup>
+
+		<RuleGroup name="Malicious Driver Drop Detected" groupRelation="or">
+			<FileExecutableDetected onmatch="include">
+                <Hashes condition="contains">SHA256=56066ed07bad3b5c1474e8fae5ee2543d17d7977369b34450bd0775517e3b25c</Hashes>
+                <Hashes condition="contains">SHA256=06a0ec9a316eb89cb041b1907918e3ad3b03842ec65f004f6fa74d57955573a4</Hashes>
+                <Hashes condition="contains">SHA256=86047bb1969d1db455493955fd450d18c62a3f36294d0a6c3732c88dfbcc4f62</Hashes>
+                <Hashes condition="contains">SHA256=06c5ebd0371342d18bc81a96f5e5ce28de64101e3c2fd0161d0b54d8368d2f1f</Hashes>
+                <Hashes condition="contains">SHA256=8dafe5f3d0527b66f6857559e3c81872699003e0f2ffda9202a1b5e29db2002e</Hashes>
+                <Hashes condition="contains">SHA256=81c7bb39100d358f8286da5e9aa838606c98dfcc263e9a82ed91cd438cb130d1</Hashes>
+                <Hashes condition="contains">SHA256=6661320f779337b95bbbe1943ee64afb2101c92f92f3d1571c1bf4201c38c724</Hashes>
+                <Hashes condition="contains">SHA256=ea50f22daade04d3ca06dedb497b905215cba31aae7b4cab4b533fda0c5be620</Hashes>
+                <Hashes condition="contains">SHA256=0440ef40c46fdd2b5d86e7feef8577a8591de862cfd7928cdbcc8f47b8fa3ffc</Hashes>
+                <Hashes condition="contains">SHA256=c0d88db11d0f529754d290ed5f4c34b4dba8c4f2e5c4148866daabeab0d25f9c</Hashes>
+                <Hashes condition="contains">SHA256=e1cb86386757b947b39086cc8639da988f6e8018ca9995dd669bdc03c8d39d7d</Hashes>
+                <Hashes condition="contains">SHA256=18c909a2b8c5e16821d6ef908f56881aa0ecceeaccb5fa1e54995935fcfd12f7</Hashes>
+                <Hashes condition="contains">SHA256=139f8412a7c6fdc43dcfbbcdba256ee55654eb36a40f338249d5162a1f69b988</Hashes>
+                <Hashes condition="contains">SHA256=b0eb4d999e4e0e7c2e33ff081e847c87b49940eb24a9e0794c6aa9516832c427</Hashes>
+                <Hashes condition="contains">SHA256=1485c0ed3e875cbdfc6786a5bd26d18ea9d31727deb8df290a1c00c780419a4e</Hashes>
+                <Hashes condition="contains">SHA256=6b5cf41512255237064e9274ca8f8a3fef820c45aa6067c9c6a0e6f5751a0421</Hashes>
+                <Hashes condition="contains">SHA256=0d10c4b2f56364b475b60bd2933273c8b1ed2176353e59e65f968c61e93b7d99</Hashes>
+                <Hashes condition="contains">SHA256=ad938d15ecfd70083c474e1642a88b078c3cea02cdbddf66d4fb1c01b9b29d9a</Hashes>
+                <Hashes condition="contains">SHA256=89698cad598a56f9e45efffd15d1841e494a2409cc12279150a03842cd6bb7f3</Hashes>
+                <Hashes condition="contains">SHA256=5f6fec8f7890d032461b127332759c88a1b7360aa10c6bd38482572f59d2ba8b</Hashes>
+                <Hashes condition="contains">SHA256=fa9abb3e7e06f857be191a1e049dd37642ec41fb2520c105df2227fcac3de5d5</Hashes>
+                <Hashes condition="contains">SHA256=05b146a48a69dd62a02759487e769bd30d39f16374bc76c86453b4ae59e7ffa4</Hashes>
+                <Hashes condition="contains">SHA256=6994b32e3f3357f4a1d0abe81e8b62dd54e36b17816f2f1a80018584200a1b77</Hashes>
+                <Hashes condition="contains">SHA256=6908ebf52eb19c6719a0b508d1e2128f198d10441551cbfb9f4031d382f5229f</Hashes>
+                <Hashes condition="contains">SHA256=32882949ea084434a376451ff8364243a50485a3b4af2f2240bb5f20c164543d</Hashes>
+                <Hashes condition="contains">SHA256=fd223833abffa9cd6cc1848d77599673643585925a7ee51259d67c44d361cce8</Hashes>
+                <Hashes condition="contains">SHA256=6839fcae985774427c65fe38e773aa96ec451a412caa5354ad9e2b9b54ffe6c1</Hashes>
+                <Hashes condition="contains">SHA256=f9f2091fccb289bcf6a945f6b38676ec71dedb32f3674262928ccaf840ca131a</Hashes>
+                <Hashes condition="contains">SHA256=7a7e8df7173387aec593e4fe2b45520ea3156c5f810d2bb1b2784efd1c922376</Hashes>
+                <Hashes condition="contains">SHA256=96bf3ee7c6673b69c6aa173bb44e21fa636b1c2c73f4356a7599c121284a51cc</Hashes>
+                <Hashes condition="contains">SHA256=b9dad0131c51e2645e761b74a71ebad2bf175645fa9f42a4ab0e6921b83306e3</Hashes>
+                <Hashes condition="contains">SHA256=e6a7b0bc01a627a7d0ffb07faddb3a4dd96b6f5208ac26107bdaeb3ab1ec8217</Hashes>
+                <Hashes condition="contains">SHA256=200f98655d1f46d2599c2c8605ebb7e335fee3883a32135ca1a81e09819bc64a</Hashes>
+                <Hashes condition="contains">SHA256=8d9a2363b757d3f127b9c6ed8f7b8b018e652369bc070aa3500b3a978feaa6ce</Hashes>
+                <Hashes condition="contains">SHA256=c8f9e1ad7b8cce62fba349a00bc168c849d42cfb2ca5b2c6cc4b51d054e0c497</Hashes>
+                <Hashes condition="contains">SHA256=23e89fd30a1c7db37f3ea81b779ce9acf8a4294397cbb54cff350d54afcfd931</Hashes>
+                <Hashes condition="contains">SHA256=575e58b62afab094c20c296604dc3b7dd2e1a50f5978d8ee24b7dca028e97316</Hashes>
+                <Hashes condition="contains">SHA256=5b932eab6c67f62f097a3249477ac46d80ddccdc52654f8674060b4ddf638e5d</Hashes>
+                <Hashes condition="contains">SHA256=e6f764c3b5580cd1675cbf184938ad5a201a8c096607857869bd7c3399df0d12</Hashes>
+                <Hashes condition="contains">SHA256=9bb09752cf3a464455422909edef518ac18fe63cf5e1e8d9d6c2e68db62e0c87</Hashes>
+                <Hashes condition="contains">SHA256=f8236fc01d4efaa48f032e301be2ebba4036b2cd945982a29046eca03944d2ae</Hashes>
+                <Hashes condition="contains">SHA256=e7af7bcb86bd6bab1835f610671c3921441965a839673ac34444cf0ce7b2164e</Hashes>
+                <Hashes condition="contains">SHA256=9b1b15a3aacb0e786a608726c3abfc94968915cedcbd239ddf903c4a54bfcf0c</Hashes>
+                <Hashes condition="contains">SHA256=f936ec4c8164cbd31add659b61c16cb3a717eac90e74d89c47afb96b60120280</Hashes>
+                <Hashes condition="contains">SHA256=9c2f3e9811f7d0c7463eaa1ee6f39c23f902f3797b80891590b43bbe0fdf0e51</Hashes>
+                <Hashes condition="contains">SHA256=b8807e365be2813b7eccd2e4c49afb0d1e131086715638b7a6307cd7d7e9556c</Hashes>
+                <Hashes condition="contains">SHA256=50819a1add4c81c0d53203592d6803f022443440935ff8260ff3b6d5253c0c76</Hashes>
+                <Hashes condition="contains">SHA256=52d5c35325ce701516f8b04380c9fbdb78ec6bcc13b444f758fdb03d545b0677</Hashes>
+                <Hashes condition="contains">SHA256=7f4555a940ce1156c9bcea9a2a0b801f9a5e44ec9400b61b14a7b1a6404ffdf6</Hashes>
+                <Hashes condition="contains">SHA256=8e035beb02a411f8a9e92d4cf184ad34f52bbd0a81a50c222cdd4706e4e45104</Hashes>
+                <Hashes condition="contains">SHA256=8578bff36e3b02cc71495b647db88c67c3c5ca710b5a2bd539148550595d0330</Hashes>
+                <Hashes condition="contains">SHA256=4734a0a5d88f44a4939b8d812364cab6ca5f611b9b8ceebe27df6c1ed3a6d8a4</Hashes>
+                <Hashes condition="contains">SHA256=88076e98d45ed3adf0c5355411fe8ca793eb7cec1a1c61f5e1ec337eae267463</Hashes>
+                <Hashes condition="contains">SHA256=749b0e8c8c8b7dda8c2063c708047cfe95afa0a4d86886b31a12f3018396e67c</Hashes>
+                <Hashes condition="contains">SHA256=49c827cf48efb122a9d6fd87b426482b7496ccd4a2dbca31ebbf6b2b80c98530</Hashes>
+                <Hashes condition="contains">SHA256=d7c81b0f3c14844f6424e8bdd31a128e773cb96cccef6d05cbff473f0ccb9f9c</Hashes>
+                <Hashes condition="contains">SHA256=f6c316e2385f2694d47e936b0ac4bc9b55e279d530dd5e805f0d963cb47c3c0d</Hashes>
+                <Hashes condition="contains">SHA256=5c1585b1a1c956c7755429544f3596515dfdf928373620c51b0606a520c6245a</Hashes>
+                <Hashes condition="contains">SHA256=5bc3994612624da168750455b363f2964e1861dba4f1c305df01b970ac02a7ae</Hashes>
+                <Hashes condition="contains">SHA256=bb2422e96ea993007f25c71d55b2eddfa1e940c89e895abb50dd07d7c17ca1df</Hashes>
+                <Hashes condition="contains">SHA256=42b22faa489b5de936db33f12184f6233198bdf851a18264d31210207827ba25</Hashes>
+                <Hashes condition="contains">SHA256=f461414a2596555cece5cfee65a3c22648db0082ca211f6238af8230e41b3212</Hashes>
+                <Hashes condition="contains">SHA256=770f33259d6fb10f4a32d8a57d0d12953e8455c72bb7b60cb39ce505c507013a</Hashes>
+			</FileExecutableDetected>
+		</RuleGroup>
+
+		<RuleGroup name="Vulnerable Driver Load" groupRelation="or">
+			<DriverLoad onmatch="include">
+                <Hashes condition="contains">SHA256=7ad0ab23023bc500c3b46f414a8b363c5f8700861bc4745cecc14dd34bcee9ed</Hashes>
+                <Hashes condition="contains">SHA256=9529efb1837b1005e5e8f477773752078e0a46500c748bc30c9b5084d04082e6</Hashes>
+                <Hashes condition="contains">SHA256=0bc3685b0b8adc97931b5d31348da235cd7581a67edf6d79913e6a5709866135</Hashes>
+                <Hashes condition="contains">SHA256=ce23c2dae4cca4771ea50ec737093dfafac06c64db0f924a1ccbbf687e33f5a2</Hashes>
+                <Hashes condition="contains">SHA256=b1334a71cc73b3d0c54f62d8011bec330dfc355a239bf94a121f6e4c86a30a2e</Hashes>
+                <Hashes condition="contains">SHA256=4da08c0681fbe028b60a1eaf5cb8890bd3eba4d0e6a8b976495ddcd315e147ba</Hashes>
+                <Hashes condition="contains">SHA256=45c3d607cb57a1714c1c604a25cbadf2779f4734855d0e43aa394073b6966b26</Hashes>
+                <Hashes condition="contains">SHA256=b1d96233235a62dbb21b8dbe2d1ae333199669f67664b107bff1ad49b41d9414</Hashes>
+                <Hashes condition="contains">SHA256=bcfc2c9883e6c1b8429be44cc4db988a9eecb544988fbd756d18cfca6201876f</Hashes>
+                <Hashes condition="contains">SHA256=eea53103e7a5a55dc1df79797395a2a3e96123ebd71cdd2db4b1be80e7b3f02b</Hashes>
+                <Hashes condition="contains">SHA256=c725919e6357126d512c638f993cf572112f323da359645e4088f789eb4c7b8c</Hashes>
+                <Hashes condition="contains">SHA256=42f0b036687cbd7717c9efed6991c00d4e3e7b032dc965a2556c02177dfdad0f</Hashes>
+                <Hashes condition="contains">SHA256=3326e2d32bbabd69feb6024809afc56c7e39241ebe70a53728c77e80995422a5</Hashes>
+                <Hashes condition="contains">SHA256=76e807b6c0214e66455f09a8de8faad40b738982ca84470f0043de0290449524</Hashes>
+                <Hashes condition="contains">SHA256=7aaf2aa194b936e48bc90f01ee854768c8383c0be50cfb41b346666aec0cf853</Hashes>
+                <Hashes condition="contains">SHA256=cb57f3a7fe9e1f8e63332c563b0a319b26c944be839eabc03e9a3277756ba612</Hashes>
+                <Hashes condition="contains">SHA256=84bf1d0bcdf175cfe8aea2973e0373015793d43907410ae97e2071b2c4b8e2d4</Hashes>
+                <Hashes condition="contains">SHA256=16768203a471a19ebb541c942f45716e9f432985abbfbe6b4b7d61a798cea354</Hashes>
+                <Hashes condition="contains">SHA256=fd8669794c67b396c12fc5f08e9c004fdf851a82faf302846878173e4fbecb03</Hashes>
+                <Hashes condition="contains">SHA256=362c4f3dadc9c393682664a139d65d80e32caa2a97b6e0361dfd713a73267ecc</Hashes>
+                <Hashes condition="contains">SHA256=04a85e359525d662338cae86c1e59b1d7aa9bd12b920e8067503723dc1e03162</Hashes>
+                <Hashes condition="contains">SHA256=49ed27460730b62403c1d2e4930573121ab0c86c442854bc0a62415ca445a810</Hashes>
+                <Hashes condition="contains">SHA256=8c95d28270a4a314299cf50f05dcbe63033b2a555195d2ad2f678e09e00393e6</Hashes>
+                <Hashes condition="contains">SHA256=ff9623317287358440ec67da9ba79994d9b17b99ffdd709ec836478fe1fc22a5</Hashes>
+                <Hashes condition="contains">SHA256=b61869b7945be062630f1dd4bae919aecee8927f7e1bc3954a21ff763f4c0867</Hashes>
+                <Hashes condition="contains">SHA256=dbc604b4e01362a3e51357af4a87686834fe913852a4e0a8c0d4c1a0f7d076ed</Hashes>
+                <Hashes condition="contains">SHA256=a961f5939088238d76757669a9a81905e33f247c9c635b908daac146ae063499</Hashes>
+                <Hashes condition="contains">SHA256=e5b0772be02e2bc807804874cf669e97aa36f5aff1f12fa0a631a3c7b4dd0dc8</Hashes>
+                <Hashes condition="contains">SHA256=aebcbfca180e372a048b682a4859fd520c98b5b63f6e3a627c626cb35adc0399</Hashes>
+                <Hashes condition="contains">SHA256=4e3eb5b9bce2fd9f6878ae36288211f0997f6149aa8c290ed91228ba4cdfae80</Hashes>
+                <Hashes condition="contains">SHA256=1a4f7d7926efc3e3488758ce318246ea78a061bde759ec6c906ff005dd8213e5</Hashes>
+                <Hashes condition="contains">SHA256=f929bead59e9424ab90427b379dcdd63fbfe0c4fb5e1792e3a1685541cd5ec65</Hashes>
+                <Hashes condition="contains">SHA256=7b0f442ac0bb183906700097d65aed0b4b9d8678f9a01aca864854189fe368e7</Hashes>
+                <Hashes condition="contains">SHA256=c344e92a6d06155a217a9af7b4b35e6653665eec6569292e7b2e70f3a3027646</Hashes>
+                <Hashes condition="contains">SHA256=8cfd5b2102fbc77018c7fe6019ec15f07da497f6d73c32a31f4ba07e67ec85d9</Hashes>
+                <Hashes condition="contains">SHA256=99f4994a0e5bd1bf6e3f637d3225c69ff4cd620557e23637533e7f18d7d6cba1</Hashes>
+                <Hashes condition="contains">SHA256=89b9823ed974a5b71de8468324d45b7e9d6dc914f93615ba86c6209b25b3cbf7</Hashes>
+                <Hashes condition="contains">SHA256=d5586dc1e61796a9ae5e5d1ced397874753056c3df2eb963a8916287e1929a71</Hashes>
+                <Hashes condition="contains">SHA256=36b9e31240ab0341873c7092b63e2e0f2cab2962ebf9b25271c3a1216b7669eb</Hashes>
+                <Hashes condition="contains">SHA256=0b2ad05939b0aabbdc011082fad7960baa0c459ec16a2b29f37c1fa31795a46d</Hashes>
+                <Hashes condition="contains">SHA256=30706f110725199e338e9cc1c940d9a644d19a14f0eb8847712cba4cacda67ab</Hashes>
+                <Hashes condition="contains">SHA256=af1011c76a22af7be97a0b3e0ce11aca0509820c59fa7c8eeaaa1b2c0225f75a</Hashes>
+                <Hashes condition="contains">SHA256=8c748ae5dcc10614cc134064c99367d28f3131d1f1dda0c9c29e99279dc1bdd9</Hashes>
+                <Hashes condition="contains">SHA256=cbb8239a765bf5b2c1b6a5c8832d2cab8fef5deacadfb65d8ed43ef56d291ab6</Hashes>
+                <Hashes condition="contains">SHA256=025e7be9fcefd6a83f4471bba0c11f1c11bd5047047d26626da24ee9a419cdc4</Hashes>
+                <Hashes condition="contains">SHA256=d5562fb90b0b3deb633ab335bcbd82ce10953466a428b3f27cb5b226b453eaf3</Hashes>
+                <Hashes condition="contains">SHA256=900dd68ccc72d73774a347b3290c4b6153ae496a81de722ebb043e2e99496f88</Hashes>
+                <Hashes condition="contains">SHA256=a566af57d88f37fa033e64b1d8abbd3ffdacaba260475fbbc8dab846a824eff5</Hashes>
+                <Hashes condition="contains">SHA256=86721ee8161096348ed3dbe1ccbf933ae004c315b1691745a8af4a0df9fed675</Hashes>
+                <Hashes condition="contains">SHA256=d205286bffdf09bc033c09e95c519c1c267b40c2ee8bab703c6a2d86741ccd3e</Hashes>
+                <Hashes condition="contains">SHA256=a5a50449e2cc4d0dbc80496f757935ae38bf8a1bebdd6555a3495d8c219df2ad</Hashes>
+                <Hashes condition="contains">SHA256=ece0a900ea089e730741499614c0917432246ceb5e11599ee3a1bb679e24fd2c</Hashes>
+                <Hashes condition="contains">SHA256=881bca6dc2dafe1ae18aeb59216af939a3ac37248c13ed42ad0e1048a3855461</Hashes>
+                <Hashes condition="contains">SHA256=aafb95a443911e4c67d4e45ffa83cca103c91b42915b81100534dc439bec0c1b</Hashes>
+                <Hashes condition="contains">SHA256=cf69704755ec2643dfd245ae1d4e15d77f306aeb1a576ffa159453de1a7345cb</Hashes>
+                <Hashes condition="contains">SHA256=e4522e2cfa0b1f5d258a3cf85b87681d6969e0572f668024c465d635c236b5d9</Hashes>
+                <Hashes condition="contains">SHA256=600a2119657973112025db3c0eeab2e69d528bccfeed75f40c6ef50b059ec8a0</Hashes>
+                <Hashes condition="contains">SHA256=65329dad28e92f4bcc64de15c552b6ef424494028b18875b7dba840053bc0cdd</Hashes>
+                <Hashes condition="contains">SHA256=78827fa00ea48d96ac9af8d1c1e317d02ce11793e7f7f6e4c7aac7b5d7dd490f</Hashes>
+                <Hashes condition="contains">SHA256=cdd2a4575a46bada4837a6153a79c14d60ee3129830717ef09e0e3efd9d00812</Hashes>
+                <Hashes condition="contains">SHA256=42851a01469ba97cdc38939b10cf9ea13237aa1f6c37b1ac84904c5a12a81fa0</Hashes>
+                <Hashes condition="contains">SHA256=3d23bdbaf9905259d858df5bf991eb23d2dc9f4ecda7f9f77839691acef1b8c4</Hashes>
+                <Hashes condition="contains">SHA256=6e944ae1bfe43a8a7cd2ea65e518a30172ce8f31223bdfd39701b2cb41d8a9e7</Hashes>
+                <Hashes condition="contains">SHA256=1ddfe4756f5db9fb319d6c6da9c41c588a729d9e7817190b027b38e9c076d219</Hashes>
+                <Hashes condition="contains">SHA256=f84f8173242b95f9f3c4fea99b5555b33f9ce37ca8188b643871d261cb081496</Hashes>
+                <Hashes condition="contains">SHA256=32e1a8513eee746d17eb5402fb9d8ff9507fb6e1238e7ff06f7a5c50ff3df993</Hashes>
+                <Hashes condition="contains">SHA256=c9014b03866bf37faa8fdb16b6af7cfec976aaef179fd5797d0c0bf8079d3a8c</Hashes>
+                <Hashes condition="contains">SHA256=79e87b93fbed84ec09261b3a0145c935f7dfe4d4805edfb563b2f971a0d51463</Hashes>
+                <Hashes condition="contains">SHA256=ebe2e9ec6d5d94c2d58fbcc9d78c5f0ee7a2f2c1aed6d1b309f383186d11dfa3</Hashes>
+                <Hashes condition="contains">SHA256=9a523854fe84f15efc1635d7f5d3e71812c45d6a4d2c99c29fdc4b4d9c84954c</Hashes>
+                <Hashes condition="contains">SHA256=2ef7df384e93951893b65500dac6ee09da6b8fe9128326caad41b8be4da49a1e</Hashes>
+                <Hashes condition="contains">SHA256=2ce81759bfa236913bbbb9b2cbc093140b099486fd002910b18e2c6e31fdc4f1</Hashes>
+                <Hashes condition="contains">SHA256=909de5f21837ea2b13fdc4e5763589e6bdedb903f7c04e1d0b08776639774880</Hashes>
+                <Hashes condition="contains">SHA256=c8940e2e9b069ec94f9f711150b313b437f8429f78d522810601b6ee8b52bada</Hashes>
+                <Hashes condition="contains">SHA256=075de997497262a9d105afeadaaefc6348b25ce0e0126505c24aa9396c251e85</Hashes>
+                <Hashes condition="contains">SHA256=e68d453d333854787f8470c8baef3e0d082f26df5aa19c0493898bcf3401e39a</Hashes>
+                <Hashes condition="contains">SHA256=3390919bb28d5c36cc348f9ef23be5fa49bfd81263eb7740826e4437cbe904cd</Hashes>
+                <Hashes condition="contains">SHA256=f088b2ba27dacd5c28f8ee428f1350dca4bc7c6606309c287c801b2e1da1a53d</Hashes>
+                <Hashes condition="contains">SHA256=771a8d05f1af6214e0ef0886662be500ee910ab99f0154227067fddcfe08a3dd</Hashes>
+                <Hashes condition="contains">SHA256=910aa4685c735d8c07662aa04fafec463185699ad1a0cd1967b892fc33ec6c3c</Hashes>
+                <Hashes condition="contains">SHA256=ed2f33452ec32830ffef2d5dc832985db9600c306ed890c47f3f33ccbb335c39</Hashes>
+                <Hashes condition="contains">SHA256=98b734dda78c16ebcaa4afeb31007926542b63b2f163b2f733fa0d00dbb344d8</Hashes>
+                <Hashes condition="contains">SHA256=e83908eba2501a00ef9e74e7d1c8b4ff1279f1cd6051707fd51824f87e4378fa</Hashes>
+                <Hashes condition="contains">SHA256=21ccdd306b5183c00ecfd0475b3152e7d94b921e858e59b68a03e925d1715f21</Hashes>
+                <Hashes condition="contains">SHA256=26c28746e947389856543837aa59a5b1f4697e5721a04d00aa28151a2659b097</Hashes>
+                <Hashes condition="contains">SHA256=9f4ce6ab5e8d44f355426d9a6ab79833709f39b300733b5b251a0766e895e0e5</Hashes>
+                <Hashes condition="contains">SHA256=0040153302b88bee27eb4f1eca6855039e1a057370f5e8c615724fa5215bada3</Hashes>
+                <Hashes condition="contains">SHA256=0ebaef662b14410c198395b13347e1d175334ec67919709ad37d65eba013adff</Hashes>
+                <Hashes condition="contains">SHA256=a7c2e7910942dd5e43e2f4eb159bcd2b4e71366e34a68109548b9fb12ac0f7cc</Hashes>
+                <Hashes condition="contains">SHA256=59b09bd69923c0b3de3239e73205b1846a5f69043546d471b259887bb141d879</Hashes>
+                <Hashes condition="contains">SHA256=09bedbf7a41e0f8dabe4f41d331db58373ce15b2e9204540873a1884f38bdde1</Hashes>
+                <Hashes condition="contains">SHA256=1e0eb0811a7cf1bdaf29d3d2cab373ca51eb8d8b58889ab7728e2d3aed244abe</Hashes>
+                <Hashes condition="contains">SHA256=7049f3c939efe76a5556c2a2c04386db51daf61d56b679f4868bb0983c996ebb</Hashes>
+                <Hashes condition="contains">SHA256=4a3d4db86f580b1680d6454baee1c1a139e2dde7d55e972ba7c92ec3f555dce2</Hashes>
+                <Hashes condition="contains">SHA256=bb1135b51acca8348d285dc5461d10e8f57260e7d0c8cc4a092734d53fc40cbc</Hashes>
+                <Hashes condition="contains">SHA256=45ba688a4bded8a7e78a4f5b0dc21004e951ddceb014bb92f51a3301d2fbc56a</Hashes>
+                <Hashes condition="contains">SHA256=15c53eb3a0ea44bbd2901a45a6ebeae29bb123f9c1115c38dfb2cdbec0642229</Hashes>
+                <Hashes condition="contains">SHA256=83f7be0a13c1fccf024c31da5c68c0ea1decf4f48fc39d6e4fd324bbe789ae8a</Hashes>
+                <Hashes condition="contains">SHA256=ecfc52a22e4a41bf53865b0e28309411c60af34a44e31a5c53cdc8c5733e8282</Hashes>
+                <Hashes condition="contains">SHA256=ffc72f0bde21ba20aa97bee99d9e96870e5aa40cce9884e44c612757f939494f</Hashes>
+                <Hashes condition="contains">SHA256=673bcec3d53fab5efd6e3bac25ac9d6cc51f6bbdf8336e38aade2713dc1ae11b</Hashes>
+                <Hashes condition="contains">SHA256=7da6113183328d4fddf6937c0c85ef65ba69bfe133b1146193a25bcf6ae1f9dd</Hashes>
+                <Hashes condition="contains">SHA256=cc383ad11e9d06047a1558ed343f389492da3ac2b84b71462aee502a2fa616c8</Hashes>
+                <Hashes condition="contains">SHA256=76fb4deaee57ef30e56c382c92abffe2cf616d08dbecb3368c8ee6b02e59f303</Hashes>
+                <Hashes condition="contains">SHA256=caa85c44eb511377ea7426ff10df00a701c07ffb384eef8287636a4bca0b53ab</Hashes>
+                <Hashes condition="contains">SHA256=19696fb0db3fcae22f705ae1eb1e9f1151c823f3ff5d8857e90f2a4a6fdc5758</Hashes>
+                <Hashes condition="contains">SHA256=77950e2a40ac0447ae7ee1ee3ef1242ce22796a157074e6f04e345b1956e143c</Hashes>
+                <Hashes condition="contains">SHA256=cf3a7d4285d65bf8688215407bce1b51d7c6b22497f09021f0fce31cbeb78986</Hashes>
+                <Hashes condition="contains">SHA256=4cff6e53430b81ecc4fae453e59a0353bcfe73dd5780abfc35f299c16a97998e</Hashes>
+                <Hashes condition="contains">SHA256=65db1b259e305a52042e07e111f4fa4af16542c8bacd33655f753ef642228890</Hashes>
+                <Hashes condition="contains">SHA256=19d0fc91b70d7a719f7a28b4ad929f114bf1de94a4c7cba5ad821285a4485da0</Hashes>
+                <Hashes condition="contains">SHA256=9b2f051ac901ab47d0012a1002cb8b2db28c14e9480c0dd55e1ac11c81ba9285</Hashes>
+                <Hashes condition="contains">SHA256=159e7c5a12157af92e0d14a0d3ea116f91c09e21a9831486e6dc592c93c10980</Hashes>
+                <Hashes condition="contains">SHA256=bdcacee3695583a0ca38b9a786b9f7334bf2a9a3387e4069c8e6ca378b2791d0</Hashes>
+                <Hashes condition="contains">SHA256=7f5dc63e5742096e4accaca39ae77a2a2142b438c10f97860dee4054b51d3b35</Hashes>
+                <Hashes condition="contains">SHA256=2b120de80a5462f8395cfb7153c86dfd44f29f0776ea156ec4a34fa64e5c4797</Hashes>
+                <Hashes condition="contains">SHA256=d7e091e0d478c34232e8479b950c5513077b3a69309885cee4c61063e5f74ac0</Hashes>
+                <Hashes condition="contains">SHA256=5351c81b4ec5a0d79c39d24bac7600d10eac30c13546fde43d23636b3f421e7c</Hashes>
+                <Hashes condition="contains">SHA256=f85cca4badff17d1aa90752153ccec77a68ad282b69e3985fdc4743eaea85004</Hashes>
+                <Hashes condition="contains">SHA256=56a3c9ac137d862a85b4004f043d46542a1b61c6acb438098a9640469e2d80e7</Hashes>
+                <Hashes condition="contains">SHA256=3cb75429944e60f6c820c7638adbf688883ad44951bca3f8912428afe72bc134</Hashes>
+                <Hashes condition="contains">SHA256=d0bd1ae72aeb5f3eabf1531a635f990e5eaae7fdd560342f915f723766c80889</Hashes>
+                <Hashes condition="contains">SHA256=f8886a9c759e0426e08d55e410b02c5b05af3c287b15970175e4874316ffaf13</Hashes>
+                <Hashes condition="contains">SHA256=cf4b5fa853ce809f1924df3a3ae3c4e191878c4ea5248d8785dc7e51807a512b</Hashes>
+                <Hashes condition="contains">SHA256=d6827cd3a8f273a66ecc33bb915df6c7dea5cc1b8134b0c348303ef50db33476</Hashes>
+                <Hashes condition="contains">SHA256=f0605dda1def240dc7e14efa73927d6c6d89988c01ea8647b671667b2b167008</Hashes>
+                <Hashes condition="contains">SHA256=4d19ee789e101e5a76834fb411aadf8229f08b3ece671343ad57a6576a525036</Hashes>
+                <Hashes condition="contains">SHA256=916c535957a3b8cbf3336b63b2260ea4055163a9e6b214f2a7005d6d36a4a677</Hashes>
+                <Hashes condition="contains">SHA256=8e6363a6393eb4234667c6f614b2072e33512866b3204f8395bbe01530d63f2f</Hashes>
+                <Hashes condition="contains">SHA256=506f953bbb285aeb8af0549eb24f52f3b7af36afe740afa36735bac70573ce28</Hashes>
+                <Hashes condition="contains">SHA256=a8027daa6facf1ff81405daf6763249e9acf232a1a191b6bf106711630e6188e</Hashes>
+                <Hashes condition="contains">SHA256=74a846c61adc53692d3040aff4c1916f32987ad72b07fe226e9e7dbeff1036c4</Hashes>
+                <Hashes condition="contains">SHA256=17927b93b2d6ab4271c158f039cae2d60591d6a14458f5a5690aec86f5d54229</Hashes>
+                <Hashes condition="contains">SHA256=8e88cb80328c3dbaa2752591692e74a2fae7e146d7d8aabc9b9ac9a6fe561e6c</Hashes>
+                <Hashes condition="contains">SHA256=e07211224b02aaf68a5e4b73fc1049376623793509d9581cdaee9e601020af06</Hashes>
+                <Hashes condition="contains">SHA256=2d2c7ee9547738a8a676ab785c151e8b48ed40fe7cf6174650814c7f5f58513b</Hashes>
+                <Hashes condition="contains">SHA256=a334bdf0c0ab07803380eb6ef83eefe7c147d6962595dd9c943a6a76f2200b0d</Hashes>
+                <Hashes condition="contains">SHA256=7f190f6e5ab0edafd63391506c2360230af4c2d56c45fc8996a168a1fc12d457</Hashes>
+                <Hashes condition="contains">SHA256=b37b3c6877b70289c0f43aeb71349f7344b06063996e6347c3c18d8c5de77f3b</Hashes>
+                <Hashes condition="contains">SHA256=6191c20426dd9b131122fb97e45be64a4d6ce98cc583406f38473434636ddedc</Hashes>
+                <Hashes condition="contains">SHA256=c470c9db58840149ce002f3e6003382ecf740884a683bae8f9d10831be218fa2</Hashes>
+                <Hashes condition="contains">SHA256=61d6e40601fa368800980801a662a5b3b36e3c23296e8ae1c85726a56ef18cc8</Hashes>
+                <Hashes condition="contains">SHA256=46621554728bc55438c7c241137af401250f062edef6e7efecf1a6f0f6d0c1f7</Hashes>
+                <Hashes condition="contains">SHA256=b4d47ea790920a4531e3df5a4b4b0721b7fea6b49a35679f0652f1e590422602</Hashes>
+                <Hashes condition="contains">SHA256=0466dac557ee161503f5dfbd3549f81ec760c3d6c7c4363a21a03e7a3f66aca8</Hashes>
+                <Hashes condition="contains">SHA256=3c6f9917418e991ed41540d8d882c8ca51d582a82fd01bff6cdf26591454faf5</Hashes>
+                <Hashes condition="contains">SHA256=b50ffc60eaa4fb7429fdbb67c0aba0c7085f5129564d0a113fec231c5f8ff62e</Hashes>
+                <Hashes condition="contains">SHA256=7cb594af6a3655daebc9fad9c8abf2417b00ba31dcd118707824e5316fc0cc21</Hashes>
+                <Hashes condition="contains">SHA256=4422851a0a102f654e95d3b79c357ae3af1b096d7d1576663c027cfbc04abaf9</Hashes>
+                <Hashes condition="contains">SHA256=3ff39728f1c11d1108f65ec5eb3d722fd1a1279c530d79712e0d32b34880baaa</Hashes>
+                <Hashes condition="contains">SHA256=5c0b429e5935814457934fa9c10ac7a88e19068fa1bd152879e4e9b89c103921</Hashes>
+                <Hashes condition="contains">SHA256=0aafa9f47acf69d46c9542985994ff5321f00842a28df2396d4a3076776a83cb</Hashes>
+                <Hashes condition="contains">SHA256=0ae8d1dd56a8a000ced74a627052933d2e9bff31d251de185b3c0c5fc94a44db</Hashes>
+                <Hashes condition="contains">SHA256=94be67c319a67de75ebed050d5537cfaa795d72bba52f3d8cf349e7bd075410e</Hashes>
+                <Hashes condition="contains">SHA256=b1867d13a4cab66a76f4d4448824ca0cb3a176064626f9618c0c103ee3cb4f47</Hashes>
+                <Hashes condition="contains">SHA256=f74ffd6916333662900cbecb90aca2d6475a714ce410adf9c5c3264abbe5732c</Hashes>
+                <Hashes condition="contains">SHA256=d7ddf874304556f8a10942a29b3d387cb5155a7419f87813557fe728cb14806d</Hashes>
+                <Hashes condition="contains">SHA256=4a9093e8dbcb867e1b97a0a67ce99a8511900658f5201c34ffb8035881f2dbbe</Hashes>
+                <Hashes condition="contains">SHA256=ff115cefe624b6ca0b3878a86f6f8b352d1915b65fbbdc33ae15530a96ebdaa7</Hashes>
+                <Hashes condition="contains">SHA256=9f1229cd8dd9092c27a01f5d56e3c0d59c2bb9f0139abf042e56f343637fda33</Hashes>
+                <Hashes condition="contains">SHA256=3124b0411b8077605db2a9b7909d8240e0d554496600e2706e531c93c931e1b5</Hashes>
+                <Hashes condition="contains">SHA256=50d5eaa168c077ce5b7f15b3f2c43bd2b86b07b1e926c1b332f8cb13bd2e0793</Hashes>
+                <Hashes condition="contains">SHA256=952199c28332bc90cfd74530a77ee237967ed32b3c71322559c59f7a42187dc4</Hashes>
+                <Hashes condition="contains">SHA256=55a1535e173c998fbbc978009b02d36ca0c737340d84ac2a8da73dfc2f450ef9</Hashes>
+                <Hashes condition="contains">SHA256=57a389da784269bb2cc0a258500f6dfbf4f6269276e1192619ce439ec77f4572</Hashes>
+                <Hashes condition="contains">SHA256=84df20b1d9d87e305c92e5ffae21b10b325609d59d835a954dbd8750ef5dabf4</Hashes>
+                <Hashes condition="contains">SHA256=8ef0ad86500094e8fa3d9e7d53163aa6feef67c09575c169873c494ed66f057f</Hashes>
+                <Hashes condition="contains">SHA256=26f41e4268be59f5de07552b51fa52d18d88be94f8895eb4a16de0f3940cf712</Hashes>
+                <Hashes condition="contains">SHA256=26e3bfef255efd052a84c3c43994c73222b14c95db9a4b1fc2e98f1a5cb26e43</Hashes>
+                <Hashes condition="contains">SHA256=478917514be37b32d5ccf76e4009f6f952f39f5553953544f1b0688befd95e82</Hashes>
+                <Hashes condition="contains">SHA256=0f035948848432bc243704041739e49b528f35c82a5be922d9e3b8a4c44398ff</Hashes>
+                <Hashes condition="contains">SHA256=72b99147839bcfb062d29014ec09fe20a8f261748b5925b00171ef3cb849a4c1</Hashes>
+                <Hashes condition="contains">SHA256=8cf0cbbdc43f9b977f0fb79e0a0dd0e1adabe08a67d0f40d727c717c747de775</Hashes>
+                <Hashes condition="contains">SHA256=4429f32db1cc70567919d7d47b844a91cf1329a6cd116f582305f3b7b60cd60b</Hashes>
+                <Hashes condition="contains">SHA256=0cd4ca335155062182608cad9ef5c8351a715bce92049719dd09c76422cd7b0c</Hashes>
+                <Hashes condition="contains">SHA256=05f052c64d192cf69a462a5ec16dda0d43ca5d0245900c9fcb9201685a2e7748</Hashes>
+                <Hashes condition="contains">SHA256=b9b3878ddc5dfb237d38f8d25067267870afd67d12a330397a8853209c4d889c</Hashes>
+                <Hashes condition="contains">SHA256=93d873cdf23d5edc622b74f9544cac7fe247d7a68e1e2a7bf2879fad97a3ae63</Hashes>
+                <Hashes condition="contains">SHA256=aaa3459bcac25423f78ed72dbae4d7ef19e7c5c65770cbe5210b14e33cd1816c</Hashes>
+                <Hashes condition="contains">SHA256=5f20541f859f21b3106e12d37182b1ea39bb75ffcfcddb2ece4f6edd42c0bab2</Hashes>
+                <Hashes condition="contains">SHA256=dbe9f17313e1164f06401234b875fbc7f71d41dc7271de643865af1358841fef</Hashes>
+                <Hashes condition="contains">SHA256=e0b5a5f8333fc1213791af5c5814d7a99615b3951361ca75f8aa5022c9cfbc2b</Hashes>
+                <Hashes condition="contains">SHA256=19a212e6fc324f4cb9ee5eba60f5c1fc0191799a4432265cbeaa3307c76a7fc0</Hashes>
+                <Hashes condition="contains">SHA256=36aafa127736c7226c50061ea065f71e14f64ec60321f705bc52686d24117e0d</Hashes>
+                <Hashes condition="contains">SHA256=cfc5c585dd4e592dd1a08887ded28b92d9a5820587b6f4f8fa4f56d60289259b</Hashes>
+                <Hashes condition="contains">SHA256=f37d609ea1f06660d970415dd3916c4c153bb5940bf7d2beb47fa34e8a8ffbfc</Hashes>
+                <Hashes condition="contains">SHA256=89108a15f009b285db4ef94250b889d5b11b96b4aa7b190784a6d1396e893e10</Hashes>
+                <Hashes condition="contains">SHA256=1f4d4db4abe26e765a33afb2501ac134d14cadeaa74ae8a0fae420e4ecf58e0c</Hashes>
+                <Hashes condition="contains">SHA256=39cfde7d401efce4f550e0a9461f5fc4d71fa07235e1336e4f0b4882bd76550e</Hashes>
+                <Hashes condition="contains">SHA256=8fe9828bea83adc8b1429394db7a556a17f79846ad0bfb7f242084a5c96edf2a</Hashes>
+                <Hashes condition="contains">SHA256=2afdb3278a7b57466a103024aef9ff7f41c73a19bab843a8ebf3d3c4d4e82b30</Hashes>
+                <Hashes condition="contains">SHA256=8bda0108de82ebeae82f43108046c5feb6f042e312fa0115475a9e32274fae59</Hashes>
+                <Hashes condition="contains">SHA256=082c39fe2e3217004206535e271ebd45c11eb072efde4cc9885b25ba5c39f91d</Hashes>
+                <Hashes condition="contains">SHA256=f40435488389b4fb3b945ca21a8325a51e1b5f80f045ab019748d0ec66056a8b</Hashes>
+                <Hashes condition="contains">SHA256=9c10e2ec4f9ef591415f9a784b93dc9c9cdafa7c69602c0dc860c5b62222e449</Hashes>
+                <Hashes condition="contains">SHA256=2594b3ef3675ca3a7b465b8ed4962e3251364bab13b12af00ebba7fa2211abb2</Hashes>
+                <Hashes condition="contains">SHA256=47f08f7d30d824a8f4bb8a98916401a37c0fd8502db308aba91fe3112b892dcc</Hashes>
+                <Hashes condition="contains">SHA256=bac709c49ddee363c8e59e515f2f632324a0359e932b7d8cb1ce2d52a95981aa</Hashes>
+                <Hashes condition="contains">SHA256=31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427</Hashes>
+                <Hashes condition="contains">SHA256=7d8937c18d6e11a0952e53970a0934cf0e65515637ac24d6ca52ccf4b93d385f</Hashes>
+                <Hashes condition="contains">SHA256=3724b39e97936bb20ada51c6119aded04530ed86f6b8d6b45fbfb2f3b9a4114b</Hashes>
+                <Hashes condition="contains">SHA256=df0dcfb3971829af79629efd036b8e1c6e2127481b3644ccc6e2ddd387489a15</Hashes>
+                <Hashes condition="contains">SHA256=91314768da140999e682d2a290d48b78bb25a35525ea12c1b1f9634d14602b2c</Hashes>
+                <Hashes condition="contains">SHA256=a9706e320179993dade519a83061477ace195daa1b788662825484813001f526</Hashes>
+                <Hashes condition="contains">SHA256=314384b40626800b1cde6fbc51ebc7d13e91398be2688c2a58354aa08d00b073</Hashes>
+                <Hashes condition="contains">SHA256=a072197177aad26c31960694e38e2cae85afbab070929e67e331b99d3a418cf4</Hashes>
+                <Hashes condition="contains">SHA256=8e5aef7c66c0e92dfc037ee29ade1c8484b8d7fadebdcf521d2763b1d8215126</Hashes>
+                <Hashes condition="contains">SHA256=b7a20b5f15e1871b392782c46ebcc897929443d82073ee4dcb3874b6a5976b5d</Hashes>
+                <Hashes condition="contains">SHA256=5ee292b605cd3751a24e5949aae615d472a3c72688632c3040dc311055b75a92</Hashes>
+                <Hashes condition="contains">SHA256=5f6547e9823f94c5b94af1fb69a967c4902f72b6e0c783804835e6ce27f887b0</Hashes>
+                <Hashes condition="contains">SHA256=2732050a7d836ae0bdc5c0aea4cdf8ce205618c3e7f613b8139c176e86476d0c</Hashes>
+                <Hashes condition="contains">SHA256=ff6729518a380bf57f1bc6f1ec0aa7f3012e1618b8d9b0f31a61d299ee2b4339</Hashes>
+                <Hashes condition="contains">SHA256=43ba8d96d5e8e54cab59d82d495eeca730eeb16e4743ed134cdd495c51a4fc89</Hashes>
+                <Hashes condition="contains">SHA256=64f9e664bc6d4b8f5f68616dd50ae819c3e60452efd5e589d6604b9356841b57</Hashes>
+                <Hashes condition="contains">SHA256=31d8fc6f5fb837d5eb29db828d13ba8ee11867d86a90b2c2483a578e1d0ec43a</Hashes>
+                <Hashes condition="contains">SHA256=23ba19352b1e71a965260bf4d5120f0200709ee8657ed381043bec9a938a1ade</Hashes>
+                <Hashes condition="contains">SHA256=11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5</Hashes>
+                <Hashes condition="contains">SHA256=de8f8006d8ee429b5f333503defa54b25447f4ed6aeade5e4219e23f3473ef1c</Hashes>
+                <Hashes condition="contains">SHA256=9fc29480407e5179aa8ea41682409b4ea33f1a42026277613d6484e5419de374</Hashes>
+                <Hashes condition="contains">SHA256=e05eeb2b8c18ad2cb2d1038c043d770a0d51b96b748bc34be3e7fc6f3790ce53</Hashes>
+                <Hashes condition="contains">SHA256=9b6a84f7c40ea51c38cc4d2e93efb3375e9d98d4894a85941190d94fbe73a4e4</Hashes>
+                <Hashes condition="contains">SHA256=2bf29a2df52110ed463d51376562afceac0e80fbb1033284cf50edd86c406b14</Hashes>
+                <Hashes condition="contains">SHA256=95d50c69cdbf10c9c9d61e64fe864ac91e6f6caa637d128eb20e1d3510e776d3</Hashes>
+                <Hashes condition="contains">SHA256=927c2a580d51a598177fa54c65e9d2610f5f212f1b6cb2fbf2740b64368f010a</Hashes>
+                <Hashes condition="contains">SHA256=7539157df91923d4575f7f57c8eb8b0fd87f064c919c1db85e73eebb2910b60c</Hashes>
+                <Hashes condition="contains">SHA256=0af5ccb3d33a9ba92071c9637be6254030d61998733a5eb3583e865e17844e05</Hashes>
+                <Hashes condition="contains">SHA256=fd388cf1df06d419b14dedbeb24c6f4dff37bea26018775f09d56b3067f0de2c</Hashes>
+                <Hashes condition="contains">SHA256=0ce40a2cdd3f45c7632b858e8089ddfdd12d9acb286f2015a4b1b0c0346a572c</Hashes>
+                <Hashes condition="contains">SHA256=3e1d47a497babbfd1c83905777b517ec87c65742bee7eb57a2273eca825d2272</Hashes>
+                <Hashes condition="contains">SHA256=f9895458e73d4b0ef01eda347fb695bb00e6598d9f5e2506161b70ad96bb7298</Hashes>
+                <Hashes condition="contains">SHA256=bb68552936a6b0a68fb53ce864a6387d2698332aac10a7adfdd5a48b97027ce3</Hashes>
+                <Hashes condition="contains">SHA256=d783ace822f8fe4e25d5387e5dd249cb72e62f62079023216dc436f1853a150f</Hashes>
+                <Hashes condition="contains">SHA256=df0cc4e5c9802f8edaefeb130e375cad56b2c5490d8ebd77d8dbdcc6fdc7ecb6</Hashes>
+                <Hashes condition="contains">SHA256=607dc4c75ac7aef82ae0616a453866b3b358c6cf5c8f9d29e4d37f844306b97c</Hashes>
+                <Hashes condition="contains">SHA256=f877296e8506e6a1acbdacdc5085b18c6842320a2775a329d286bac796f08d54</Hashes>
+                <Hashes condition="contains">SHA256=18712a063574bfec315d58577dfe413ab45b650e54747d1e18a56c3c7337a12c</Hashes>
+                <Hashes condition="contains">SHA256=8b92cdb91a2e2fab3881d54f5862e723826b759749f837a11c9e9d85d52095a2</Hashes>
+                <Hashes condition="contains">SHA256=72322fa8bba20df6966acbcf41e83747893fd173cd29de99b5ad1a5d3bf8f2de</Hashes>
+                <Hashes condition="contains">SHA256=146d77e80ca70ea5cb17bfc9a5cea92334f809cbdc87a51c2d10b8579a4b9c88</Hashes>
+                <Hashes condition="contains">SHA256=45abdbcd4c0916b7d9faaf1cd08543a3a5178871074628e0126a6eda890d26e0</Hashes>
+                <Hashes condition="contains">SHA256=9f1025601d17945c3a47026814bdec353ee363966e62dba7fe2673da5ce50def</Hashes>
+                <Hashes condition="contains">SHA256=3f9530c94b689f39cc83377d76979d443275012e022782a600dcb5cad4cca6aa</Hashes>
+                <Hashes condition="contains">SHA256=9254f012009d55f555418ff85f7d93b184ab7cb0e37aecdfdab62cfe94dea96b</Hashes>
+                <Hashes condition="contains">SHA256=3384f4a892f7aa72c43280ff682d85c8e3936f37a68d978d307a9461149192de</Hashes>
+                <Hashes condition="contains">SHA256=b8b94c2646b62f6ac08f16514b6efaa9866aa3c581e4c0435a7aeafe569b2418</Hashes>
+                <Hashes condition="contains">SHA256=b03f26009de2e8eabfcf6152f49b02a55c5e5d0f73e01d48f5a745f93ce93a29</Hashes>
+                <Hashes condition="contains">SHA256=696679114f6a106ec94c21e2a33fe17af86368bcf9a796aaea37ea6e8748ad6a</Hashes>
+                <Hashes condition="contains">SHA256=b019ebd77ac19cdd72bba3318032752649bd56a7576723a8ae1cccd70ee1e61a</Hashes>
+                <Hashes condition="contains">SHA256=67734c7c0130dd66c964f76965f09a2290da4b14c94412c0056046e700654bdc</Hashes>
+                <Hashes condition="contains">SHA256=ecd07df7ad6fee9269a9e9429eb199bf3e24cf672aa1d013b7e8d90d75324566</Hashes>
+                <Hashes condition="contains">SHA256=38c18db050b0b2b07f657c03db1c9595febae0319c746c3eede677e21cd238b0</Hashes>
+                <Hashes condition="contains">SHA256=810513b3f4c8d29afb46f71816350088caacf46f1be361af55b26f3fee4662c3</Hashes>
+                <Hashes condition="contains">SHA256=1b7fb154a7b7903a3c81f12f4b094f24a3c60a6a8cffca894c67c264ab7545fa</Hashes>
+                <Hashes condition="contains">SHA256=ea0b9eecf4ad5ec8c14aec13de7d661e7615018b1a3c65464bf5eca9bbf6ded3</Hashes>
+                <Hashes condition="contains">SHA256=09b0e07af8b17db1d896b78da4dd3f55db76738ee1f4ced083a97d737334a184</Hashes>
+                <Hashes condition="contains">SHA256=5b9623da9ba8e5c80c49473f40ffe7ad315dcadffc3230afdc9d9226d60a715a</Hashes>
+                <Hashes condition="contains">SHA256=258359a7fa3d975620c9810dab3a6493972876a024135feaf3ac8482179b2e79</Hashes>
+                <Hashes condition="contains">SHA256=a2353030d4ea3ad9e874a0f7ff35bbfa10562c98c949d88cabab27102bbb8e48</Hashes>
+                <Hashes condition="contains">SHA256=a56c2a2425eb3a4260cc7fc5c8d7bed7a3b4cd2af256185f24471c668853aee8</Hashes>
+                <Hashes condition="contains">SHA256=1f8168036d636aad1680dd0f577ef9532dbb2dad3591d63e752b0ba3ee6fd501</Hashes>
+                <Hashes condition="contains">SHA256=ee45fd2d7315fd039f3585a66e7855ba4af9d4721e1448e602623de14e932bbe</Hashes>
+                <Hashes condition="contains">SHA256=d636c011b8b2896572f5de260eb997182cc6955449b044a739bd19cbe6fdabd2</Hashes>
+                <Hashes condition="contains">SHA256=6a4875ae86131a594019dec4abd46ac6ba47e57a88287b814d07d929858fe3e5</Hashes>
+                <Hashes condition="contains">SHA256=238046cfe126a1f8ab96d8b62f6aa5ec97bab830e2bae5b1b6ab2d31894c79e4</Hashes>
+                <Hashes condition="contains">SHA256=3e9b62d2ea2be50a2da670746c4dbe807db9601980af3a1014bcd72d0248d84c</Hashes>
+                <Hashes condition="contains">SHA256=c082514317bf80a2f5129d84a5a55e411a95e32d03a4df1274537704c80e41dd</Hashes>
+                <Hashes condition="contains">SHA256=cd4a249c3ef65af285d0f8f30a8a96e83688486aab515836318a2559757a89bb</Hashes>
+                <Hashes condition="contains">SHA256=32cccc4f249499061c0afa18f534c825d01034a1f6815f5506bf4c4ff55d1351</Hashes>
+                <Hashes condition="contains">SHA256=818e396595d08d724666803cd29dac566dc7db23bf50e9919d04b33afa988c01</Hashes>
+                <Hashes condition="contains">SHA256=2b186926ed815d87eaf72759a69095a11274f5d13c33b8cc2b8700a1f020be1d</Hashes>
+                <Hashes condition="contains">SHA256=e6056443537d4d2314dabca1b9168f1eaaf17a14eb41f6f5741b6b82b3119790</Hashes>
+                <Hashes condition="contains">SHA256=a13054f349b7baa8c8a3fcbd31789807a493cc52224bbff5e412eb2bd52a6433</Hashes>
+                <Hashes condition="contains">SHA256=e4c154a0073bbad3c9f8ab7218e9b3be252ae705c20c568861dae4088f17ffcc</Hashes>
+                <Hashes condition="contains">SHA256=5192ec4501d0fe0b1c8f7bf9b778f7524a7a70a26bbbb66e5dab8480f6fdbb8b</Hashes>
+                <Hashes condition="contains">SHA256=65025741ecd0ef516da01319b42c2d96e13cb8d78de53fb7e39cd53ea6d58c75</Hashes>
+                <Hashes condition="contains">SHA256=37c637a74bf20d7630281581a8fae124200920df11ad7cd68c14c26cc12c5ec9</Hashes>
+                <Hashes condition="contains">SHA256=ec5fac0b6bb267a2bd10fc80c8cca6718439d56e82e053d3ff799ce5f3475db5</Hashes>
+                <Hashes condition="contains">SHA256=c299063e3eae8ddc15839767e83b9808fd43418dc5a1af7e4f44b97ba53fbd3d</Hashes>
+                <Hashes condition="contains">SHA256=923ebbe8111e73d5b8ecc2db10f8ea2629a3264c3a535d01c3c118a3b4c91782</Hashes>
+                <Hashes condition="contains">SHA256=c1c4310e5d467d24e864177bdbfc57cb5d29aac697481bfa9c11ddbeebfd4cc8</Hashes>
+                <Hashes condition="contains">SHA256=12eda8b65ed8c1d80464a0c535ea099dffdb4981c134294cb0fa424efc85ee56</Hashes>
+                <Hashes condition="contains">SHA256=552f70374715e70c4ade591d65177be2539ec60f751223680dfaccb9e0be0ed9</Hashes>
+                <Hashes condition="contains">SHA256=49f75746eebe14e5db11706b3e58accc62d4034d2f1c05c681ecef5d1ad933ba</Hashes>
+                <Hashes condition="contains">SHA256=bc13adeb6bf62b1e10ef41205ef92382e6c18d6a20669d288a0b11058e533d63</Hashes>
+                <Hashes condition="contains">SHA256=525d9b51a80ca0cd4c5889a96f857e73f3a80da1ffbae59851e0f51bdfb0b6cd</Hashes>
+                <Hashes condition="contains">SHA256=86a1b1bacc0c51332c9979e6aad84b5fba335df6b9a096ccb7681ab0779a8882</Hashes>
+                <Hashes condition="contains">SHA256=36505921af5a09175395ebaea29c72b2a69a3a9204384a767a5be8a721f31b10</Hashes>
+                <Hashes condition="contains">SHA256=c9b49b52b493b53cd49c12c3fa9553e57c5394555b64e32d1208f5b96a5b8c6e</Hashes>
+                <Hashes condition="contains">SHA256=dd573f23d656818036fc9ae1064eda31aca86acb9bc44a6e127db3ea112a9094</Hashes>
+                <Hashes condition="contains">SHA256=b179e1ab6dc0b1aee783adbcad4ad6bb75a8a64cb798f30c0dd2ee8aaf43e6de</Hashes>
+                <Hashes condition="contains">SHA256=76b86543ce05540048f954fed37bdda66360c4a3ddb8328213d5aef7a960c184</Hashes>
+                <Hashes condition="contains">SHA256=58a74dceb2022cd8a358b92acd1b48a5e01c524c3b0195d7033e4bd55eff4495</Hashes>
+                <Hashes condition="contains">SHA256=133e542842656197c5d22429bd56d57aa33c9522897fdf29853a6d321033c743</Hashes>
+                <Hashes condition="contains">SHA256=e7cbfb16261de1c7f009431d374d90e9eb049ba78246e38bc4c8b9e06f324b6f</Hashes>
+                <Hashes condition="contains">SHA256=8cb62c5d41148de416014f80bd1fd033fd4d2bd504cb05b90eeb6992a382d58f</Hashes>
+                <Hashes condition="contains">SHA256=06508aacb4ed0a1398a2b0da5fa2dbf7da435b56da76fd83c759a50a51c75caf</Hashes>
+                <Hashes condition="contains">SHA256=5bd41a29cbba0d24e639f49d1f201b9bd119b11f5e3b8a5fefa3a5c6f1e7692c</Hashes>
+                <Hashes condition="contains">SHA256=cb9890d4e303a4c03095d7bc176c42dee1b47d8aa58e2f442ec1514c8f9e3cec</Hashes>
+                <Hashes condition="contains">SHA256=a899b659b08fbae30b182443be8ffb6a6471c1d0497b52293061754886a937a3</Hashes>
+                <Hashes condition="contains">SHA256=910479467ef17b9591d8d42305e7f6f247ad41c60ec890a1ffbe331f495ed135</Hashes>
+                <Hashes condition="contains">SHA256=cf3180f5308af002ac5d6fd5b75d1340878c375f0aebc3157e3bcad6322b7190</Hashes>
+                <Hashes condition="contains">SHA256=3ac5e01689a3d745e60925bc7faca8d4306ae693e803b5e19c94906dc30add46</Hashes>
+                <Hashes condition="contains">SHA256=afdd66562dea51001c3a9de300f91fc3eb965d6848dfce92ccb9b75853e02508</Hashes>
+                <Hashes condition="contains">SHA256=7f375639a0df7fe51e5518cf87c3f513c55bc117db47d28da8c615642eb18bfa</Hashes>
+                <Hashes condition="contains">SHA256=9d5ebd0f4585ec20a5fe3c5276df13ece5a2645d3d6f70cedcda979bd1248fc2</Hashes>
+                <Hashes condition="contains">SHA256=ae42afa9be9aa6f6a5ae09fa9c05cd2dfb7861dc72d4fd8e0130e5843756c471</Hashes>
+                <Hashes condition="contains">SHA256=3ff50c67d51553c08dcb7c98342f68a0f54ad6658c5346c428bdcd1f185569f6</Hashes>
+                <Hashes condition="contains">SHA256=8d57e416ea4bb855b78a2ff3c80de1dfbb5dc5ee9bfbdddb23e46bd8619287e2</Hashes>
+                <Hashes condition="contains">SHA256=f8430bdc6fd01f42217d66d87a3ef6f66cb2700ebb39c4f25c8b851858cc4b35</Hashes>
+                <Hashes condition="contains">SHA256=bc7ebd191e0991fd0865a5c956a92e63792a0bb2ff888af43f7a63bb65a22248</Hashes>
+                <Hashes condition="contains">SHA256=be03e9541f56ac6ed1e81407dcd7cc85c0ffc538c3c2c2c8a9c747edbcf13100</Hashes>
+                <Hashes condition="contains">SHA256=6cb6e23ba516570bbd158c32f7c7c99f19b24ca4437340ecb39253662afe4293</Hashes>
+                <Hashes condition="contains">SHA256=60b163776e7b95e0c2280d04476304d0c943b484909131f340e3ce6045a49289</Hashes>
+                <Hashes condition="contains">SHA256=455bc98ba32adab8b47d2d89bdbadca4910f91c182ab2fc3211ba07d3784537b</Hashes>
+                <Hashes condition="contains">SHA256=543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91</Hashes>
+                <Hashes condition="contains">SHA256=3c18ae965fba56d09a65770b4d8da54ccd7801f979d3ebd283397bc99646004b</Hashes>
+                <Hashes condition="contains">SHA256=94911fe6f2aba9683b10353094caf71ee4a882de63b4620797629d79f18feec5</Hashes>
+                <Hashes condition="contains">SHA256=71fe5af0f1564dc187eea8d59c0fbc897712afa07d18316d2080330ba17cf009</Hashes>
+                <Hashes condition="contains">SHA256=f05b1ee9e2f6ab704b8919d5071becbce6f9d0f9d0ba32a460c41d5272134abe</Hashes>
+                <Hashes condition="contains">SHA256=e3eff841ea0f2786e5e0fed2744c0829719ad711fc9258eeaf81ed65a52a8918</Hashes>
+                <Hashes condition="contains">SHA256=e16dc51c51b2df88c474feb52ce884d152b3511094306a289623de69dedfdf48</Hashes>
+                <Hashes condition="contains">SHA256=a59c40e7470b7003e8adfee37c77606663e78d7e3f2ebb8d60910af19924d8df</Hashes>
+                <Hashes condition="contains">SHA256=2a6db9facf9e13d35c37dd468be04bae5f70c6127a9aee76daebddbdec95d486</Hashes>
+                <Hashes condition="contains">SHA256=adc10de960f40fa9f6e28449748250fa9ddfd331115b77a79809a50c606753ee</Hashes>
+                <Hashes condition="contains">SHA256=c60fcff9c8e5243bbb22ec94618b9dcb02c59bb49b90c04d7d6ab3ebbd58dc3a</Hashes>
+                <Hashes condition="contains">SHA256=9a54ef5cfbe6db599322967ee2c84db7daabcb468be10a3ccfcaa0f64d9173c7</Hashes>
+                <Hashes condition="contains">SHA256=a4680fabf606d6580893434e81c130ff7ec9467a15e6534692443465f264d3c9</Hashes>
+                <Hashes condition="contains">SHA256=2e6b339597a89e875f175023ed952aaac64e9d20d457bbc07acf1586e7fe2df8</Hashes>
+                <Hashes condition="contains">SHA256=ef6d3c00f9d0aa31a218094480299ef73fc85146adf62fd0c2f4f88972c5c850</Hashes>
+                <Hashes condition="contains">SHA256=fcdfe570e6dc6e768ef75138033d9961f78045adca53beb6fdb520f6417e0df1</Hashes>
+                <Hashes condition="contains">SHA256=dd4a1253d47de14ef83f1bc8b40816a86ccf90d1e624c5adf9203ae9d51d4097</Hashes>
+                <Hashes condition="contains">SHA256=d8b58f6a89a7618558e37afc360cd772b6731e3ba367f8d58734ecee2244a530</Hashes>
+                <Hashes condition="contains">SHA256=a903f329b70f0078197cb7683aae1bb432eaf58572fe572f7cb4bc2080042d7e</Hashes>
+                <Hashes condition="contains">SHA256=984a77e5424c6d099051441005f2938ae92b31b5ad8f6521c6b001932862add7</Hashes>
+                <Hashes condition="contains">SHA256=3c7e5b25a33a7805c999d318a9523fcae46695a89f55bbdb8bb9087360323dfc</Hashes>
+                <Hashes condition="contains">SHA256=4bc0921ffd4acc865525d3faf98961e8decc5aec4974552cbbf2ae8d5a569de4</Hashes>
+                <Hashes condition="contains">SHA256=a2f45d95d54f4e110b577e621fefa0483fa0e3dcca14c500c298fb9209e491c1</Hashes>
+                <Hashes condition="contains">SHA256=d1f4949f76d8ac9f2fa844d16b1b45fb1375d149d46e414e4a4c9424dc66c91f</Hashes>
+                <Hashes condition="contains">SHA256=263e8f1e20612849aea95272da85773f577fd962a7a6d525b53f43407aa7ad24</Hashes>
+                <Hashes condition="contains">SHA256=22be050955347661685a4343c51f11c7811674e030386d2264cd12ecbf544b7c</Hashes>
+                <Hashes condition="contains">SHA256=c3e150eb7e7292f70299d3054ed429156a4c32b1f7466a706a2b99249022979e</Hashes>
+                <Hashes condition="contains">SHA256=06bda5a1594f7121acd2efe38ccb617fbc078bb9a70b665a5f5efd70e3013f50</Hashes>
+                <Hashes condition="contains">SHA256=221dfbc74bbb255b0879360ccc71a74b756b2e0f16e9386b38a9ce9d4e2e34f9</Hashes>
+                <Hashes condition="contains">SHA256=36875562e747136313ec5db58174e5fab870997a054ca8d3987d181599c7db6a</Hashes>
+                <Hashes condition="contains">SHA256=475e5016c9c0f5a127896f9179a1b1577a67b357f399ab5a1e68aab07134729a</Hashes>
+                <Hashes condition="contains">SHA256=18776682fcc0c6863147143759a8d4050a4115a8ede0136e49a7cf885c8a4805</Hashes>
+                <Hashes condition="contains">SHA256=dec8a933dba04463ed9bb7d53338ff87f2c23cfb79e0e988449fc631252c9dcc</Hashes>
+                <Hashes condition="contains">SHA256=d25904fbf907e19f366d54962ff543d9f53b8fdfd2416c8b9796b6a8dd430e26</Hashes>
+                <Hashes condition="contains">SHA256=771015b2620942919bb2e0683476635b7a09db55216d6fbf03534cb18513b20c</Hashes>
+                <Hashes condition="contains">SHA256=2aa1b08f47fbb1e2bd2e4a492f5d616968e703e1359a921f62b38b8e4662f0c4</Hashes>
+                <Hashes condition="contains">SHA256=40061b30b1243be76d5283cbc8abfe007e148097d4de7337670ff1536c4c7ba1</Hashes>
+                <Hashes condition="contains">SHA256=b9a4e40a5d80fedd1037eaed958f9f9efed41eb01ada73d51b5dcd86e27e0cbf</Hashes>
+                <Hashes condition="contains">SHA256=1273b74c3c1553eaa92e844fbd51f716356cc19cf77c2c780d4899ec7738fbd1</Hashes>
+                <Hashes condition="contains">SHA256=58c071cfe72e9ee867bba85cbd0abe72eb223d27978d6f0650d0103553839b59</Hashes>
+                <Hashes condition="contains">SHA256=f88ebb633406a086d9cca6bc8b66a4ea940c5476529f9033a9e0463512a23a57</Hashes>
+                <Hashes condition="contains">SHA256=d7bc7306cb489fe4c285bbeddc6d1a09e814ef55cf30bd5b8daf87a52396f102</Hashes>
+                <Hashes condition="contains">SHA256=03e0581432f5c8cc727a8aa387f5b69ff84d38d0df6f1226c19c6e960a81e1e9</Hashes>
+                <Hashes condition="contains">SHA256=7d43769b353d63093228a59eb19bba87ce6b552d7e1a99bf34a54eee641aa0ea</Hashes>
+                <Hashes condition="contains">SHA256=2a9d481ffdc5c1e2cb50cf078be32be06b21f6e2b38e90e008edfc8c4f2a9c4e</Hashes>
+                <Hashes condition="contains">SHA256=d969845ef6acc8e5d3421a7ce7e244f419989710871313b04148f9b322751e5d</Hashes>
+                <Hashes condition="contains">SHA256=708016fbe22c813a251098f8f992b177b476bd1bbc48c2ed4a122ff74910a965</Hashes>
+                <Hashes condition="contains">SHA256=7cb497abc44aad09a38160d6a071db499e05ff5871802ccc45d565d242026ee7</Hashes>
+                <Hashes condition="contains">SHA256=2e665962c827ce0adbd29fe6bcf09bbb1d7a7022075d162ff9b65d0af9794ac0</Hashes>
+                <Hashes condition="contains">SHA256=3243aab18e273a9b9c4280a57aecef278e10bfff19abb260d7a7820e41739099</Hashes>
+                <Hashes condition="contains">SHA256=fda93c6e41212e86af07f57ca95db841161f00b08dae6304a51b467056e56280</Hashes>
+                <Hashes condition="contains">SHA256=c2a4ddcc9c3b339d752c48925d62fc4cc5adbf6fae8fedef74cdd47e88da01f8</Hashes>
+                <Hashes condition="contains">SHA256=5ae23f1fcf3fb735fcf1fa27f27e610d9945d668a149c7b7b0c84ffd6409d99a</Hashes>
+                <Hashes condition="contains">SHA256=4744df6ac02ff0a3f9ad0bf47b15854bbebb73c936dd02f7c79293a2828406f6</Hashes>
+                <Hashes condition="contains">SHA256=a7860e110f7a292d621006b7208a634504fb5be417fd71e219060381b9a891e6</Hashes>
+                <Hashes condition="contains">SHA256=bdbceca41e576841cad2f2b38ee6dbf92fd77fbbfdfe6ecf99f0623d44ef182c</Hashes>
+                <Hashes condition="contains">SHA256=7a48f92a9c2d95a72e18055cac28c1e7e6cad5f47aa735cbea5c3b82813ccfaf</Hashes>
+                <Hashes condition="contains">SHA256=17687cba00ec2c9036dd3cb5430aa1f4851e64990dafb4c8f06d88de5283d6ca</Hashes>
+                <Hashes condition="contains">SHA256=3e07bb866d329a2f9aaa4802bad04fdac9163de9bf9cfa1d035f5ca610b4b9bf</Hashes>
+                <Hashes condition="contains">SHA256=b17507a3246020fa0052a172485d7b3567e0161747927f2edf27c40e310852e0</Hashes>
+                <Hashes condition="contains">SHA256=1e16a01ef44e4c56e87abfbe03b2989b0391b172c3ec162783ad640be65ab961</Hashes>
+                <Hashes condition="contains">SHA256=82fbcb371d53b8a76a25fbbafaae31147c0d1f6b9f26b3ea45262c2267386989</Hashes>
+                <Hashes condition="contains">SHA256=ad23d77a38655acb71216824e363df8ac41a48a1a0080f35a0d23aa14b54460b</Hashes>
+                <Hashes condition="contains">SHA256=28999af32b55ddb7dcfc26376a244aa2fe297233ce7abe4919a1aef2f7e2cee7</Hashes>
+                <Hashes condition="contains">SHA256=2270a8144dabaf159c2888519b11b61e5e13acdaa997820c09798137bded3dd6</Hashes>
+                <Hashes condition="contains">SHA256=27cd05527feb020084a4a76579c125458571da8843cdfc3733211760a11da970</Hashes>
+                <Hashes condition="contains">SHA256=592f56b13e7dcaa285da64a0b9a48be7562bd9b0a190208b7c8b7d8de427cf6c</Hashes>
+                <Hashes condition="contains">SHA256=3871e16758a1778907667f78589359734f7f62f9dc953ec558946dcdbe6951e3</Hashes>
+                <Hashes condition="contains">SHA256=1d0397c263d51e9fc95bcc8baf98d1a853e1c0401cd0e27c7bf5da3fba1c93a8</Hashes>
+                <Hashes condition="contains">SHA256=4941c4298f4560fc1e59d0f16f84bab5c060793700b82be2fd7c63735f1657a8</Hashes>
+                <Hashes condition="contains">SHA256=80eeb8c2890f3535ed14f5881baf2f2226e6763be099d09fb8aadaba5b4474c1</Hashes>
+                <Hashes condition="contains">SHA256=175eed7a4c6de9c3156c7ae16ae85c554959ec350f1c8aaa6dfe8c7e99de3347</Hashes>
+                <Hashes condition="contains">SHA256=5f7e47d728ac3301eb47b409801a0f4726a435f78f1ed02c30d2a926259c71f3</Hashes>
+                <Hashes condition="contains">SHA256=358ac54be252673841a1d65bfc2fb6d549c1a4c877fa7f5e1bfa188f30375d69</Hashes>
+                <Hashes condition="contains">SHA256=6fb5bc9c51f6872de116c7db8a2134461743908efc306373f6de59a0646c4f5d</Hashes>
+                <Hashes condition="contains">SHA256=0f016c80c4938fbcd47a47409969b3925f54292eba2ce01a8e45222ce8615eb8</Hashes>
+                <Hashes condition="contains">SHA256=478d855b648ef4501d3b08b3b10e94076ac67546b0ce86b454324f1bf9a78aa0</Hashes>
+                <Hashes condition="contains">SHA256=a7c8f4faf3cbb088cac7753d81f8ec4c38ccb97cd9da817741f49272e8d01200</Hashes>
+                <Hashes condition="contains">SHA256=f1c8ca232789c2f11a511c8cd95a9f3830dd719cad5aa22cb7c3539ab8cb4dc3</Hashes>
+                <Hashes condition="contains">SHA256=8f68ca89910ebe9da3d02ec82d935de1814d79c44f36cd30ea02fa49ae488f00</Hashes>
+                <Hashes condition="contains">SHA256=1afa03118f87b62c59a97617e595ebb26dde8dbdd16ee47ef3ddd1097c30ef6a</Hashes>
+                <Hashes condition="contains">SHA256=e75714f8e0ff45605f6fc7689a1a89c7dcd34aab66c6131c63fefaca584539cf</Hashes>
+                <Hashes condition="contains">SHA256=38fa0c663c8689048726666f1c5e019feaa9da8278f1df6ff62da33961891d2a</Hashes>
+                <Hashes condition="contains">SHA256=b583414fcee280128788f7b39451c511376fe821f455d4f3702795e96d560704</Hashes>
+                <Hashes condition="contains">SHA256=1ee59eb28688e73d10838c66e0d8e011c8df45b6b43a4ac5d0b75795ca3eb512</Hashes>
+                <Hashes condition="contains">SHA256=ef86c4e5ee1dbc4f81cd864e8cd2f4a2a85ee4475b9a9ab698a4ae1cc71fbeb0</Hashes>
+                <Hashes condition="contains">SHA256=29e0062a017a93b2f2f5207a608a96df4d554c5de976bd0276c2590a03bd3e94</Hashes>
+                <Hashes condition="contains">SHA256=c628cda1ef43defc00af45b79949675a8422490d32b080b3a8bb9434242bdbf2</Hashes>
+                <Hashes condition="contains">SHA256=38d87b51f4b69ba2dae1477684a1415f1a3b578eee5e1126673b1beaefee9a20</Hashes>
+                <Hashes condition="contains">SHA256=3d9e83b189fcf5c3541c62d1f54a0da0a4e5b62c3243d2989afc46644056c8e3</Hashes>
+                <Hashes condition="contains">SHA256=88df37ede18bea511f1782c1a6c4915690b29591cf2c1bf5f52201fbbb4fa2b9</Hashes>
+                <Hashes condition="contains">SHA256=e2e79f1e696f27fa70d72f97e448081b1fa14d59cbb89bb4a40428534dd5c6f6</Hashes>
+                <Hashes condition="contains">SHA256=e50b25d94c1771937b2f632e10eea875ac6b19c57da703d52e23ad2b6299f0ae</Hashes>
+                <Hashes condition="contains">SHA256=841335eeb6af68dce5b8b24151776281a751b95056a894991b23afae80e9f33b</Hashes>
+                <Hashes condition="contains">SHA256=9d58f640c7295952b71bdcb456cae37213baccdcd3032c1e3aeb54e79081f395</Hashes>
+                <Hashes condition="contains">SHA256=19bf0d0f55d2ad33ef2d105520bde8fb4286f00e9d7a721e3c9587b9408a0775</Hashes>
+                <Hashes condition="contains">SHA256=da11e9598eef033722b97873d1c046270dd039d0e3ee6cd37911e2dc2eb2608d</Hashes>
+                <Hashes condition="contains">SHA256=2d83ccb1ad9839c9f5b3f10b1f856177df1594c66cbbc7661677d4b462ebf44d</Hashes>
+                <Hashes condition="contains">SHA256=7cfa5e10dff8a99a5d544b011f676bc383991274c693e21e3af40cf6982adb8c</Hashes>
+                <Hashes condition="contains">SHA256=316a27e2bdb86222bc7c8af4e5472166b02aec7f3f526901ce939094e5861f6d</Hashes>
+                <Hashes condition="contains">SHA256=7196187fb1ef8d108b380d37b2af8efdeb3ca1f6eefd37b5dc114c609147216d</Hashes>
+                <Hashes condition="contains">SHA256=d0e25b879d830e4f867b09d6540a664b6f88bad353cd14494c33b31a8091f605</Hashes>
+                <Hashes condition="contains">SHA256=bced04bdefad6a08c763265d6993f07aa2feb57d33ed057f162a947cf0e6668f</Hashes>
+                <Hashes condition="contains">SHA256=2101d5e80e92c55ecfd8c24fcf2202a206a4fd70195a1378f88c4cc04d336f22</Hashes>
+                <Hashes condition="contains">SHA256=9778136d2441439dc470861d15d96fa21dc9f16225232cd05b76791a5e0fde6f</Hashes>
+                <Hashes condition="contains">SHA256=18e1707b319c279c7e0204074088cc39286007a1cf6cb6e269d5067d8d0628c6</Hashes>
+                <Hashes condition="contains">SHA256=2bbc6b9dd5e6d0327250b32305be20c89b19b56d33a096522ee33f22d8c82ff1</Hashes>
+                <Hashes condition="contains">SHA256=7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d</Hashes>
+                <Hashes condition="contains">SHA256=45f42c5d874369d6be270ea27a5511efcca512aeac7977f83a51b7c4dee6b5ef</Hashes>
+                <Hashes condition="contains">SHA256=fb6b0d304433bf88cc7d57728683dbb4b9833459dc33528918ead09b3907ff22</Hashes>
+                <Hashes condition="contains">SHA256=677c0b1add3990fad51f492553d3533115c50a242a919437ccb145943011d2bf</Hashes>
+                <Hashes condition="contains">SHA256=385485e643aa611e97ceae6590c6a8c47155886123dbb9de1e704d0d1624d039</Hashes>
+                <Hashes condition="contains">SHA256=71ff60722231c7641ad593756108cf6779dbaad21c7b08065fb1d4e225eab14d</Hashes>
+                <Hashes condition="contains">SHA256=ad2477632b9b07588cfe0e692f244c05fa4202975c1fe91dd3b90fa911ac6058</Hashes>
+                <Hashes condition="contains">SHA256=727e8ba66a8ff07bdc778eacb463b65f2d7167a6616ca2f259ea32571cacf8af</Hashes>
+                <Hashes condition="contains">SHA256=af095de15a16255ca1b2c27dad365dff9ac32d2a75e8e288f5a1307680781685</Hashes>
+                <Hashes condition="contains">SHA256=cfb7af8ac67a379e7869289aeee21837c448ea6f8ab6c93988e7aa423653bd40</Hashes>
+                <Hashes condition="contains">SHA256=0c512b615eac374d4d494e3c36838d8e788b3dc2691bf27916f7f42694b14467</Hashes>
+                <Hashes condition="contains">SHA256=fb81b5f8bf69637dbdf050181499088a67d24577587bc520de94b5ee8996240f</Hashes>
+                <Hashes condition="contains">SHA256=440883cd9d6a76db5e53517d0ec7fe13d5a50d2f6a7f91ecfc863bc3490e4f5c</Hashes>
+                <Hashes condition="contains">SHA256=e3936d3356573ce2e472495cd3ce769f49a613e453b010433dafce5ea498ddc2</Hashes>
+                <Hashes condition="contains">SHA256=5f487829527802983d5c120e3b99f3cf89333ca14f5e49ac32df0798cfb1f7aa</Hashes>
+                <Hashes condition="contains">SHA256=673b63b67345773cd6d66f6adcf2c753e2d949232bff818d5bb6e05786538d92</Hashes>
+                <Hashes condition="contains">SHA256=72c0d2d699d0440db17cb7cbbc06a253eaafd21465f14bb0fed8b85ae73153d1</Hashes>
+                <Hashes condition="contains">SHA256=ad8ffccfde782bc287241152cf24245a8bf21c2530d81c57e17631b3c4adb833</Hashes>
+                <Hashes condition="contains">SHA256=e61a54f6d3869b43c4eceac3016df73df67cce03878c5a6167166601c5d3f028</Hashes>
+                <Hashes condition="contains">SHA256=5cfad3d473961763306d72c12bd5ae14183a1a5778325c9acacca764b79ca185</Hashes>
+                <Hashes condition="contains">SHA256=436ccab6f62fa2d29827916e054ade7acae485b3de1d3e5c6c62d3debf1480e7</Hashes>
+                <Hashes condition="contains">SHA256=8399e5afd8e3e97139dffb1a9fb00db2186321b427f164403282217cab067c38</Hashes>
+                <Hashes condition="contains">SHA256=b48a309ee0960da3caaaaf1e794e8c409993aeb3a2b64809f36b97aac8a1e62a</Hashes>
+                <Hashes condition="contains">SHA256=dbb457ae1bd07a945a1466ce4a206c625e590aee3922fa7d86fbe956beccfc98</Hashes>
+                <Hashes condition="contains">SHA256=6071db01b50c658cf78665c24f1d21f21b4a12d16bfcfaa6813bf6bbc4d0a1e8</Hashes>
+                <Hashes condition="contains">SHA256=e428ddf9afc9b2d11e2271f0a67a2d6638b860c2c12d4b8cc63d33f3349ee93f</Hashes>
+                <Hashes condition="contains">SHA256=6c64688444d3e004da77dcfb769d064bb38afceeef7ff915dfc71e60e19ff18a</Hashes>
+                <Hashes condition="contains">SHA256=aa9ab1195dc866270e984f1bed5e1358d6ef24c515dfdb6c2a92d1e1b94bf608</Hashes>
+                <Hashes condition="contains">SHA256=1023dcd4c80db19e9f82f95b1c5e1ddb60db7ac034848dd5cc1c78104a6350f4</Hashes>
+                <Hashes condition="contains">SHA256=de3597ae7196ca8c0750dce296a8a4f58893774f764455a125464766fcc9b3b5</Hashes>
+                <Hashes condition="contains">SHA256=47f0cdaa2359a63ad1389ef4a635f1f6eee1f63bdf6ef177f114bdcdadc2e005</Hashes>
+                <Hashes condition="contains">SHA256=db2a9247177e8cdd50fe9433d066b86ffd2a84301aa6b2eb60f361cfff077004</Hashes>
+                <Hashes condition="contains">SHA256=6948480954137987a0be626c24cf594390960242cd75f094cd6aaa5c2e7a54fa</Hashes>
+                <Hashes condition="contains">SHA256=6f55c148bb27c14408cf0f16f344abcd63539174ac855e510a42d78cfaec451c</Hashes>
+                <Hashes condition="contains">SHA256=3e274df646f191d2705c0beaa35eeea84808593c3b333809f13632782e27ad75</Hashes>
+                <Hashes condition="contains">SHA256=ab8f2217e59319b88080e052782e559a706fa4fb7b8b708f709ff3617124da89</Hashes>
+                <Hashes condition="contains">SHA256=0be4912bfd7a79f6ebfa1c06a59f0fb402bd4fe0158265780509edd0e562eac1</Hashes>
+                <Hashes condition="contains">SHA256=77c5e95b872b1d815d6d3ed28b399ca39f3427eeb0143f49982120ff732285a9</Hashes>
+                <Hashes condition="contains">SHA256=42579a759f3f95f20a2c51d5ac2047a2662a2675b3fb9f46c1ed7f23393a0f00</Hashes>
+                <Hashes condition="contains">SHA256=11d258e05b850dcc9ecfacccc9486e54bd928aaa3d5e9942696c323fdbd3481b</Hashes>
+                <Hashes condition="contains">SHA256=5027fce41ed60906a0e76b97c95c2a5a83d57a2d1cd42de232a21f26c0d58e48</Hashes>
+                <Hashes condition="contains">SHA256=955dac77a0148e9f9ed744f5d341cb9c9118261e52fe622ac6213965f2bc4cad</Hashes>
+                <Hashes condition="contains">SHA256=80a59ca71fc20961ccafc0686051e86ae4afbbd4578cb26ad4570b9207651085</Hashes>
+                <Hashes condition="contains">SHA256=dfaefd06b680f9ea837e7815fc1cc7d1f4cc375641ac850667ab20739f46ad22</Hashes>
+                <Hashes condition="contains">SHA256=0d3790af5f8e5c945410929e31d06144a471ac82f828afe89a4758a5bbeb7f9f</Hashes>
+                <Hashes condition="contains">SHA256=50db5480d0392a7dd6ab5df98389dc24d1ed1e9c98c9c35964b19dabcd6dc67f</Hashes>
+                <Hashes condition="contains">SHA256=862d0ff27bb086145a33b9261142838651b0d2e1403be321145e197600eb5015</Hashes>
+                <Hashes condition="contains">SHA256=fca10cde7d331b7f614118682d834d46125a65888e97bd9fda2df3f15797166c</Hashes>
+                <Hashes condition="contains">SHA256=c50f8ab8538c557963252b702c1bd3cee4604b5fc2497705d2a6a3fd87e3cc26</Hashes>
+                <Hashes condition="contains">SHA256=1c1251784e6f61525d0082882a969cb8a0c5d5359be22f5a73e3b0cd38b51687</Hashes>
+                <Hashes condition="contains">SHA256=c8eaa5e6d3230b93c126d2d58e32409e4aeeb23ccf0dd047a17f1ef552f92fe9</Hashes>
+                <Hashes condition="contains">SHA256=31f4140c12ac31f5729a8de4dc051d3acd07783564604df831a2a6722c979192</Hashes>
+                <Hashes condition="contains">SHA256=88e2e6a705d3fb71b966d9fb46dc5a4b015548daf585fb54dfcd81dc0bd3ebdc</Hashes>
+                <Hashes condition="contains">SHA256=f8965fdce668692c3785afa3559159f9a18287bc0d53abb21902895a8ecf221b</Hashes>
+                <Hashes condition="contains">SHA256=3b6e85c8fed9e39b21b2eab0b69bc464272b2c92961510c36e2e2df7aa39861b</Hashes>
+                <Hashes condition="contains">SHA256=399effe75d32bdab6fa0a6bffe02dbf0a59219d940b654837c3be1c0bd02e9aa</Hashes>
+                <Hashes condition="contains">SHA256=092349aebdac28294dbad1656759d8461f362d1a36b01054dccf861d97beadf0</Hashes>
+                <Hashes condition="contains">SHA256=074ae477c8c7ae76c6f2b0bf77ac17935a8e8ee51b52155d2821d93ab30f3761</Hashes>
+                <Hashes condition="contains">SHA256=b47be212352d407d0ef7458a7161c66b47c2aec8391dd101df11e65728337a6a</Hashes>
+                <Hashes condition="contains">SHA256=b51ddcf8309c80384986dda9b11bf7856b030e3e885b0856efdb9e84064917e5</Hashes>
+                <Hashes condition="contains">SHA256=fd33fb2735cc5ef466a54807d3436622407287e325276fcd3ed1290c98bd0533</Hashes>
+                <Hashes condition="contains">SHA256=523d1d43e896077f32cd9acaa8e85b513bfb7b013a625e56f0d4e9675d9822ba</Hashes>
+                <Hashes condition="contains">SHA256=f4ff679066269392f6b7c3ba6257fc60dd609e4f9c491b00e1a16e4c405b0b9b</Hashes>
+                <Hashes condition="contains">SHA256=d5c4ff35eaa74ccdb80c7197d3d113c9cd38561070f2aa69c0affe8ed84a77c9</Hashes>
+                <Hashes condition="contains">SHA256=6cb51ae871fbd5d07c5aad6ff8eea43d34063089528603ca9ceb8b4f52f68ddc</Hashes>
+                <Hashes condition="contains">SHA256=7e3b0b8d3e430074109d85729201d7c34bc5b918c0bcb9f64ce88c5e37e1a456</Hashes>
+                <Hashes condition="contains">SHA256=c5050a2017490fff7aa53c73755982b339ddb0fd7cef2cde32c81bc9834331c5</Hashes>
+                <Hashes condition="contains">SHA256=0f17e5cfc5bdd74aff91bfb1a836071345ba2b5d1b47b0d5bf8e7e0d4d5e2dbf</Hashes>
+                <Hashes condition="contains">SHA256=3a95cc82173032b82a0ffc7d2e438df64c13bc16b4574214c9fe3be37250925e</Hashes>
+                <Hashes condition="contains">SHA256=4ab41816abbf14d59e75b7fad49e2cb1c1feb27a3cb27402297a2a4793ff9da7</Hashes>
+                <Hashes condition="contains">SHA256=42e170a7ab1d2c160d60abfc906872f9cfd0c2ee169ed76f6acb3f83b3eeefdb</Hashes>
+                <Hashes condition="contains">SHA256=496f4a4021226fb0f1b5f71a7634c84114c29faa308746a12c2414adb6b2a40b</Hashes>
+                <Hashes condition="contains">SHA256=9a1d66036b0868bbb1b2823209fedea61a301d5dd245f8e7d390bd31e52d663e</Hashes>
+                <Hashes condition="contains">SHA256=a7b000abbcc344444a9b00cfade7aa22ab92ce0cadec196c30eb1851ae4fa062</Hashes>
+                <Hashes condition="contains">SHA256=38bb9751a3a1f072d518afe6921a66ee6d5cf6d25bc50af49e1925f20d75d4d7</Hashes>
+                <Hashes condition="contains">SHA256=86a8e0aa29a5b52c84921188cc1f0eca9a7904dcfe09544602933d8377720219</Hashes>
+                <Hashes condition="contains">SHA256=1b00d6e5d40b1b84ca63da0e99246574cdd2a533122bc83746f06c0d66e63a6e</Hashes>
+                <Hashes condition="contains">SHA256=6c7120e40fc850e4715058b233f5ad4527d1084a909114fd6a36b7b7573c4a44</Hashes>
+                <Hashes condition="contains">SHA256=e58bbf3251906ff722aa63415bf169618e78be85cb92c8263d3715c260491e90</Hashes>
+                <Hashes condition="contains">SHA256=000547560fea0dd4b477eb28bf781ea67bf83c748945ce8923f90fdd14eb7a4b</Hashes>
+                <Hashes condition="contains">SHA256=53eaefba7e7dca9ab74e385abf18762f9f1aa51594e7f7db5ba612d6c787dd7e</Hashes>
+                <Hashes condition="contains">SHA256=7837cb350338c4958968d06b105466da6518f5bb522a6e70e87c0cad85128408</Hashes>
+                <Hashes condition="contains">SHA256=6e0aa67cfdbe27a059cbd066443337f81c5b6d37444d14792d1c765d9d122dcf</Hashes>
+                <Hashes condition="contains">SHA256=3503ea284b6819f9cb43b3e94c0bb1bf5945ccb37be6a898387e215197a4792a</Hashes>
+                <Hashes condition="contains">SHA256=37dde6bd8a7a36111c3ac57e0ac20bbb93ce3374d0852bcacc9a2c8c8c30079e</Hashes>
+                <Hashes condition="contains">SHA256=54841d9f89e195196e65aa881834804fe3678f1cf6b328cab8703edd15e3ec57</Hashes>
+                <Hashes condition="contains">SHA256=48891874441c6fa69e5518d98c53d83b723573e280c6c65ccfbde9039a6458c9</Hashes>
+                <Hashes condition="contains">SHA256=37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba</Hashes>
+                <Hashes condition="contains">SHA256=01aa278b07b58dc46c84bd0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd</Hashes>
+                <Hashes condition="contains">SHA256=f29073dc99cb52fa890aae80037b48a172138f112474a1aecddae21179c93478</Hashes>
+                <Hashes condition="contains">SHA256=e3f2ee22dec15061919583e4beb8abb3b29b283e2bcb46badf2bfde65f5ea8dd</Hashes>
+                <Hashes condition="contains">SHA256=20f11a64bc4548f4edb47e3d3418da0f6d54a83158224b71662a6292bf45b5fb</Hashes>
+                <Hashes condition="contains">SHA256=38b3eb8c86201d26353aab625cea672e60c2f66ce6f5e5eda673e8c3478bf305</Hashes>
+                <Hashes condition="contains">SHA256=ea85bbe63d6f66f7efee7007e770af820d57f914c7f179c5fee3ef2845f19c41</Hashes>
+                <Hashes condition="contains">SHA256=d74755311d127d0eb7454e56babc2db8dbaa814bc4ba8e2a7754d3e0224778e1</Hashes>
+                <Hashes condition="contains">SHA256=e32ab30d01dcff6418544d93f99ae812d2ce6396e809686620547bea05074f6f</Hashes>
+                <Hashes condition="contains">SHA256=69e3fda487a5ec2ec0f67b7d79a5a836ff0036497b2d1aec514c67d2efa789b2</Hashes>
+                <Hashes condition="contains">SHA256=9ee33ffd80611a13779df6286c1e04d3c151f1e2f65e3d664a08997fcd098ef3</Hashes>
+                <Hashes condition="contains">SHA256=de6bf572d39e2611773e7a01f0388f84fb25da6cba2f1f8b9b36ffba467de6fa</Hashes>
+                <Hashes condition="contains">SHA256=fc22977ff721b3d718b71c42440ee2d8a144f3fbc7755e4331ddd5bcc65158d2</Hashes>
+                <Hashes condition="contains">SHA256=6de84caa2ca18673e01b91af58220c60aecd5cccf269725ec3c7f226b2167492</Hashes>
+                <Hashes condition="contains">SHA256=0e53b58415fa68552928622118d5b8a3a851b2fc512709a90b63ba46acda8b6b</Hashes>
+                <Hashes condition="contains">SHA256=3279593db91bb7ad5b489a01808c645eafafda6cc9c39f50d10ccc30203f2ddf</Hashes>
+                <Hashes condition="contains">SHA256=d8459f7d707c635e2c04d6d6d47b63f73ba3f6629702c7a6e0df0462f6478ae2</Hashes>
+                <Hashes condition="contains">SHA256=61befeef14783eb0fed679fca179d2f5c33eb2dcbd40980669ca2ebeb3bf11cf</Hashes>
+                <Hashes condition="contains">SHA256=7cc9ba2df7b9ea6bb17ee342898edd7f54703b93b6ded6a819e83a7ee9f938b4</Hashes>
+                <Hashes condition="contains">SHA256=9b1ac756e35f795dd91adbc841e78db23cb7165280f8d4a01df663128b66d194</Hashes>
+                <Hashes condition="contains">SHA256=6befa481e8cca8084d9ec3a1925782cd3c28ef7a3e4384e034d48deaabb96b63</Hashes>
+                <Hashes condition="contains">SHA256=5b3705b47dc15f2b61ca3821b883b9cd114d83fcc3344d11eb1d3df495d75abe</Hashes>
+                <Hashes condition="contains">SHA256=34bee22c18ddbddbe115cf1ab55cabf0e482aba1eb2c343153577fb24b7226d3</Hashes>
+                <Hashes condition="contains">SHA256=2f60536b25ba8c9014e4a57d7a9a681bd3189fa414eea88c256d029750e15cae</Hashes>
+                <Hashes condition="contains">SHA256=3f2fda9a7a9c57b7138687bbce49a2e156d6095dddabb3454ea09737e02c3fa5</Hashes>
+                <Hashes condition="contains">SHA256=d92eab70bcece4432258c9c9a914483a2267f6ab5ce2630048d3a99e8cb1b482</Hashes>
+                <Hashes condition="contains">SHA256=81aafae4c4158d0b9a6431aff0410745a0f6a43fb20a9ab316ffeb8c2e2ccac0</Hashes>
+                <Hashes condition="contains">SHA256=1c8dfa14888bb58848b4792fb1d8a921976a9463be8334cff45cc96f1276049a</Hashes>
+                <Hashes condition="contains">SHA256=9679758455c69877fce866267d60c39d108b495dca183954e4af869902965b3d</Hashes>
+                <Hashes condition="contains">SHA256=b6fd51e1f57a03006953e84fd56cc2821cc19e7c77c0474e1110aabaacaf03df</Hashes>
+                <Hashes condition="contains">SHA256=9a91d6e83b8fdec536580f6617f10dfc64eedf14ead29a6a644eb154426622ba</Hashes>
+                <Hashes condition="contains">SHA256=6ed35f310c96920a271c59a097b382da07856e40179c2a4239f8daa04eef38e7</Hashes>
+                <Hashes condition="contains">SHA256=cff9aa9046bdfd781d34f607d901a431a51bb7e5f48f4f681cc743b2cdedc98c</Hashes>
+                <Hashes condition="contains">SHA256=dde6f28b3f7f2abbee59d4864435108791631e9cb4cdfb1f178e5aa9859956d8</Hashes>
+                <Hashes condition="contains">SHA256=59626cac380d8fe0b80a6d4c4406d62ba0683a2f0f68d50ad506ca1b1cf25347</Hashes>
+                <Hashes condition="contains">SHA256=18deed37f60b6aa8634dda2565a0485452487d7bce88afb49301a7352db4e506</Hashes>
+                <Hashes condition="contains">SHA256=01e024cb14b34b6d525c642a710bfa14497ea20fd287c39ba404b10a8b143ece</Hashes>
+                <Hashes condition="contains">SHA256=509628b6d16d2428031311d7bd2add8d5f5160e9ecc0cd909f1e82bbbb3234d6</Hashes>
+                <Hashes condition="contains">SHA256=ada4e42bf5ef58ef1aad94435441003b1cc1fcaa5d38bfdbe1a3d736dc451d47</Hashes>
+                <Hashes condition="contains">SHA256=e2d8dd5dacc24051709f55a35184f5f99aef957a83bd358b0608b4479e1ec24f</Hashes>
+                <Hashes condition="contains">SHA256=c2fcc0fec64d5647813b84b9049d430406c4c6a7b9f8b725da21bcae2ff12247</Hashes>
+                <Hashes condition="contains">SHA256=7c731c0ea7f28671ab7787800db69739ea5cd6be16ea21045b4580cf95cbf73b</Hashes>
+                <Hashes condition="contains">SHA256=34e0364a4952d914f23f271d36e11161fb6bb7b64aea22ff965a967825a4a4bf</Hashes>
+                <Hashes condition="contains">SHA256=cc687fe3741bbde1dd142eac0ef59fd1d4457daee43cdde23bb162ef28d04e64</Hashes>
+                <Hashes condition="contains">SHA256=da6ca1fb539f825ca0f012ed6976baf57ef9c70143b7a1e88b4650bf7a925e24</Hashes>
+                <Hashes condition="contains">SHA256=5fad3775feb8b6f6dcbd1642ae6b6a565ff7b64eadfc9bf9777918b51696ab36</Hashes>
+                <Hashes condition="contains">SHA256=bda99629ec6c522c3efcbcc9ca33688d31903146f05b37d0d3b43db81bfb3961</Hashes>
+                <Hashes condition="contains">SHA256=9790a7b9d624b2b18768bb655dda4a05a9929633cef0b1521e79e40d7de0a05b</Hashes>
+                <Hashes condition="contains">SHA256=1963d5a0e512b72353953aadbe694f73a9a576f0241a988378fa40bf574eda52</Hashes>
+                <Hashes condition="contains">SHA256=ae79e760c739d6214c1e314728a78a6cb6060cce206fde2440a69735d639a0a2</Hashes>
+                <Hashes condition="contains">SHA256=72288d4978ee87ea6c8b1566dbd906107357087cef7364fb3dd1e1896d00baeb</Hashes>
+                <Hashes condition="contains">SHA256=e4eca7db365929ff7c5c785e2eab04ef8ec67ea9edcf7392f2b74eccd9449148</Hashes>
+                <Hashes condition="contains">SHA256=1aaf4c1e3cb6774857e2eef27c17e68dc1ae577112e4769665f516c2e8c4e27b</Hashes>
+                <Hashes condition="contains">SHA256=131d5490ceb9a5b2324d8e927fea5becfc633015661de2f4c2f2375a3a3b64c6</Hashes>
+                <Hashes condition="contains">SHA256=89b0017bc30cc026e32b758c66a1af88bd54c6a78e11ec2908ff854e00ac46be</Hashes>
+                <Hashes condition="contains">SHA256=70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4</Hashes>
+                <Hashes condition="contains">SHA256=626fae47811450d080d08c3d9fd890aa64bfecdc45eacd42a40850c1833c8763</Hashes>
+                <Hashes condition="contains">SHA256=101402d4f5d1ae413ded499c78a5fcbbc7e3bae9b000d64c1dd64e3c48c37558</Hashes>
+                <Hashes condition="contains">SHA256=1078af0c70e03ac17c7b8aa5ee03593f5decfef2f536716646a4ded1e98c153c</Hashes>
+                <Hashes condition="contains">SHA256=8f23313adb35782adb0ba97fefbfbb8bbc5fc40ae272e07f6d4629a5305a3fa2</Hashes>
+                <Hashes condition="contains">SHA256=3a5ec83fe670e5e23aef3afa0a7241053f5b6be5e6ca01766d6b5f9177183c25</Hashes>
+                <Hashes condition="contains">SHA256=2fbbc276737047cb9b3ba5396756d28c1737342d89dce1b64c23a9c4513ae445</Hashes>
+                <Hashes condition="contains">SHA256=98a123b314cba2de65f899cdbfa386532f178333389e0f0fbd544aff85be02eb</Hashes>
+                <Hashes condition="contains">SHA256=2bbe65cbec3bb069e92233924f7ee1f95ffa16173fceb932c34f68d862781250</Hashes>
+                <Hashes condition="contains">SHA256=2470fd1b733314c9b0afa19fd39c5d19aa1b36db598b5ebbe93445caa545da5f</Hashes>
+                <Hashes condition="contains">SHA256=09043c51719d4bf6405c9a7a292bb9bb3bcc782f639b708ddcc4eedb5e5c9ce9</Hashes>
+                <Hashes condition="contains">SHA256=d884ca8cc4ef1826ca3ab03eb3c2d8f356ba25f2d20db0a7d9fc251c565be7f3</Hashes>
+                <Hashes condition="contains">SHA256=55fee54c0d0d873724864dc0b2a10b38b7f40300ee9cae4d9baaf8a202c4049a</Hashes>
+                <Hashes condition="contains">SHA256=4045ae77859b1dbf13972451972eaaf6f3c97bea423e9e78f1c2f14330cd47ca</Hashes>
+                <Hashes condition="contains">SHA256=b95b2d9b29bd25659f1c7ba5a187f8d23cde01162d9b5b1a2c4aea8f64b38441</Hashes>
+                <Hashes condition="contains">SHA256=1766fd66f846d9a21e648d649ad35d1ff94f8ca17a40a9a738444d6b8e07aacb</Hashes>
+                <Hashes condition="contains">SHA256=8111085022bda87e5f6aa4c195e743cc6dd6a3a6d41add475d267dc6b105a69f</Hashes>
+                <Hashes condition="contains">SHA256=c089a31ac95d41ed02d1e4574962f53376b36a9e60ff87769d221dc7d1a3ecfa</Hashes>
+                <Hashes condition="contains">SHA256=b2ba6efeff1860614b150916a77c9278f19d51e459e67a069ccd15f985cbc0e1</Hashes>
+                <Hashes condition="contains">SHA256=823da894b2c73ffcd39e77366b6f1abf0ae9604d9b20140a54e6d55053aadeba</Hashes>
+                <Hashes condition="contains">SHA256=79e2d37632c417138970b4feba91b7e10c2ea251c5efe3d1fc6fa0190f176b57</Hashes>
+                <Hashes condition="contains">SHA256=1aaa9aef39cb3c0a854ecb4ca7d3b213458f302025e0ec5bfbdef973cca9111c</Hashes>
+                <Hashes condition="contains">SHA256=f596e64f4c5d7c37a00493728d8756b243cfdc11e3372d6d6dfeffc13c9ab960</Hashes>
+                <Hashes condition="contains">SHA256=0da746e49fd662be910d0e366934a7e02898714eaaa577e261ab40eb44222b5c</Hashes>
+                <Hashes condition="contains">SHA256=c9cf1d627078f63a36bbde364cd0d5f2be1714124d186c06db5bcdf549a109f8</Hashes>
+                <Hashes condition="contains">SHA256=092d04284fdeb6762e65e6ac5b813920d6c69a5e99d110769c5c1a78e11c5ba0</Hashes>
+                <Hashes condition="contains">SHA256=0ee5067ce48883701824c5b1ad91695998916a3702cf8086962fbe58af74b2d6</Hashes>
+                <Hashes condition="contains">SHA256=2b4c7d3820fe08400a7791e2556132b902a9bbadc1942de57077ecb9d21bf47a</Hashes>
+                <Hashes condition="contains">SHA256=07b6d69bafcfd767f1b63a490a8843c3bb1f8e1bbea56176109b5743c8f7d357</Hashes>
+                <Hashes condition="contains">SHA256=5f5e5f1c93d961985624768b7c676d488c7c7c1d4c043f6fc1ea1904fefb75be</Hashes>
+                <Hashes condition="contains">SHA256=93b266f38c3c3eaab475d81597abbd7cc07943035068bb6fd670dbbe15de0131</Hashes>
+                <Hashes condition="contains">SHA256=dcb815eb8e9016608d0d917101b6af8c84b96fb709dc0344bceed02cbc4ed258</Hashes>
+                <Hashes condition="contains">SHA256=4b5229b3250c8c08b98cb710d6c056144271de099a57ae09f5d2097fc41bd4f1</Hashes>
+                <Hashes condition="contains">SHA256=9dab4b6fddc8e1ec0a186aa8382b184a5d52cfcabaaf04ff9e3767021eb09cf4</Hashes>
+                <Hashes condition="contains">SHA256=6b830ea0db6546a044c9900d3f335e7820c2a80e147b0751641899d1a5aa8f74</Hashes>
+                <Hashes condition="contains">SHA256=ae6fb53e4d8122dba3a65e5fa59185b36c3ac9df46e82fcfb6731ab55c6395aa</Hashes>
+                <Hashes condition="contains">SHA256=7e0124fcc7c95fdc34408cf154cb41e654dade8b898c71ad587b2090b1da30d7</Hashes>
+                <Hashes condition="contains">SHA256=5f69d6b167a1eeca3f6ac64785c3c01976ee7303171faf998d65852056988683</Hashes>
+                <Hashes condition="contains">SHA256=e4a7da2cf59a4a21fc42b611df1d59cae75051925a7ddf42bf216cc1a026eadb</Hashes>
+                <Hashes condition="contains">SHA256=0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5</Hashes>
+                <Hashes condition="contains">SHA256=e005e8d183e853a27ad3bb56f25489f369c11b0d47e3d4095aad9291b3343bf1</Hashes>
+                <Hashes condition="contains">SHA256=5177a3b7393fb5855b2ec0a45d4c91660b958ee077e76e5a7d0669f2e04bcf02</Hashes>
+                <Hashes condition="contains">SHA256=f6cd7353cb6e86e98d387473ed6340f9b44241867508e209e944f548b9db1d5f</Hashes>
+                <Hashes condition="contains">SHA256=7877c1b0e7429453b750218ca491c2825dae684ad9616642eff7b41715c70aca</Hashes>
+                <Hashes condition="contains">SHA256=8137ce22d0d0fc5ea5b174d6ad3506a4949506477b1325da2ccb76511f4c4f60</Hashes>
+                <Hashes condition="contains">SHA256=5d530e111400785d183057113d70623e17af32931668ab7c7fc826f0fd4f91a3</Hashes>
+                <Hashes condition="contains">SHA256=2d195cd4400754cc6f6c3f8ab1fe31627932c3c1bf8d5d0507c292232d1a2396</Hashes>
+                <Hashes condition="contains">SHA256=ee3ff12943ced401e2b6df9e66e8a0be8e449fa9326cab241f471b2d8ffefdd7</Hashes>
+                <Hashes condition="contains">SHA256=65008817eb97635826a8708a6411d7b50f762bab81304e457119d669382944c3</Hashes>
+                <Hashes condition="contains">SHA256=7893307df2fdde25371645a924f0333e1b2de31b6bc839d8e2a908d7830c6504</Hashes>
+                <Hashes condition="contains">SHA256=2121a2bb8ebbf2e6e82c782b6f3c6b7904f686aa495def25cf1cf52a42e16109</Hashes>
+                <Hashes condition="contains">SHA256=e1980c6592e6d2d92c1a65acad8f1071b6a404097bb6fcce494f3c8ac31385cf</Hashes>
+                <Hashes condition="contains">SHA256=f85784fa8e7a7ec86cb3fe76435802f6bb82256e1824ed7b5d61bf075f054573</Hashes>
+                <Hashes condition="contains">SHA256=8688e43d94b41eeca2ed458b8fc0d02f74696a918e375ecd3842d8627e7a8f2b</Hashes>
+                <Hashes condition="contains">SHA256=f581decc2888ef27ee1ea85ea23bbb5fb2fe6a554266ff5a1476acd1d29d53af</Hashes>
+                <Hashes condition="contains">SHA256=61a1bdddd3c512e681818debb5bee94db701768fc25e674fcad46592a3259bd0</Hashes>
+                <Hashes condition="contains">SHA256=4b4c925c3b8285aeeab9b954e8b2a0773b4d2d0e18d07d4a9d268f4be90f6cae</Hashes>
+                <Hashes condition="contains">SHA256=ac63c26ca43701dddaa7fb1aea535d42190f88752900a03040fd5aaa24991e25</Hashes>
+                <Hashes condition="contains">SHA256=7dfc2eb033d2e090540860b8853036f40736d02bd22099ff6cf665a90be659cd</Hashes>
+                <Hashes condition="contains">SHA256=b773511fdb2e370dec042530910a905472fcc2558eb108b246fd3200171b04d3</Hashes>
+                <Hashes condition="contains">SHA256=2da330a2088409efc351118445a824f11edbe51cf3d653b298053785097fe40e</Hashes>
+                <Hashes condition="contains">SHA256=f85eb576acb5db0d2f48e5f09a7244165a876fa1ca8697ebb773e4d7071d4439</Hashes>
+                <Hashes condition="contains">SHA256=e4d9f037411284e996a002b15b49bc227d085ee869ae1cd91ba54ff7c244f036</Hashes>
+                <Hashes condition="contains">SHA256=36e3127f045ef1fa7426a3ff8c441092d3b66923d2b69826034e48306609e289</Hashes>
+                <Hashes condition="contains">SHA256=950a4c0c772021cee26011a92194f0e58d61588f77f2873aa0599dff52a160c9</Hashes>
+                <Hashes condition="contains">SHA256=5c04c274a708c9a7d993e33be3ea9e6119dc29527a767410dbaf93996f87369a</Hashes>
+                <Hashes condition="contains">SHA256=0fd2df82341bf5ebb8a53682e60d08978100c01acb0bed7b6ce2876ada80f670</Hashes>
+                <Hashes condition="contains">SHA256=904e0f7d485a98e8497d5ec6dd6e6e1cf0b8d8e067fb64a9e09790af3c8c9d5a</Hashes>
+                <Hashes condition="contains">SHA256=3ec5ad51e6879464dfbccb9f4ed76c6325056a42548d5994ba869da9c4c039a8</Hashes>
+                <Hashes condition="contains">SHA256=3c4207c90c97733fae2a08679d63fbbe94dfcf96fdfdf88406aa7ab3f80ea78f</Hashes>
+                <Hashes condition="contains">SHA256=077aa8ff5e01747723b6d24cc8af460a7a00f30cd3bc80e41cc245ceb8305356</Hashes>
+                <Hashes condition="contains">SHA256=cfcf32f5662791f1f22a77acb6dddfbc970fe6e99506969b3ea67c03f67687ab</Hashes>
+                <Hashes condition="contains">SHA256=6bfc0f425de9f4e7480aa2d1f2e08892d0553ed0df1c31e9bf3d8d702f38fa2e</Hashes>
+                <Hashes condition="contains">SHA256=f15ae970e222ce06dbf3752b223270d0e726fb78ebec3598b4f8225b5a0880b1</Hashes>
+                <Hashes condition="contains">SHA256=e86cb77de7b6a8025f9a546f6c45d135f471e664963cf70b381bee2dfd0fdef4</Hashes>
+                <Hashes condition="contains">SHA256=654c5ba47f74008c8f49cbb97988017eec8c898adc3bb851bc6e1fdf9dcf54ad</Hashes>
+                <Hashes condition="contains">SHA256=ad40e6d0f77c0e579fb87c5106bf6de3d1a9f30ee2fbf8c9c011f377fa05f173</Hashes>
+                <Hashes condition="contains">SHA256=6ffdde6bc6784c13c601442e47157062941c47015891e7139c2aaba676ab59cc</Hashes>
+                <Hashes condition="contains">SHA256=81939e5c12bd627ff268e9887d6fb57e95e6049f28921f3437898757e7f21469</Hashes>
+                <Hashes condition="contains">SHA256=80cbba9f404df3e642f22c476664d63d7c229d45d34f5cd0e19c65eb41becec3</Hashes>
+                <Hashes condition="contains">SHA256=ab2632a4d93a7f3b7598c06a9fdc773a1b1b69a7dd926bdb7cf578992628e9dd</Hashes>
+                <Hashes condition="contains">SHA256=22418016e980e0a4a2d01ca210a17059916a4208352c1018b0079ccb19aaf86a</Hashes>
+                <Hashes condition="contains">SHA256=f51bdb0ad924178131c21e39a8ccd191e46b5512b0f2e1cc8486f63e84e5d960</Hashes>
+                <Hashes condition="contains">SHA256=119c48b79735fda0ecd973d77d9bdc6b329960caed09b38ab454236ca039d280</Hashes>
+                <Hashes condition="contains">SHA256=62f5e13b2edc00128716cb93e6a9eddffea67ce83d2bb426f18f5be08ead89e0</Hashes>
+                <Hashes condition="contains">SHA256=0b542e47248611a1895018ec4f4033ea53464f259c74eb014d018b19ad818917</Hashes>
+                <Hashes condition="contains">SHA256=5a826b4fa10891cf63aae832fc645ce680a483b915c608ca26cedbb173b1b80a</Hashes>
+                <Hashes condition="contains">SHA256=7133a461aeb03b4d69d43f3d26cd1a9e3ee01694e97a0645a3d8aa1a44c39129</Hashes>
+                <Hashes condition="contains">SHA256=2a6212f3b68a6f263e96420b3607b31cfdfe51afff516f3c87d27bf8a89721e8</Hashes>
+                <Hashes condition="contains">SHA256=453be8f63cc6b116e2049659e081d896491cf1a426e3d5f029f98146a3f44233</Hashes>
+                <Hashes condition="contains">SHA256=cdfbe62ef515546f1728189260d0bdf77167063b6dbb77f1db6ed8b61145a2bc</Hashes>
+                <Hashes condition="contains">SHA256=3c5d7069f85ec1d6f58147431f88c4d7c48df73baf94ffdefd664f2606baf09c</Hashes>
+                <Hashes condition="contains">SHA256=ded2927f9a4e64eefd09d0caba78e94f309e3a6292841ae81d5528cab109f95d</Hashes>
+                <Hashes condition="contains">SHA256=ac3f613d457fc4d44fa27b2e0b1baa62c09415705efb5a40a4756da39b3ac165</Hashes>
+                <Hashes condition="contains">SHA256=fa875178ae2d7604d027510b0d0a7e2d9d675e10a4c9dda2d927ee891e0bcb91</Hashes>
+                <Hashes condition="contains">SHA256=2003b478b9fd1b3d76ec5bf4172c2e8915babbbee7ad1783794acbf8d4c2519d</Hashes>
+                <Hashes condition="contains">SHA256=60c6f4f34c7319cb3f9ca682e59d92711a05a2688badbae4891b1303cd384813</Hashes>
+                <Hashes condition="contains">SHA256=47eaebc920ccf99e09fc9924feb6b19b8a28589f52783327067c9b09754b5e84</Hashes>
+                <Hashes condition="contains">SHA256=0de4247e72d378713bcf22d5c5d3874d079203bb4364e25f67a90d5570bdcce8</Hashes>
+                <Hashes condition="contains">SHA256=1a42ebde59e8f63804eaa404f79ee93a16bb33d27fb158c6bfbe6143226899a0</Hashes>
+                <Hashes condition="contains">SHA256=76614f2e372f33100a8d92bf372cdbc1e183930ca747eed0b0cf2501293b990a</Hashes>
+                <Hashes condition="contains">SHA256=405472a8f9400a54bb29d03b436ccd58cfd6442fe686f6d2ed4f63f002854659</Hashes>
+                <Hashes condition="contains">SHA256=15fb486b6b8c2a2f1b067f48fba10c2f164638fe5e6cee618fb84463578ecac9</Hashes>
+                <Hashes condition="contains">SHA256=deecbcd260849178de421d8e2f177dce5c63cf67a48abb23a0e3cf3aa3e00578</Hashes>
+                <Hashes condition="contains">SHA256=08eb2d2aa25c5f0af4e72a7e0126735536f6c2c05e9c7437282171afe5e322c6</Hashes>
+                <Hashes condition="contains">SHA256=49329fa09f584d1960b09c1b15df18c0bc1c4fdb90bf48b6b5703e872040b668</Hashes>
+                <Hashes condition="contains">SHA256=c26b51b4c37330800cff8519252e110116c3aaade94ceb9894ec5bfb1b8f9924</Hashes>
+                <Hashes condition="contains">SHA256=7ec93f34eb323823eb199fbf8d06219086d517d0e8f4b9e348d7afd41ec9fd5d</Hashes>
+                <Hashes condition="contains">SHA256=4e37592a2a415f520438330c32cfbdbd6af594deef5290b2fa4b9722b898ff69</Hashes>
+                <Hashes condition="contains">SHA256=6f1fc8287dd8d724972d7a165683f2b2ad6837e16f09fe292714e8e38ecd1e38</Hashes>
+                <Hashes condition="contains">SHA256=85866e8c25d82c1ec91d7a8076c7d073cccf421cf57d9c83d80d63943a4edd94</Hashes>
+                <Hashes condition="contains">SHA256=6f1ff29e2e710f6d064dc74e8e011331d807c32cc2a622cbe507fd4b4d43f8f4</Hashes>
+                <Hashes condition="contains">SHA256=0cf6c6c2d231eaf67dfc87561cc9a56ecef89ab50baafee5a67962748d51faf3</Hashes>
+                <Hashes condition="contains">SHA256=fafa1bb36f0ac34b762a10e9f327dcab2152a6d0b16a19697362d49a31e7f566</Hashes>
+                <Hashes condition="contains">SHA256=bb50818a07b0eb1bd317467139b7eb4bad6cd89053fecdabfeae111689825955</Hashes>
+                <Hashes condition="contains">SHA256=4324f3d1e4007f6499a3d0f0102cd92ed9f554332bc0b633305cd7b957ff16c8</Hashes>
+                <Hashes condition="contains">SHA256=be54f7279e69fb7651f98e91d24069dbc7c4c67e65850e486622ccbdc44d9a57</Hashes>
+                <Hashes condition="contains">SHA256=845f1e228de249fc1ddf8dc28c39d03e8ad328a6277b6502d3932e83b879a65a</Hashes>
+                <Hashes condition="contains">SHA256=2a652de6b680d5ad92376ad323021850dab2c653abf06edf26120f7714b8e08a</Hashes>
+                <Hashes condition="contains">SHA256=8797d9afc7a6bb0933f100a8acbb5d0666ec691779d522ac66c66817155b1c0d</Hashes>
+                <Hashes condition="contains">SHA256=30abc0cc700fdebc74e62d574addc08f6227f9c7177d9eaa8cbc37d5c017c9bb</Hashes>
+                <Hashes condition="contains">SHA256=4d0580c20c1ba74cf90d44c82d040f0039542eea96e4bbff3996e6760f457cee</Hashes>
+                <Hashes condition="contains">SHA256=51e91dd108d974ae809e5fc23f6fbd16e13f672f86aa594dae4a5c4bc629b0b5</Hashes>
+                <Hashes condition="contains">SHA256=e81230217988f3e7ec6f89a06d231ec66039bdba340fd8ebb2bbb586506e3293</Hashes>
+                <Hashes condition="contains">SHA256=14adbf0bc43414a7700e5403100cff7fc6ade50bebfab16a17acf2fdda5a9da8</Hashes>
+                <Hashes condition="contains">SHA256=db90e554ad249c2bd888282ecf7d8da4d1538dd364129a3327b54f8242dd5653</Hashes>
+                <Hashes condition="contains">SHA256=a3e507e713f11901017fc328186ae98e23de7cea5594687480229f77d45848d8</Hashes>
+                <Hashes condition="contains">SHA256=65c26276cadda7a36f8977d1d01120edb5c3418be2317d501761092d5f9916c9</Hashes>
+                <Hashes condition="contains">SHA256=e3b257357be41a18319332df7023c4407e2b93ac4c9e0c6754032e29f3763eac</Hashes>
+                <Hashes condition="contains">SHA256=591bd5e92dfa0117b3daa29750e73e2db25baa717c31217539d30ffb1f7f3a52</Hashes>
+                <Hashes condition="contains">SHA256=16a2e578bc8683f17a175480fea4f53c838cfae965f1d4caa47eaf9e0b3415c1</Hashes>
+                <Hashes condition="contains">SHA256=97b32ddf83f75637e3ba934df117081dd6a1c57d47a4c9700d35e736da11d5bd</Hashes>
+                <Hashes condition="contains">SHA256=26453afb1f808f64bec87a2532a9361b696c0ed501d6b973a1f1b5ae152a4d40</Hashes>
+                <Hashes condition="contains">SHA256=ab0925398f3fa69a67eacee2bbb7b34ac395bb309df7fc7a9a9b8103ef41ed7a</Hashes>
+                <Hashes condition="contains">SHA256=7236c8ff33c0e5cfa956778aa7303f1979f3bf709c361399fa1ce101b7e355b8</Hashes>
+                <Hashes condition="contains">SHA256=4880f40f2e557cff38100620b9aa1a3a753cb693af16cd3d95841583edcb57a8</Hashes>
+                <Hashes condition="contains">SHA256=cc586254e9e89e88334adee44e332166119307e79c2f18f6c2ab90ce8ba7fc9b</Hashes>
+                <Hashes condition="contains">SHA256=3943a796cc7c5352aa57ccf544295bfd6fb69aae147bc8235a00202dc6ed6838</Hashes>
+                <Hashes condition="contains">SHA256=3fa6379951f08ed3cb87eeba9cf0c5f5e1d0317dcfcf003b810df9d795eeb73e</Hashes>
+                <Hashes condition="contains">SHA256=29a90ae1dcee66335ece4287a06482716530509912be863c85a2a03a6450a5b6</Hashes>
+                <Hashes condition="contains">SHA256=9a95a70f68144980f2d684e96c79bdc93ebca1587f46afae6962478631e85d0c</Hashes>
+                <Hashes condition="contains">SHA256=f744abb99c97d98e4cd08072a897107829d6d8481aee96c22443f626d00f4145</Hashes>
+                <Hashes condition="contains">SHA256=76660e91f1ff3cb89630df5af4fe09de6098d09baa66b1a130c89c3c5edd5b22</Hashes>
+                <Hashes condition="contains">SHA256=3a65d14fd3b1b5981084cdbd293dc6f4558911ea18dd80177d1e5b54d85bcaa0</Hashes>
+                <Hashes condition="contains">SHA256=0909005d625866ef8ccd8ae8af5745a469f4f70561b644d6e38b80bccb53eb06</Hashes>
+                <Hashes condition="contains">SHA256=be8dd2d39a527649e34dc77ef8bc07193a4234b38597b8f51e519dadc5479ec2</Hashes>
+                <Hashes condition="contains">SHA256=c64d4ac416363c7a1aa828929544d1c1d78cf032b39769943b851cfc4c0faafc</Hashes>
+                <Hashes condition="contains">SHA256=8939116df1d6c8fd0ebd14b2d37b3dec38a8820aa666ecd487bc1bb794f2a587</Hashes>
+                <Hashes condition="contains">SHA256=1e8b0c1966e566a523d652e00f7727d8b0663f1dfdce3b9a09b9adfaef48d8ee</Hashes>
+                <Hashes condition="contains">SHA256=55963284bbd5a3297f39f12f0d8a01ed99fe59d008561e3537bcd4db4b4268fa</Hashes>
+			</DriverLoad>
+		</RuleGroup>
+
+		<RuleGroup name="Vulnerable Driver Drop Detected" groupRelation="or">
+			<FileExecutableDetected onmatch="include">
+                <Hashes condition="contains">SHA256=7ad0ab23023bc500c3b46f414a8b363c5f8700861bc4745cecc14dd34bcee9ed</Hashes>
+                <Hashes condition="contains">SHA256=9529efb1837b1005e5e8f477773752078e0a46500c748bc30c9b5084d04082e6</Hashes>
+                <Hashes condition="contains">SHA256=0bc3685b0b8adc97931b5d31348da235cd7581a67edf6d79913e6a5709866135</Hashes>
+                <Hashes condition="contains">SHA256=ce23c2dae4cca4771ea50ec737093dfafac06c64db0f924a1ccbbf687e33f5a2</Hashes>
+                <Hashes condition="contains">SHA256=b1334a71cc73b3d0c54f62d8011bec330dfc355a239bf94a121f6e4c86a30a2e</Hashes>
+                <Hashes condition="contains">SHA256=4da08c0681fbe028b60a1eaf5cb8890bd3eba4d0e6a8b976495ddcd315e147ba</Hashes>
+                <Hashes condition="contains">SHA256=45c3d607cb57a1714c1c604a25cbadf2779f4734855d0e43aa394073b6966b26</Hashes>
+                <Hashes condition="contains">SHA256=b1d96233235a62dbb21b8dbe2d1ae333199669f67664b107bff1ad49b41d9414</Hashes>
+                <Hashes condition="contains">SHA256=bcfc2c9883e6c1b8429be44cc4db988a9eecb544988fbd756d18cfca6201876f</Hashes>
+                <Hashes condition="contains">SHA256=eea53103e7a5a55dc1df79797395a2a3e96123ebd71cdd2db4b1be80e7b3f02b</Hashes>
+                <Hashes condition="contains">SHA256=c725919e6357126d512c638f993cf572112f323da359645e4088f789eb4c7b8c</Hashes>
+                <Hashes condition="contains">SHA256=42f0b036687cbd7717c9efed6991c00d4e3e7b032dc965a2556c02177dfdad0f</Hashes>
+                <Hashes condition="contains">SHA256=3326e2d32bbabd69feb6024809afc56c7e39241ebe70a53728c77e80995422a5</Hashes>
+                <Hashes condition="contains">SHA256=76e807b6c0214e66455f09a8de8faad40b738982ca84470f0043de0290449524</Hashes>
+                <Hashes condition="contains">SHA256=7aaf2aa194b936e48bc90f01ee854768c8383c0be50cfb41b346666aec0cf853</Hashes>
+                <Hashes condition="contains">SHA256=cb57f3a7fe9e1f8e63332c563b0a319b26c944be839eabc03e9a3277756ba612</Hashes>
+                <Hashes condition="contains">SHA256=84bf1d0bcdf175cfe8aea2973e0373015793d43907410ae97e2071b2c4b8e2d4</Hashes>
+                <Hashes condition="contains">SHA256=16768203a471a19ebb541c942f45716e9f432985abbfbe6b4b7d61a798cea354</Hashes>
+                <Hashes condition="contains">SHA256=fd8669794c67b396c12fc5f08e9c004fdf851a82faf302846878173e4fbecb03</Hashes>
+                <Hashes condition="contains">SHA256=362c4f3dadc9c393682664a139d65d80e32caa2a97b6e0361dfd713a73267ecc</Hashes>
+                <Hashes condition="contains">SHA256=04a85e359525d662338cae86c1e59b1d7aa9bd12b920e8067503723dc1e03162</Hashes>
+                <Hashes condition="contains">SHA256=49ed27460730b62403c1d2e4930573121ab0c86c442854bc0a62415ca445a810</Hashes>
+                <Hashes condition="contains">SHA256=8c95d28270a4a314299cf50f05dcbe63033b2a555195d2ad2f678e09e00393e6</Hashes>
+                <Hashes condition="contains">SHA256=ff9623317287358440ec67da9ba79994d9b17b99ffdd709ec836478fe1fc22a5</Hashes>
+                <Hashes condition="contains">SHA256=b61869b7945be062630f1dd4bae919aecee8927f7e1bc3954a21ff763f4c0867</Hashes>
+                <Hashes condition="contains">SHA256=dbc604b4e01362a3e51357af4a87686834fe913852a4e0a8c0d4c1a0f7d076ed</Hashes>
+                <Hashes condition="contains">SHA256=a961f5939088238d76757669a9a81905e33f247c9c635b908daac146ae063499</Hashes>
+                <Hashes condition="contains">SHA256=e5b0772be02e2bc807804874cf669e97aa36f5aff1f12fa0a631a3c7b4dd0dc8</Hashes>
+                <Hashes condition="contains">SHA256=aebcbfca180e372a048b682a4859fd520c98b5b63f6e3a627c626cb35adc0399</Hashes>
+                <Hashes condition="contains">SHA256=4e3eb5b9bce2fd9f6878ae36288211f0997f6149aa8c290ed91228ba4cdfae80</Hashes>
+                <Hashes condition="contains">SHA256=1a4f7d7926efc3e3488758ce318246ea78a061bde759ec6c906ff005dd8213e5</Hashes>
+                <Hashes condition="contains">SHA256=f929bead59e9424ab90427b379dcdd63fbfe0c4fb5e1792e3a1685541cd5ec65</Hashes>
+                <Hashes condition="contains">SHA256=7b0f442ac0bb183906700097d65aed0b4b9d8678f9a01aca864854189fe368e7</Hashes>
+                <Hashes condition="contains">SHA256=c344e92a6d06155a217a9af7b4b35e6653665eec6569292e7b2e70f3a3027646</Hashes>
+                <Hashes condition="contains">SHA256=8cfd5b2102fbc77018c7fe6019ec15f07da497f6d73c32a31f4ba07e67ec85d9</Hashes>
+                <Hashes condition="contains">SHA256=99f4994a0e5bd1bf6e3f637d3225c69ff4cd620557e23637533e7f18d7d6cba1</Hashes>
+                <Hashes condition="contains">SHA256=89b9823ed974a5b71de8468324d45b7e9d6dc914f93615ba86c6209b25b3cbf7</Hashes>
+                <Hashes condition="contains">SHA256=d5586dc1e61796a9ae5e5d1ced397874753056c3df2eb963a8916287e1929a71</Hashes>
+                <Hashes condition="contains">SHA256=36b9e31240ab0341873c7092b63e2e0f2cab2962ebf9b25271c3a1216b7669eb</Hashes>
+                <Hashes condition="contains">SHA256=0b2ad05939b0aabbdc011082fad7960baa0c459ec16a2b29f37c1fa31795a46d</Hashes>
+                <Hashes condition="contains">SHA256=30706f110725199e338e9cc1c940d9a644d19a14f0eb8847712cba4cacda67ab</Hashes>
+                <Hashes condition="contains">SHA256=af1011c76a22af7be97a0b3e0ce11aca0509820c59fa7c8eeaaa1b2c0225f75a</Hashes>
+                <Hashes condition="contains">SHA256=8c748ae5dcc10614cc134064c99367d28f3131d1f1dda0c9c29e99279dc1bdd9</Hashes>
+                <Hashes condition="contains">SHA256=cbb8239a765bf5b2c1b6a5c8832d2cab8fef5deacadfb65d8ed43ef56d291ab6</Hashes>
+                <Hashes condition="contains">SHA256=025e7be9fcefd6a83f4471bba0c11f1c11bd5047047d26626da24ee9a419cdc4</Hashes>
+                <Hashes condition="contains">SHA256=d5562fb90b0b3deb633ab335bcbd82ce10953466a428b3f27cb5b226b453eaf3</Hashes>
+                <Hashes condition="contains">SHA256=900dd68ccc72d73774a347b3290c4b6153ae496a81de722ebb043e2e99496f88</Hashes>
+                <Hashes condition="contains">SHA256=a566af57d88f37fa033e64b1d8abbd3ffdacaba260475fbbc8dab846a824eff5</Hashes>
+                <Hashes condition="contains">SHA256=86721ee8161096348ed3dbe1ccbf933ae004c315b1691745a8af4a0df9fed675</Hashes>
+                <Hashes condition="contains">SHA256=d205286bffdf09bc033c09e95c519c1c267b40c2ee8bab703c6a2d86741ccd3e</Hashes>
+                <Hashes condition="contains">SHA256=a5a50449e2cc4d0dbc80496f757935ae38bf8a1bebdd6555a3495d8c219df2ad</Hashes>
+                <Hashes condition="contains">SHA256=ece0a900ea089e730741499614c0917432246ceb5e11599ee3a1bb679e24fd2c</Hashes>
+                <Hashes condition="contains">SHA256=881bca6dc2dafe1ae18aeb59216af939a3ac37248c13ed42ad0e1048a3855461</Hashes>
+                <Hashes condition="contains">SHA256=aafb95a443911e4c67d4e45ffa83cca103c91b42915b81100534dc439bec0c1b</Hashes>
+                <Hashes condition="contains">SHA256=cf69704755ec2643dfd245ae1d4e15d77f306aeb1a576ffa159453de1a7345cb</Hashes>
+                <Hashes condition="contains">SHA256=e4522e2cfa0b1f5d258a3cf85b87681d6969e0572f668024c465d635c236b5d9</Hashes>
+                <Hashes condition="contains">SHA256=600a2119657973112025db3c0eeab2e69d528bccfeed75f40c6ef50b059ec8a0</Hashes>
+                <Hashes condition="contains">SHA256=65329dad28e92f4bcc64de15c552b6ef424494028b18875b7dba840053bc0cdd</Hashes>
+                <Hashes condition="contains">SHA256=78827fa00ea48d96ac9af8d1c1e317d02ce11793e7f7f6e4c7aac7b5d7dd490f</Hashes>
+                <Hashes condition="contains">SHA256=cdd2a4575a46bada4837a6153a79c14d60ee3129830717ef09e0e3efd9d00812</Hashes>
+                <Hashes condition="contains">SHA256=42851a01469ba97cdc38939b10cf9ea13237aa1f6c37b1ac84904c5a12a81fa0</Hashes>
+                <Hashes condition="contains">SHA256=3d23bdbaf9905259d858df5bf991eb23d2dc9f4ecda7f9f77839691acef1b8c4</Hashes>
+                <Hashes condition="contains">SHA256=6e944ae1bfe43a8a7cd2ea65e518a30172ce8f31223bdfd39701b2cb41d8a9e7</Hashes>
+                <Hashes condition="contains">SHA256=1ddfe4756f5db9fb319d6c6da9c41c588a729d9e7817190b027b38e9c076d219</Hashes>
+                <Hashes condition="contains">SHA256=f84f8173242b95f9f3c4fea99b5555b33f9ce37ca8188b643871d261cb081496</Hashes>
+                <Hashes condition="contains">SHA256=32e1a8513eee746d17eb5402fb9d8ff9507fb6e1238e7ff06f7a5c50ff3df993</Hashes>
+                <Hashes condition="contains">SHA256=c9014b03866bf37faa8fdb16b6af7cfec976aaef179fd5797d0c0bf8079d3a8c</Hashes>
+                <Hashes condition="contains">SHA256=79e87b93fbed84ec09261b3a0145c935f7dfe4d4805edfb563b2f971a0d51463</Hashes>
+                <Hashes condition="contains">SHA256=ebe2e9ec6d5d94c2d58fbcc9d78c5f0ee7a2f2c1aed6d1b309f383186d11dfa3</Hashes>
+                <Hashes condition="contains">SHA256=9a523854fe84f15efc1635d7f5d3e71812c45d6a4d2c99c29fdc4b4d9c84954c</Hashes>
+                <Hashes condition="contains">SHA256=2ef7df384e93951893b65500dac6ee09da6b8fe9128326caad41b8be4da49a1e</Hashes>
+                <Hashes condition="contains">SHA256=2ce81759bfa236913bbbb9b2cbc093140b099486fd002910b18e2c6e31fdc4f1</Hashes>
+                <Hashes condition="contains">SHA256=909de5f21837ea2b13fdc4e5763589e6bdedb903f7c04e1d0b08776639774880</Hashes>
+                <Hashes condition="contains">SHA256=c8940e2e9b069ec94f9f711150b313b437f8429f78d522810601b6ee8b52bada</Hashes>
+                <Hashes condition="contains">SHA256=075de997497262a9d105afeadaaefc6348b25ce0e0126505c24aa9396c251e85</Hashes>
+                <Hashes condition="contains">SHA256=e68d453d333854787f8470c8baef3e0d082f26df5aa19c0493898bcf3401e39a</Hashes>
+                <Hashes condition="contains">SHA256=3390919bb28d5c36cc348f9ef23be5fa49bfd81263eb7740826e4437cbe904cd</Hashes>
+                <Hashes condition="contains">SHA256=f088b2ba27dacd5c28f8ee428f1350dca4bc7c6606309c287c801b2e1da1a53d</Hashes>
+                <Hashes condition="contains">SHA256=771a8d05f1af6214e0ef0886662be500ee910ab99f0154227067fddcfe08a3dd</Hashes>
+                <Hashes condition="contains">SHA256=910aa4685c735d8c07662aa04fafec463185699ad1a0cd1967b892fc33ec6c3c</Hashes>
+                <Hashes condition="contains">SHA256=ed2f33452ec32830ffef2d5dc832985db9600c306ed890c47f3f33ccbb335c39</Hashes>
+                <Hashes condition="contains">SHA256=98b734dda78c16ebcaa4afeb31007926542b63b2f163b2f733fa0d00dbb344d8</Hashes>
+                <Hashes condition="contains">SHA256=e83908eba2501a00ef9e74e7d1c8b4ff1279f1cd6051707fd51824f87e4378fa</Hashes>
+                <Hashes condition="contains">SHA256=21ccdd306b5183c00ecfd0475b3152e7d94b921e858e59b68a03e925d1715f21</Hashes>
+                <Hashes condition="contains">SHA256=26c28746e947389856543837aa59a5b1f4697e5721a04d00aa28151a2659b097</Hashes>
+                <Hashes condition="contains">SHA256=9f4ce6ab5e8d44f355426d9a6ab79833709f39b300733b5b251a0766e895e0e5</Hashes>
+                <Hashes condition="contains">SHA256=0040153302b88bee27eb4f1eca6855039e1a057370f5e8c615724fa5215bada3</Hashes>
+                <Hashes condition="contains">SHA256=0ebaef662b14410c198395b13347e1d175334ec67919709ad37d65eba013adff</Hashes>
+                <Hashes condition="contains">SHA256=a7c2e7910942dd5e43e2f4eb159bcd2b4e71366e34a68109548b9fb12ac0f7cc</Hashes>
+                <Hashes condition="contains">SHA256=59b09bd69923c0b3de3239e73205b1846a5f69043546d471b259887bb141d879</Hashes>
+                <Hashes condition="contains">SHA256=09bedbf7a41e0f8dabe4f41d331db58373ce15b2e9204540873a1884f38bdde1</Hashes>
+                <Hashes condition="contains">SHA256=1e0eb0811a7cf1bdaf29d3d2cab373ca51eb8d8b58889ab7728e2d3aed244abe</Hashes>
+                <Hashes condition="contains">SHA256=7049f3c939efe76a5556c2a2c04386db51daf61d56b679f4868bb0983c996ebb</Hashes>
+                <Hashes condition="contains">SHA256=4a3d4db86f580b1680d6454baee1c1a139e2dde7d55e972ba7c92ec3f555dce2</Hashes>
+                <Hashes condition="contains">SHA256=bb1135b51acca8348d285dc5461d10e8f57260e7d0c8cc4a092734d53fc40cbc</Hashes>
+                <Hashes condition="contains">SHA256=45ba688a4bded8a7e78a4f5b0dc21004e951ddceb014bb92f51a3301d2fbc56a</Hashes>
+                <Hashes condition="contains">SHA256=15c53eb3a0ea44bbd2901a45a6ebeae29bb123f9c1115c38dfb2cdbec0642229</Hashes>
+                <Hashes condition="contains">SHA256=83f7be0a13c1fccf024c31da5c68c0ea1decf4f48fc39d6e4fd324bbe789ae8a</Hashes>
+                <Hashes condition="contains">SHA256=ecfc52a22e4a41bf53865b0e28309411c60af34a44e31a5c53cdc8c5733e8282</Hashes>
+                <Hashes condition="contains">SHA256=ffc72f0bde21ba20aa97bee99d9e96870e5aa40cce9884e44c612757f939494f</Hashes>
+                <Hashes condition="contains">SHA256=673bcec3d53fab5efd6e3bac25ac9d6cc51f6bbdf8336e38aade2713dc1ae11b</Hashes>
+                <Hashes condition="contains">SHA256=7da6113183328d4fddf6937c0c85ef65ba69bfe133b1146193a25bcf6ae1f9dd</Hashes>
+                <Hashes condition="contains">SHA256=cc383ad11e9d06047a1558ed343f389492da3ac2b84b71462aee502a2fa616c8</Hashes>
+                <Hashes condition="contains">SHA256=76fb4deaee57ef30e56c382c92abffe2cf616d08dbecb3368c8ee6b02e59f303</Hashes>
+                <Hashes condition="contains">SHA256=caa85c44eb511377ea7426ff10df00a701c07ffb384eef8287636a4bca0b53ab</Hashes>
+                <Hashes condition="contains">SHA256=19696fb0db3fcae22f705ae1eb1e9f1151c823f3ff5d8857e90f2a4a6fdc5758</Hashes>
+                <Hashes condition="contains">SHA256=77950e2a40ac0447ae7ee1ee3ef1242ce22796a157074e6f04e345b1956e143c</Hashes>
+                <Hashes condition="contains">SHA256=cf3a7d4285d65bf8688215407bce1b51d7c6b22497f09021f0fce31cbeb78986</Hashes>
+                <Hashes condition="contains">SHA256=4cff6e53430b81ecc4fae453e59a0353bcfe73dd5780abfc35f299c16a97998e</Hashes>
+                <Hashes condition="contains">SHA256=65db1b259e305a52042e07e111f4fa4af16542c8bacd33655f753ef642228890</Hashes>
+                <Hashes condition="contains">SHA256=19d0fc91b70d7a719f7a28b4ad929f114bf1de94a4c7cba5ad821285a4485da0</Hashes>
+                <Hashes condition="contains">SHA256=9b2f051ac901ab47d0012a1002cb8b2db28c14e9480c0dd55e1ac11c81ba9285</Hashes>
+                <Hashes condition="contains">SHA256=159e7c5a12157af92e0d14a0d3ea116f91c09e21a9831486e6dc592c93c10980</Hashes>
+                <Hashes condition="contains">SHA256=bdcacee3695583a0ca38b9a786b9f7334bf2a9a3387e4069c8e6ca378b2791d0</Hashes>
+                <Hashes condition="contains">SHA256=7f5dc63e5742096e4accaca39ae77a2a2142b438c10f97860dee4054b51d3b35</Hashes>
+                <Hashes condition="contains">SHA256=2b120de80a5462f8395cfb7153c86dfd44f29f0776ea156ec4a34fa64e5c4797</Hashes>
+                <Hashes condition="contains">SHA256=d7e091e0d478c34232e8479b950c5513077b3a69309885cee4c61063e5f74ac0</Hashes>
+                <Hashes condition="contains">SHA256=5351c81b4ec5a0d79c39d24bac7600d10eac30c13546fde43d23636b3f421e7c</Hashes>
+                <Hashes condition="contains">SHA256=f85cca4badff17d1aa90752153ccec77a68ad282b69e3985fdc4743eaea85004</Hashes>
+                <Hashes condition="contains">SHA256=56a3c9ac137d862a85b4004f043d46542a1b61c6acb438098a9640469e2d80e7</Hashes>
+                <Hashes condition="contains">SHA256=3cb75429944e60f6c820c7638adbf688883ad44951bca3f8912428afe72bc134</Hashes>
+                <Hashes condition="contains">SHA256=d0bd1ae72aeb5f3eabf1531a635f990e5eaae7fdd560342f915f723766c80889</Hashes>
+                <Hashes condition="contains">SHA256=f8886a9c759e0426e08d55e410b02c5b05af3c287b15970175e4874316ffaf13</Hashes>
+                <Hashes condition="contains">SHA256=cf4b5fa853ce809f1924df3a3ae3c4e191878c4ea5248d8785dc7e51807a512b</Hashes>
+                <Hashes condition="contains">SHA256=d6827cd3a8f273a66ecc33bb915df6c7dea5cc1b8134b0c348303ef50db33476</Hashes>
+                <Hashes condition="contains">SHA256=f0605dda1def240dc7e14efa73927d6c6d89988c01ea8647b671667b2b167008</Hashes>
+                <Hashes condition="contains">SHA256=4d19ee789e101e5a76834fb411aadf8229f08b3ece671343ad57a6576a525036</Hashes>
+                <Hashes condition="contains">SHA256=916c535957a3b8cbf3336b63b2260ea4055163a9e6b214f2a7005d6d36a4a677</Hashes>
+                <Hashes condition="contains">SHA256=8e6363a6393eb4234667c6f614b2072e33512866b3204f8395bbe01530d63f2f</Hashes>
+                <Hashes condition="contains">SHA256=506f953bbb285aeb8af0549eb24f52f3b7af36afe740afa36735bac70573ce28</Hashes>
+                <Hashes condition="contains">SHA256=a8027daa6facf1ff81405daf6763249e9acf232a1a191b6bf106711630e6188e</Hashes>
+                <Hashes condition="contains">SHA256=74a846c61adc53692d3040aff4c1916f32987ad72b07fe226e9e7dbeff1036c4</Hashes>
+                <Hashes condition="contains">SHA256=17927b93b2d6ab4271c158f039cae2d60591d6a14458f5a5690aec86f5d54229</Hashes>
+                <Hashes condition="contains">SHA256=8e88cb80328c3dbaa2752591692e74a2fae7e146d7d8aabc9b9ac9a6fe561e6c</Hashes>
+                <Hashes condition="contains">SHA256=e07211224b02aaf68a5e4b73fc1049376623793509d9581cdaee9e601020af06</Hashes>
+                <Hashes condition="contains">SHA256=2d2c7ee9547738a8a676ab785c151e8b48ed40fe7cf6174650814c7f5f58513b</Hashes>
+                <Hashes condition="contains">SHA256=a334bdf0c0ab07803380eb6ef83eefe7c147d6962595dd9c943a6a76f2200b0d</Hashes>
+                <Hashes condition="contains">SHA256=7f190f6e5ab0edafd63391506c2360230af4c2d56c45fc8996a168a1fc12d457</Hashes>
+                <Hashes condition="contains">SHA256=b37b3c6877b70289c0f43aeb71349f7344b06063996e6347c3c18d8c5de77f3b</Hashes>
+                <Hashes condition="contains">SHA256=6191c20426dd9b131122fb97e45be64a4d6ce98cc583406f38473434636ddedc</Hashes>
+                <Hashes condition="contains">SHA256=c470c9db58840149ce002f3e6003382ecf740884a683bae8f9d10831be218fa2</Hashes>
+                <Hashes condition="contains">SHA256=61d6e40601fa368800980801a662a5b3b36e3c23296e8ae1c85726a56ef18cc8</Hashes>
+                <Hashes condition="contains">SHA256=46621554728bc55438c7c241137af401250f062edef6e7efecf1a6f0f6d0c1f7</Hashes>
+                <Hashes condition="contains">SHA256=b4d47ea790920a4531e3df5a4b4b0721b7fea6b49a35679f0652f1e590422602</Hashes>
+                <Hashes condition="contains">SHA256=0466dac557ee161503f5dfbd3549f81ec760c3d6c7c4363a21a03e7a3f66aca8</Hashes>
+                <Hashes condition="contains">SHA256=3c6f9917418e991ed41540d8d882c8ca51d582a82fd01bff6cdf26591454faf5</Hashes>
+                <Hashes condition="contains">SHA256=b50ffc60eaa4fb7429fdbb67c0aba0c7085f5129564d0a113fec231c5f8ff62e</Hashes>
+                <Hashes condition="contains">SHA256=7cb594af6a3655daebc9fad9c8abf2417b00ba31dcd118707824e5316fc0cc21</Hashes>
+                <Hashes condition="contains">SHA256=4422851a0a102f654e95d3b79c357ae3af1b096d7d1576663c027cfbc04abaf9</Hashes>
+                <Hashes condition="contains">SHA256=3ff39728f1c11d1108f65ec5eb3d722fd1a1279c530d79712e0d32b34880baaa</Hashes>
+                <Hashes condition="contains">SHA256=5c0b429e5935814457934fa9c10ac7a88e19068fa1bd152879e4e9b89c103921</Hashes>
+                <Hashes condition="contains">SHA256=0aafa9f47acf69d46c9542985994ff5321f00842a28df2396d4a3076776a83cb</Hashes>
+                <Hashes condition="contains">SHA256=0ae8d1dd56a8a000ced74a627052933d2e9bff31d251de185b3c0c5fc94a44db</Hashes>
+                <Hashes condition="contains">SHA256=94be67c319a67de75ebed050d5537cfaa795d72bba52f3d8cf349e7bd075410e</Hashes>
+                <Hashes condition="contains">SHA256=b1867d13a4cab66a76f4d4448824ca0cb3a176064626f9618c0c103ee3cb4f47</Hashes>
+                <Hashes condition="contains">SHA256=f74ffd6916333662900cbecb90aca2d6475a714ce410adf9c5c3264abbe5732c</Hashes>
+                <Hashes condition="contains">SHA256=d7ddf874304556f8a10942a29b3d387cb5155a7419f87813557fe728cb14806d</Hashes>
+                <Hashes condition="contains">SHA256=4a9093e8dbcb867e1b97a0a67ce99a8511900658f5201c34ffb8035881f2dbbe</Hashes>
+                <Hashes condition="contains">SHA256=ff115cefe624b6ca0b3878a86f6f8b352d1915b65fbbdc33ae15530a96ebdaa7</Hashes>
+                <Hashes condition="contains">SHA256=9f1229cd8dd9092c27a01f5d56e3c0d59c2bb9f0139abf042e56f343637fda33</Hashes>
+                <Hashes condition="contains">SHA256=3124b0411b8077605db2a9b7909d8240e0d554496600e2706e531c93c931e1b5</Hashes>
+                <Hashes condition="contains">SHA256=50d5eaa168c077ce5b7f15b3f2c43bd2b86b07b1e926c1b332f8cb13bd2e0793</Hashes>
+                <Hashes condition="contains">SHA256=952199c28332bc90cfd74530a77ee237967ed32b3c71322559c59f7a42187dc4</Hashes>
+                <Hashes condition="contains">SHA256=55a1535e173c998fbbc978009b02d36ca0c737340d84ac2a8da73dfc2f450ef9</Hashes>
+                <Hashes condition="contains">SHA256=57a389da784269bb2cc0a258500f6dfbf4f6269276e1192619ce439ec77f4572</Hashes>
+                <Hashes condition="contains">SHA256=84df20b1d9d87e305c92e5ffae21b10b325609d59d835a954dbd8750ef5dabf4</Hashes>
+                <Hashes condition="contains">SHA256=8ef0ad86500094e8fa3d9e7d53163aa6feef67c09575c169873c494ed66f057f</Hashes>
+                <Hashes condition="contains">SHA256=26f41e4268be59f5de07552b51fa52d18d88be94f8895eb4a16de0f3940cf712</Hashes>
+                <Hashes condition="contains">SHA256=26e3bfef255efd052a84c3c43994c73222b14c95db9a4b1fc2e98f1a5cb26e43</Hashes>
+                <Hashes condition="contains">SHA256=478917514be37b32d5ccf76e4009f6f952f39f5553953544f1b0688befd95e82</Hashes>
+                <Hashes condition="contains">SHA256=0f035948848432bc243704041739e49b528f35c82a5be922d9e3b8a4c44398ff</Hashes>
+                <Hashes condition="contains">SHA256=72b99147839bcfb062d29014ec09fe20a8f261748b5925b00171ef3cb849a4c1</Hashes>
+                <Hashes condition="contains">SHA256=8cf0cbbdc43f9b977f0fb79e0a0dd0e1adabe08a67d0f40d727c717c747de775</Hashes>
+                <Hashes condition="contains">SHA256=4429f32db1cc70567919d7d47b844a91cf1329a6cd116f582305f3b7b60cd60b</Hashes>
+                <Hashes condition="contains">SHA256=0cd4ca335155062182608cad9ef5c8351a715bce92049719dd09c76422cd7b0c</Hashes>
+                <Hashes condition="contains">SHA256=05f052c64d192cf69a462a5ec16dda0d43ca5d0245900c9fcb9201685a2e7748</Hashes>
+                <Hashes condition="contains">SHA256=b9b3878ddc5dfb237d38f8d25067267870afd67d12a330397a8853209c4d889c</Hashes>
+                <Hashes condition="contains">SHA256=93d873cdf23d5edc622b74f9544cac7fe247d7a68e1e2a7bf2879fad97a3ae63</Hashes>
+                <Hashes condition="contains">SHA256=aaa3459bcac25423f78ed72dbae4d7ef19e7c5c65770cbe5210b14e33cd1816c</Hashes>
+                <Hashes condition="contains">SHA256=5f20541f859f21b3106e12d37182b1ea39bb75ffcfcddb2ece4f6edd42c0bab2</Hashes>
+                <Hashes condition="contains">SHA256=dbe9f17313e1164f06401234b875fbc7f71d41dc7271de643865af1358841fef</Hashes>
+                <Hashes condition="contains">SHA256=e0b5a5f8333fc1213791af5c5814d7a99615b3951361ca75f8aa5022c9cfbc2b</Hashes>
+                <Hashes condition="contains">SHA256=19a212e6fc324f4cb9ee5eba60f5c1fc0191799a4432265cbeaa3307c76a7fc0</Hashes>
+                <Hashes condition="contains">SHA256=36aafa127736c7226c50061ea065f71e14f64ec60321f705bc52686d24117e0d</Hashes>
+                <Hashes condition="contains">SHA256=cfc5c585dd4e592dd1a08887ded28b92d9a5820587b6f4f8fa4f56d60289259b</Hashes>
+                <Hashes condition="contains">SHA256=f37d609ea1f06660d970415dd3916c4c153bb5940bf7d2beb47fa34e8a8ffbfc</Hashes>
+                <Hashes condition="contains">SHA256=89108a15f009b285db4ef94250b889d5b11b96b4aa7b190784a6d1396e893e10</Hashes>
+                <Hashes condition="contains">SHA256=1f4d4db4abe26e765a33afb2501ac134d14cadeaa74ae8a0fae420e4ecf58e0c</Hashes>
+                <Hashes condition="contains">SHA256=39cfde7d401efce4f550e0a9461f5fc4d71fa07235e1336e4f0b4882bd76550e</Hashes>
+                <Hashes condition="contains">SHA256=8fe9828bea83adc8b1429394db7a556a17f79846ad0bfb7f242084a5c96edf2a</Hashes>
+                <Hashes condition="contains">SHA256=2afdb3278a7b57466a103024aef9ff7f41c73a19bab843a8ebf3d3c4d4e82b30</Hashes>
+                <Hashes condition="contains">SHA256=8bda0108de82ebeae82f43108046c5feb6f042e312fa0115475a9e32274fae59</Hashes>
+                <Hashes condition="contains">SHA256=082c39fe2e3217004206535e271ebd45c11eb072efde4cc9885b25ba5c39f91d</Hashes>
+                <Hashes condition="contains">SHA256=f40435488389b4fb3b945ca21a8325a51e1b5f80f045ab019748d0ec66056a8b</Hashes>
+                <Hashes condition="contains">SHA256=9c10e2ec4f9ef591415f9a784b93dc9c9cdafa7c69602c0dc860c5b62222e449</Hashes>
+                <Hashes condition="contains">SHA256=2594b3ef3675ca3a7b465b8ed4962e3251364bab13b12af00ebba7fa2211abb2</Hashes>
+                <Hashes condition="contains">SHA256=47f08f7d30d824a8f4bb8a98916401a37c0fd8502db308aba91fe3112b892dcc</Hashes>
+                <Hashes condition="contains">SHA256=bac709c49ddee363c8e59e515f2f632324a0359e932b7d8cb1ce2d52a95981aa</Hashes>
+                <Hashes condition="contains">SHA256=31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427</Hashes>
+                <Hashes condition="contains">SHA256=7d8937c18d6e11a0952e53970a0934cf0e65515637ac24d6ca52ccf4b93d385f</Hashes>
+                <Hashes condition="contains">SHA256=3724b39e97936bb20ada51c6119aded04530ed86f6b8d6b45fbfb2f3b9a4114b</Hashes>
+                <Hashes condition="contains">SHA256=df0dcfb3971829af79629efd036b8e1c6e2127481b3644ccc6e2ddd387489a15</Hashes>
+                <Hashes condition="contains">SHA256=91314768da140999e682d2a290d48b78bb25a35525ea12c1b1f9634d14602b2c</Hashes>
+                <Hashes condition="contains">SHA256=a9706e320179993dade519a83061477ace195daa1b788662825484813001f526</Hashes>
+                <Hashes condition="contains">SHA256=314384b40626800b1cde6fbc51ebc7d13e91398be2688c2a58354aa08d00b073</Hashes>
+                <Hashes condition="contains">SHA256=a072197177aad26c31960694e38e2cae85afbab070929e67e331b99d3a418cf4</Hashes>
+                <Hashes condition="contains">SHA256=8e5aef7c66c0e92dfc037ee29ade1c8484b8d7fadebdcf521d2763b1d8215126</Hashes>
+                <Hashes condition="contains">SHA256=b7a20b5f15e1871b392782c46ebcc897929443d82073ee4dcb3874b6a5976b5d</Hashes>
+                <Hashes condition="contains">SHA256=5ee292b605cd3751a24e5949aae615d472a3c72688632c3040dc311055b75a92</Hashes>
+                <Hashes condition="contains">SHA256=5f6547e9823f94c5b94af1fb69a967c4902f72b6e0c783804835e6ce27f887b0</Hashes>
+                <Hashes condition="contains">SHA256=2732050a7d836ae0bdc5c0aea4cdf8ce205618c3e7f613b8139c176e86476d0c</Hashes>
+                <Hashes condition="contains">SHA256=ff6729518a380bf57f1bc6f1ec0aa7f3012e1618b8d9b0f31a61d299ee2b4339</Hashes>
+                <Hashes condition="contains">SHA256=43ba8d96d5e8e54cab59d82d495eeca730eeb16e4743ed134cdd495c51a4fc89</Hashes>
+                <Hashes condition="contains">SHA256=64f9e664bc6d4b8f5f68616dd50ae819c3e60452efd5e589d6604b9356841b57</Hashes>
+                <Hashes condition="contains">SHA256=31d8fc6f5fb837d5eb29db828d13ba8ee11867d86a90b2c2483a578e1d0ec43a</Hashes>
+                <Hashes condition="contains">SHA256=23ba19352b1e71a965260bf4d5120f0200709ee8657ed381043bec9a938a1ade</Hashes>
+                <Hashes condition="contains">SHA256=11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5</Hashes>
+                <Hashes condition="contains">SHA256=de8f8006d8ee429b5f333503defa54b25447f4ed6aeade5e4219e23f3473ef1c</Hashes>
+                <Hashes condition="contains">SHA256=9fc29480407e5179aa8ea41682409b4ea33f1a42026277613d6484e5419de374</Hashes>
+                <Hashes condition="contains">SHA256=e05eeb2b8c18ad2cb2d1038c043d770a0d51b96b748bc34be3e7fc6f3790ce53</Hashes>
+                <Hashes condition="contains">SHA256=9b6a84f7c40ea51c38cc4d2e93efb3375e9d98d4894a85941190d94fbe73a4e4</Hashes>
+                <Hashes condition="contains">SHA256=2bf29a2df52110ed463d51376562afceac0e80fbb1033284cf50edd86c406b14</Hashes>
+                <Hashes condition="contains">SHA256=95d50c69cdbf10c9c9d61e64fe864ac91e6f6caa637d128eb20e1d3510e776d3</Hashes>
+                <Hashes condition="contains">SHA256=927c2a580d51a598177fa54c65e9d2610f5f212f1b6cb2fbf2740b64368f010a</Hashes>
+                <Hashes condition="contains">SHA256=7539157df91923d4575f7f57c8eb8b0fd87f064c919c1db85e73eebb2910b60c</Hashes>
+                <Hashes condition="contains">SHA256=0af5ccb3d33a9ba92071c9637be6254030d61998733a5eb3583e865e17844e05</Hashes>
+                <Hashes condition="contains">SHA256=fd388cf1df06d419b14dedbeb24c6f4dff37bea26018775f09d56b3067f0de2c</Hashes>
+                <Hashes condition="contains">SHA256=0ce40a2cdd3f45c7632b858e8089ddfdd12d9acb286f2015a4b1b0c0346a572c</Hashes>
+                <Hashes condition="contains">SHA256=3e1d47a497babbfd1c83905777b517ec87c65742bee7eb57a2273eca825d2272</Hashes>
+                <Hashes condition="contains">SHA256=f9895458e73d4b0ef01eda347fb695bb00e6598d9f5e2506161b70ad96bb7298</Hashes>
+                <Hashes condition="contains">SHA256=bb68552936a6b0a68fb53ce864a6387d2698332aac10a7adfdd5a48b97027ce3</Hashes>
+                <Hashes condition="contains">SHA256=d783ace822f8fe4e25d5387e5dd249cb72e62f62079023216dc436f1853a150f</Hashes>
+                <Hashes condition="contains">SHA256=df0cc4e5c9802f8edaefeb130e375cad56b2c5490d8ebd77d8dbdcc6fdc7ecb6</Hashes>
+                <Hashes condition="contains">SHA256=607dc4c75ac7aef82ae0616a453866b3b358c6cf5c8f9d29e4d37f844306b97c</Hashes>
+                <Hashes condition="contains">SHA256=f877296e8506e6a1acbdacdc5085b18c6842320a2775a329d286bac796f08d54</Hashes>
+                <Hashes condition="contains">SHA256=18712a063574bfec315d58577dfe413ab45b650e54747d1e18a56c3c7337a12c</Hashes>
+                <Hashes condition="contains">SHA256=8b92cdb91a2e2fab3881d54f5862e723826b759749f837a11c9e9d85d52095a2</Hashes>
+                <Hashes condition="contains">SHA256=72322fa8bba20df6966acbcf41e83747893fd173cd29de99b5ad1a5d3bf8f2de</Hashes>
+                <Hashes condition="contains">SHA256=146d77e80ca70ea5cb17bfc9a5cea92334f809cbdc87a51c2d10b8579a4b9c88</Hashes>
+                <Hashes condition="contains">SHA256=45abdbcd4c0916b7d9faaf1cd08543a3a5178871074628e0126a6eda890d26e0</Hashes>
+                <Hashes condition="contains">SHA256=9f1025601d17945c3a47026814bdec353ee363966e62dba7fe2673da5ce50def</Hashes>
+                <Hashes condition="contains">SHA256=3f9530c94b689f39cc83377d76979d443275012e022782a600dcb5cad4cca6aa</Hashes>
+                <Hashes condition="contains">SHA256=9254f012009d55f555418ff85f7d93b184ab7cb0e37aecdfdab62cfe94dea96b</Hashes>
+                <Hashes condition="contains">SHA256=3384f4a892f7aa72c43280ff682d85c8e3936f37a68d978d307a9461149192de</Hashes>
+                <Hashes condition="contains">SHA256=b8b94c2646b62f6ac08f16514b6efaa9866aa3c581e4c0435a7aeafe569b2418</Hashes>
+                <Hashes condition="contains">SHA256=b03f26009de2e8eabfcf6152f49b02a55c5e5d0f73e01d48f5a745f93ce93a29</Hashes>
+                <Hashes condition="contains">SHA256=696679114f6a106ec94c21e2a33fe17af86368bcf9a796aaea37ea6e8748ad6a</Hashes>
+                <Hashes condition="contains">SHA256=b019ebd77ac19cdd72bba3318032752649bd56a7576723a8ae1cccd70ee1e61a</Hashes>
+                <Hashes condition="contains">SHA256=67734c7c0130dd66c964f76965f09a2290da4b14c94412c0056046e700654bdc</Hashes>
+                <Hashes condition="contains">SHA256=ecd07df7ad6fee9269a9e9429eb199bf3e24cf672aa1d013b7e8d90d75324566</Hashes>
+                <Hashes condition="contains">SHA256=38c18db050b0b2b07f657c03db1c9595febae0319c746c3eede677e21cd238b0</Hashes>
+                <Hashes condition="contains">SHA256=810513b3f4c8d29afb46f71816350088caacf46f1be361af55b26f3fee4662c3</Hashes>
+                <Hashes condition="contains">SHA256=1b7fb154a7b7903a3c81f12f4b094f24a3c60a6a8cffca894c67c264ab7545fa</Hashes>
+                <Hashes condition="contains">SHA256=ea0b9eecf4ad5ec8c14aec13de7d661e7615018b1a3c65464bf5eca9bbf6ded3</Hashes>
+                <Hashes condition="contains">SHA256=09b0e07af8b17db1d896b78da4dd3f55db76738ee1f4ced083a97d737334a184</Hashes>
+                <Hashes condition="contains">SHA256=5b9623da9ba8e5c80c49473f40ffe7ad315dcadffc3230afdc9d9226d60a715a</Hashes>
+                <Hashes condition="contains">SHA256=258359a7fa3d975620c9810dab3a6493972876a024135feaf3ac8482179b2e79</Hashes>
+                <Hashes condition="contains">SHA256=a2353030d4ea3ad9e874a0f7ff35bbfa10562c98c949d88cabab27102bbb8e48</Hashes>
+                <Hashes condition="contains">SHA256=a56c2a2425eb3a4260cc7fc5c8d7bed7a3b4cd2af256185f24471c668853aee8</Hashes>
+                <Hashes condition="contains">SHA256=1f8168036d636aad1680dd0f577ef9532dbb2dad3591d63e752b0ba3ee6fd501</Hashes>
+                <Hashes condition="contains">SHA256=ee45fd2d7315fd039f3585a66e7855ba4af9d4721e1448e602623de14e932bbe</Hashes>
+                <Hashes condition="contains">SHA256=d636c011b8b2896572f5de260eb997182cc6955449b044a739bd19cbe6fdabd2</Hashes>
+                <Hashes condition="contains">SHA256=6a4875ae86131a594019dec4abd46ac6ba47e57a88287b814d07d929858fe3e5</Hashes>
+                <Hashes condition="contains">SHA256=238046cfe126a1f8ab96d8b62f6aa5ec97bab830e2bae5b1b6ab2d31894c79e4</Hashes>
+                <Hashes condition="contains">SHA256=3e9b62d2ea2be50a2da670746c4dbe807db9601980af3a1014bcd72d0248d84c</Hashes>
+                <Hashes condition="contains">SHA256=c082514317bf80a2f5129d84a5a55e411a95e32d03a4df1274537704c80e41dd</Hashes>
+                <Hashes condition="contains">SHA256=cd4a249c3ef65af285d0f8f30a8a96e83688486aab515836318a2559757a89bb</Hashes>
+                <Hashes condition="contains">SHA256=32cccc4f249499061c0afa18f534c825d01034a1f6815f5506bf4c4ff55d1351</Hashes>
+                <Hashes condition="contains">SHA256=818e396595d08d724666803cd29dac566dc7db23bf50e9919d04b33afa988c01</Hashes>
+                <Hashes condition="contains">SHA256=2b186926ed815d87eaf72759a69095a11274f5d13c33b8cc2b8700a1f020be1d</Hashes>
+                <Hashes condition="contains">SHA256=e6056443537d4d2314dabca1b9168f1eaaf17a14eb41f6f5741b6b82b3119790</Hashes>
+                <Hashes condition="contains">SHA256=a13054f349b7baa8c8a3fcbd31789807a493cc52224bbff5e412eb2bd52a6433</Hashes>
+                <Hashes condition="contains">SHA256=e4c154a0073bbad3c9f8ab7218e9b3be252ae705c20c568861dae4088f17ffcc</Hashes>
+                <Hashes condition="contains">SHA256=5192ec4501d0fe0b1c8f7bf9b778f7524a7a70a26bbbb66e5dab8480f6fdbb8b</Hashes>
+                <Hashes condition="contains">SHA256=65025741ecd0ef516da01319b42c2d96e13cb8d78de53fb7e39cd53ea6d58c75</Hashes>
+                <Hashes condition="contains">SHA256=37c637a74bf20d7630281581a8fae124200920df11ad7cd68c14c26cc12c5ec9</Hashes>
+                <Hashes condition="contains">SHA256=ec5fac0b6bb267a2bd10fc80c8cca6718439d56e82e053d3ff799ce5f3475db5</Hashes>
+                <Hashes condition="contains">SHA256=c299063e3eae8ddc15839767e83b9808fd43418dc5a1af7e4f44b97ba53fbd3d</Hashes>
+                <Hashes condition="contains">SHA256=923ebbe8111e73d5b8ecc2db10f8ea2629a3264c3a535d01c3c118a3b4c91782</Hashes>
+                <Hashes condition="contains">SHA256=c1c4310e5d467d24e864177bdbfc57cb5d29aac697481bfa9c11ddbeebfd4cc8</Hashes>
+                <Hashes condition="contains">SHA256=12eda8b65ed8c1d80464a0c535ea099dffdb4981c134294cb0fa424efc85ee56</Hashes>
+                <Hashes condition="contains">SHA256=552f70374715e70c4ade591d65177be2539ec60f751223680dfaccb9e0be0ed9</Hashes>
+                <Hashes condition="contains">SHA256=49f75746eebe14e5db11706b3e58accc62d4034d2f1c05c681ecef5d1ad933ba</Hashes>
+                <Hashes condition="contains">SHA256=bc13adeb6bf62b1e10ef41205ef92382e6c18d6a20669d288a0b11058e533d63</Hashes>
+                <Hashes condition="contains">SHA256=525d9b51a80ca0cd4c5889a96f857e73f3a80da1ffbae59851e0f51bdfb0b6cd</Hashes>
+                <Hashes condition="contains">SHA256=86a1b1bacc0c51332c9979e6aad84b5fba335df6b9a096ccb7681ab0779a8882</Hashes>
+                <Hashes condition="contains">SHA256=36505921af5a09175395ebaea29c72b2a69a3a9204384a767a5be8a721f31b10</Hashes>
+                <Hashes condition="contains">SHA256=c9b49b52b493b53cd49c12c3fa9553e57c5394555b64e32d1208f5b96a5b8c6e</Hashes>
+                <Hashes condition="contains">SHA256=dd573f23d656818036fc9ae1064eda31aca86acb9bc44a6e127db3ea112a9094</Hashes>
+                <Hashes condition="contains">SHA256=b179e1ab6dc0b1aee783adbcad4ad6bb75a8a64cb798f30c0dd2ee8aaf43e6de</Hashes>
+                <Hashes condition="contains">SHA256=76b86543ce05540048f954fed37bdda66360c4a3ddb8328213d5aef7a960c184</Hashes>
+                <Hashes condition="contains">SHA256=58a74dceb2022cd8a358b92acd1b48a5e01c524c3b0195d7033e4bd55eff4495</Hashes>
+                <Hashes condition="contains">SHA256=133e542842656197c5d22429bd56d57aa33c9522897fdf29853a6d321033c743</Hashes>
+                <Hashes condition="contains">SHA256=e7cbfb16261de1c7f009431d374d90e9eb049ba78246e38bc4c8b9e06f324b6f</Hashes>
+                <Hashes condition="contains">SHA256=8cb62c5d41148de416014f80bd1fd033fd4d2bd504cb05b90eeb6992a382d58f</Hashes>
+                <Hashes condition="contains">SHA256=06508aacb4ed0a1398a2b0da5fa2dbf7da435b56da76fd83c759a50a51c75caf</Hashes>
+                <Hashes condition="contains">SHA256=5bd41a29cbba0d24e639f49d1f201b9bd119b11f5e3b8a5fefa3a5c6f1e7692c</Hashes>
+                <Hashes condition="contains">SHA256=cb9890d4e303a4c03095d7bc176c42dee1b47d8aa58e2f442ec1514c8f9e3cec</Hashes>
+                <Hashes condition="contains">SHA256=a899b659b08fbae30b182443be8ffb6a6471c1d0497b52293061754886a937a3</Hashes>
+                <Hashes condition="contains">SHA256=910479467ef17b9591d8d42305e7f6f247ad41c60ec890a1ffbe331f495ed135</Hashes>
+                <Hashes condition="contains">SHA256=cf3180f5308af002ac5d6fd5b75d1340878c375f0aebc3157e3bcad6322b7190</Hashes>
+                <Hashes condition="contains">SHA256=3ac5e01689a3d745e60925bc7faca8d4306ae693e803b5e19c94906dc30add46</Hashes>
+                <Hashes condition="contains">SHA256=afdd66562dea51001c3a9de300f91fc3eb965d6848dfce92ccb9b75853e02508</Hashes>
+                <Hashes condition="contains">SHA256=7f375639a0df7fe51e5518cf87c3f513c55bc117db47d28da8c615642eb18bfa</Hashes>
+                <Hashes condition="contains">SHA256=9d5ebd0f4585ec20a5fe3c5276df13ece5a2645d3d6f70cedcda979bd1248fc2</Hashes>
+                <Hashes condition="contains">SHA256=ae42afa9be9aa6f6a5ae09fa9c05cd2dfb7861dc72d4fd8e0130e5843756c471</Hashes>
+                <Hashes condition="contains">SHA256=3ff50c67d51553c08dcb7c98342f68a0f54ad6658c5346c428bdcd1f185569f6</Hashes>
+                <Hashes condition="contains">SHA256=8d57e416ea4bb855b78a2ff3c80de1dfbb5dc5ee9bfbdddb23e46bd8619287e2</Hashes>
+                <Hashes condition="contains">SHA256=f8430bdc6fd01f42217d66d87a3ef6f66cb2700ebb39c4f25c8b851858cc4b35</Hashes>
+                <Hashes condition="contains">SHA256=bc7ebd191e0991fd0865a5c956a92e63792a0bb2ff888af43f7a63bb65a22248</Hashes>
+                <Hashes condition="contains">SHA256=be03e9541f56ac6ed1e81407dcd7cc85c0ffc538c3c2c2c8a9c747edbcf13100</Hashes>
+                <Hashes condition="contains">SHA256=6cb6e23ba516570bbd158c32f7c7c99f19b24ca4437340ecb39253662afe4293</Hashes>
+                <Hashes condition="contains">SHA256=60b163776e7b95e0c2280d04476304d0c943b484909131f340e3ce6045a49289</Hashes>
+                <Hashes condition="contains">SHA256=455bc98ba32adab8b47d2d89bdbadca4910f91c182ab2fc3211ba07d3784537b</Hashes>
+                <Hashes condition="contains">SHA256=543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91</Hashes>
+                <Hashes condition="contains">SHA256=3c18ae965fba56d09a65770b4d8da54ccd7801f979d3ebd283397bc99646004b</Hashes>
+                <Hashes condition="contains">SHA256=94911fe6f2aba9683b10353094caf71ee4a882de63b4620797629d79f18feec5</Hashes>
+                <Hashes condition="contains">SHA256=71fe5af0f1564dc187eea8d59c0fbc897712afa07d18316d2080330ba17cf009</Hashes>
+                <Hashes condition="contains">SHA256=f05b1ee9e2f6ab704b8919d5071becbce6f9d0f9d0ba32a460c41d5272134abe</Hashes>
+                <Hashes condition="contains">SHA256=e3eff841ea0f2786e5e0fed2744c0829719ad711fc9258eeaf81ed65a52a8918</Hashes>
+                <Hashes condition="contains">SHA256=e16dc51c51b2df88c474feb52ce884d152b3511094306a289623de69dedfdf48</Hashes>
+                <Hashes condition="contains">SHA256=a59c40e7470b7003e8adfee37c77606663e78d7e3f2ebb8d60910af19924d8df</Hashes>
+                <Hashes condition="contains">SHA256=2a6db9facf9e13d35c37dd468be04bae5f70c6127a9aee76daebddbdec95d486</Hashes>
+                <Hashes condition="contains">SHA256=adc10de960f40fa9f6e28449748250fa9ddfd331115b77a79809a50c606753ee</Hashes>
+                <Hashes condition="contains">SHA256=c60fcff9c8e5243bbb22ec94618b9dcb02c59bb49b90c04d7d6ab3ebbd58dc3a</Hashes>
+                <Hashes condition="contains">SHA256=9a54ef5cfbe6db599322967ee2c84db7daabcb468be10a3ccfcaa0f64d9173c7</Hashes>
+                <Hashes condition="contains">SHA256=a4680fabf606d6580893434e81c130ff7ec9467a15e6534692443465f264d3c9</Hashes>
+                <Hashes condition="contains">SHA256=2e6b339597a89e875f175023ed952aaac64e9d20d457bbc07acf1586e7fe2df8</Hashes>
+                <Hashes condition="contains">SHA256=ef6d3c00f9d0aa31a218094480299ef73fc85146adf62fd0c2f4f88972c5c850</Hashes>
+                <Hashes condition="contains">SHA256=fcdfe570e6dc6e768ef75138033d9961f78045adca53beb6fdb520f6417e0df1</Hashes>
+                <Hashes condition="contains">SHA256=dd4a1253d47de14ef83f1bc8b40816a86ccf90d1e624c5adf9203ae9d51d4097</Hashes>
+                <Hashes condition="contains">SHA256=d8b58f6a89a7618558e37afc360cd772b6731e3ba367f8d58734ecee2244a530</Hashes>
+                <Hashes condition="contains">SHA256=a903f329b70f0078197cb7683aae1bb432eaf58572fe572f7cb4bc2080042d7e</Hashes>
+                <Hashes condition="contains">SHA256=984a77e5424c6d099051441005f2938ae92b31b5ad8f6521c6b001932862add7</Hashes>
+                <Hashes condition="contains">SHA256=3c7e5b25a33a7805c999d318a9523fcae46695a89f55bbdb8bb9087360323dfc</Hashes>
+                <Hashes condition="contains">SHA256=4bc0921ffd4acc865525d3faf98961e8decc5aec4974552cbbf2ae8d5a569de4</Hashes>
+                <Hashes condition="contains">SHA256=a2f45d95d54f4e110b577e621fefa0483fa0e3dcca14c500c298fb9209e491c1</Hashes>
+                <Hashes condition="contains">SHA256=d1f4949f76d8ac9f2fa844d16b1b45fb1375d149d46e414e4a4c9424dc66c91f</Hashes>
+                <Hashes condition="contains">SHA256=263e8f1e20612849aea95272da85773f577fd962a7a6d525b53f43407aa7ad24</Hashes>
+                <Hashes condition="contains">SHA256=22be050955347661685a4343c51f11c7811674e030386d2264cd12ecbf544b7c</Hashes>
+                <Hashes condition="contains">SHA256=c3e150eb7e7292f70299d3054ed429156a4c32b1f7466a706a2b99249022979e</Hashes>
+                <Hashes condition="contains">SHA256=06bda5a1594f7121acd2efe38ccb617fbc078bb9a70b665a5f5efd70e3013f50</Hashes>
+                <Hashes condition="contains">SHA256=221dfbc74bbb255b0879360ccc71a74b756b2e0f16e9386b38a9ce9d4e2e34f9</Hashes>
+                <Hashes condition="contains">SHA256=36875562e747136313ec5db58174e5fab870997a054ca8d3987d181599c7db6a</Hashes>
+                <Hashes condition="contains">SHA256=475e5016c9c0f5a127896f9179a1b1577a67b357f399ab5a1e68aab07134729a</Hashes>
+                <Hashes condition="contains">SHA256=18776682fcc0c6863147143759a8d4050a4115a8ede0136e49a7cf885c8a4805</Hashes>
+                <Hashes condition="contains">SHA256=dec8a933dba04463ed9bb7d53338ff87f2c23cfb79e0e988449fc631252c9dcc</Hashes>
+                <Hashes condition="contains">SHA256=d25904fbf907e19f366d54962ff543d9f53b8fdfd2416c8b9796b6a8dd430e26</Hashes>
+                <Hashes condition="contains">SHA256=771015b2620942919bb2e0683476635b7a09db55216d6fbf03534cb18513b20c</Hashes>
+                <Hashes condition="contains">SHA256=2aa1b08f47fbb1e2bd2e4a492f5d616968e703e1359a921f62b38b8e4662f0c4</Hashes>
+                <Hashes condition="contains">SHA256=40061b30b1243be76d5283cbc8abfe007e148097d4de7337670ff1536c4c7ba1</Hashes>
+                <Hashes condition="contains">SHA256=b9a4e40a5d80fedd1037eaed958f9f9efed41eb01ada73d51b5dcd86e27e0cbf</Hashes>
+                <Hashes condition="contains">SHA256=1273b74c3c1553eaa92e844fbd51f716356cc19cf77c2c780d4899ec7738fbd1</Hashes>
+                <Hashes condition="contains">SHA256=58c071cfe72e9ee867bba85cbd0abe72eb223d27978d6f0650d0103553839b59</Hashes>
+                <Hashes condition="contains">SHA256=f88ebb633406a086d9cca6bc8b66a4ea940c5476529f9033a9e0463512a23a57</Hashes>
+                <Hashes condition="contains">SHA256=d7bc7306cb489fe4c285bbeddc6d1a09e814ef55cf30bd5b8daf87a52396f102</Hashes>
+                <Hashes condition="contains">SHA256=03e0581432f5c8cc727a8aa387f5b69ff84d38d0df6f1226c19c6e960a81e1e9</Hashes>
+                <Hashes condition="contains">SHA256=7d43769b353d63093228a59eb19bba87ce6b552d7e1a99bf34a54eee641aa0ea</Hashes>
+                <Hashes condition="contains">SHA256=2a9d481ffdc5c1e2cb50cf078be32be06b21f6e2b38e90e008edfc8c4f2a9c4e</Hashes>
+                <Hashes condition="contains">SHA256=d969845ef6acc8e5d3421a7ce7e244f419989710871313b04148f9b322751e5d</Hashes>
+                <Hashes condition="contains">SHA256=708016fbe22c813a251098f8f992b177b476bd1bbc48c2ed4a122ff74910a965</Hashes>
+                <Hashes condition="contains">SHA256=7cb497abc44aad09a38160d6a071db499e05ff5871802ccc45d565d242026ee7</Hashes>
+                <Hashes condition="contains">SHA256=2e665962c827ce0adbd29fe6bcf09bbb1d7a7022075d162ff9b65d0af9794ac0</Hashes>
+                <Hashes condition="contains">SHA256=3243aab18e273a9b9c4280a57aecef278e10bfff19abb260d7a7820e41739099</Hashes>
+                <Hashes condition="contains">SHA256=fda93c6e41212e86af07f57ca95db841161f00b08dae6304a51b467056e56280</Hashes>
+                <Hashes condition="contains">SHA256=c2a4ddcc9c3b339d752c48925d62fc4cc5adbf6fae8fedef74cdd47e88da01f8</Hashes>
+                <Hashes condition="contains">SHA256=5ae23f1fcf3fb735fcf1fa27f27e610d9945d668a149c7b7b0c84ffd6409d99a</Hashes>
+                <Hashes condition="contains">SHA256=4744df6ac02ff0a3f9ad0bf47b15854bbebb73c936dd02f7c79293a2828406f6</Hashes>
+                <Hashes condition="contains">SHA256=a7860e110f7a292d621006b7208a634504fb5be417fd71e219060381b9a891e6</Hashes>
+                <Hashes condition="contains">SHA256=bdbceca41e576841cad2f2b38ee6dbf92fd77fbbfdfe6ecf99f0623d44ef182c</Hashes>
+                <Hashes condition="contains">SHA256=7a48f92a9c2d95a72e18055cac28c1e7e6cad5f47aa735cbea5c3b82813ccfaf</Hashes>
+                <Hashes condition="contains">SHA256=17687cba00ec2c9036dd3cb5430aa1f4851e64990dafb4c8f06d88de5283d6ca</Hashes>
+                <Hashes condition="contains">SHA256=3e07bb866d329a2f9aaa4802bad04fdac9163de9bf9cfa1d035f5ca610b4b9bf</Hashes>
+                <Hashes condition="contains">SHA256=b17507a3246020fa0052a172485d7b3567e0161747927f2edf27c40e310852e0</Hashes>
+                <Hashes condition="contains">SHA256=1e16a01ef44e4c56e87abfbe03b2989b0391b172c3ec162783ad640be65ab961</Hashes>
+                <Hashes condition="contains">SHA256=82fbcb371d53b8a76a25fbbafaae31147c0d1f6b9f26b3ea45262c2267386989</Hashes>
+                <Hashes condition="contains">SHA256=ad23d77a38655acb71216824e363df8ac41a48a1a0080f35a0d23aa14b54460b</Hashes>
+                <Hashes condition="contains">SHA256=28999af32b55ddb7dcfc26376a244aa2fe297233ce7abe4919a1aef2f7e2cee7</Hashes>
+                <Hashes condition="contains">SHA256=2270a8144dabaf159c2888519b11b61e5e13acdaa997820c09798137bded3dd6</Hashes>
+                <Hashes condition="contains">SHA256=27cd05527feb020084a4a76579c125458571da8843cdfc3733211760a11da970</Hashes>
+                <Hashes condition="contains">SHA256=592f56b13e7dcaa285da64a0b9a48be7562bd9b0a190208b7c8b7d8de427cf6c</Hashes>
+                <Hashes condition="contains">SHA256=3871e16758a1778907667f78589359734f7f62f9dc953ec558946dcdbe6951e3</Hashes>
+                <Hashes condition="contains">SHA256=1d0397c263d51e9fc95bcc8baf98d1a853e1c0401cd0e27c7bf5da3fba1c93a8</Hashes>
+                <Hashes condition="contains">SHA256=4941c4298f4560fc1e59d0f16f84bab5c060793700b82be2fd7c63735f1657a8</Hashes>
+                <Hashes condition="contains">SHA256=80eeb8c2890f3535ed14f5881baf2f2226e6763be099d09fb8aadaba5b4474c1</Hashes>
+                <Hashes condition="contains">SHA256=175eed7a4c6de9c3156c7ae16ae85c554959ec350f1c8aaa6dfe8c7e99de3347</Hashes>
+                <Hashes condition="contains">SHA256=5f7e47d728ac3301eb47b409801a0f4726a435f78f1ed02c30d2a926259c71f3</Hashes>
+                <Hashes condition="contains">SHA256=358ac54be252673841a1d65bfc2fb6d549c1a4c877fa7f5e1bfa188f30375d69</Hashes>
+                <Hashes condition="contains">SHA256=6fb5bc9c51f6872de116c7db8a2134461743908efc306373f6de59a0646c4f5d</Hashes>
+                <Hashes condition="contains">SHA256=0f016c80c4938fbcd47a47409969b3925f54292eba2ce01a8e45222ce8615eb8</Hashes>
+                <Hashes condition="contains">SHA256=478d855b648ef4501d3b08b3b10e94076ac67546b0ce86b454324f1bf9a78aa0</Hashes>
+                <Hashes condition="contains">SHA256=a7c8f4faf3cbb088cac7753d81f8ec4c38ccb97cd9da817741f49272e8d01200</Hashes>
+                <Hashes condition="contains">SHA256=f1c8ca232789c2f11a511c8cd95a9f3830dd719cad5aa22cb7c3539ab8cb4dc3</Hashes>
+                <Hashes condition="contains">SHA256=8f68ca89910ebe9da3d02ec82d935de1814d79c44f36cd30ea02fa49ae488f00</Hashes>
+                <Hashes condition="contains">SHA256=1afa03118f87b62c59a97617e595ebb26dde8dbdd16ee47ef3ddd1097c30ef6a</Hashes>
+                <Hashes condition="contains">SHA256=e75714f8e0ff45605f6fc7689a1a89c7dcd34aab66c6131c63fefaca584539cf</Hashes>
+                <Hashes condition="contains">SHA256=38fa0c663c8689048726666f1c5e019feaa9da8278f1df6ff62da33961891d2a</Hashes>
+                <Hashes condition="contains">SHA256=b583414fcee280128788f7b39451c511376fe821f455d4f3702795e96d560704</Hashes>
+                <Hashes condition="contains">SHA256=1ee59eb28688e73d10838c66e0d8e011c8df45b6b43a4ac5d0b75795ca3eb512</Hashes>
+                <Hashes condition="contains">SHA256=ef86c4e5ee1dbc4f81cd864e8cd2f4a2a85ee4475b9a9ab698a4ae1cc71fbeb0</Hashes>
+                <Hashes condition="contains">SHA256=29e0062a017a93b2f2f5207a608a96df4d554c5de976bd0276c2590a03bd3e94</Hashes>
+                <Hashes condition="contains">SHA256=c628cda1ef43defc00af45b79949675a8422490d32b080b3a8bb9434242bdbf2</Hashes>
+                <Hashes condition="contains">SHA256=38d87b51f4b69ba2dae1477684a1415f1a3b578eee5e1126673b1beaefee9a20</Hashes>
+                <Hashes condition="contains">SHA256=3d9e83b189fcf5c3541c62d1f54a0da0a4e5b62c3243d2989afc46644056c8e3</Hashes>
+                <Hashes condition="contains">SHA256=88df37ede18bea511f1782c1a6c4915690b29591cf2c1bf5f52201fbbb4fa2b9</Hashes>
+                <Hashes condition="contains">SHA256=e2e79f1e696f27fa70d72f97e448081b1fa14d59cbb89bb4a40428534dd5c6f6</Hashes>
+                <Hashes condition="contains">SHA256=e50b25d94c1771937b2f632e10eea875ac6b19c57da703d52e23ad2b6299f0ae</Hashes>
+                <Hashes condition="contains">SHA256=841335eeb6af68dce5b8b24151776281a751b95056a894991b23afae80e9f33b</Hashes>
+                <Hashes condition="contains">SHA256=9d58f640c7295952b71bdcb456cae37213baccdcd3032c1e3aeb54e79081f395</Hashes>
+                <Hashes condition="contains">SHA256=19bf0d0f55d2ad33ef2d105520bde8fb4286f00e9d7a721e3c9587b9408a0775</Hashes>
+                <Hashes condition="contains">SHA256=da11e9598eef033722b97873d1c046270dd039d0e3ee6cd37911e2dc2eb2608d</Hashes>
+                <Hashes condition="contains">SHA256=2d83ccb1ad9839c9f5b3f10b1f856177df1594c66cbbc7661677d4b462ebf44d</Hashes>
+                <Hashes condition="contains">SHA256=7cfa5e10dff8a99a5d544b011f676bc383991274c693e21e3af40cf6982adb8c</Hashes>
+                <Hashes condition="contains">SHA256=316a27e2bdb86222bc7c8af4e5472166b02aec7f3f526901ce939094e5861f6d</Hashes>
+                <Hashes condition="contains">SHA256=7196187fb1ef8d108b380d37b2af8efdeb3ca1f6eefd37b5dc114c609147216d</Hashes>
+                <Hashes condition="contains">SHA256=d0e25b879d830e4f867b09d6540a664b6f88bad353cd14494c33b31a8091f605</Hashes>
+                <Hashes condition="contains">SHA256=bced04bdefad6a08c763265d6993f07aa2feb57d33ed057f162a947cf0e6668f</Hashes>
+                <Hashes condition="contains">SHA256=2101d5e80e92c55ecfd8c24fcf2202a206a4fd70195a1378f88c4cc04d336f22</Hashes>
+                <Hashes condition="contains">SHA256=9778136d2441439dc470861d15d96fa21dc9f16225232cd05b76791a5e0fde6f</Hashes>
+                <Hashes condition="contains">SHA256=18e1707b319c279c7e0204074088cc39286007a1cf6cb6e269d5067d8d0628c6</Hashes>
+                <Hashes condition="contains">SHA256=2bbc6b9dd5e6d0327250b32305be20c89b19b56d33a096522ee33f22d8c82ff1</Hashes>
+                <Hashes condition="contains">SHA256=7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d</Hashes>
+                <Hashes condition="contains">SHA256=45f42c5d874369d6be270ea27a5511efcca512aeac7977f83a51b7c4dee6b5ef</Hashes>
+                <Hashes condition="contains">SHA256=fb6b0d304433bf88cc7d57728683dbb4b9833459dc33528918ead09b3907ff22</Hashes>
+                <Hashes condition="contains">SHA256=677c0b1add3990fad51f492553d3533115c50a242a919437ccb145943011d2bf</Hashes>
+                <Hashes condition="contains">SHA256=385485e643aa611e97ceae6590c6a8c47155886123dbb9de1e704d0d1624d039</Hashes>
+                <Hashes condition="contains">SHA256=71ff60722231c7641ad593756108cf6779dbaad21c7b08065fb1d4e225eab14d</Hashes>
+                <Hashes condition="contains">SHA256=ad2477632b9b07588cfe0e692f244c05fa4202975c1fe91dd3b90fa911ac6058</Hashes>
+                <Hashes condition="contains">SHA256=727e8ba66a8ff07bdc778eacb463b65f2d7167a6616ca2f259ea32571cacf8af</Hashes>
+                <Hashes condition="contains">SHA256=af095de15a16255ca1b2c27dad365dff9ac32d2a75e8e288f5a1307680781685</Hashes>
+                <Hashes condition="contains">SHA256=cfb7af8ac67a379e7869289aeee21837c448ea6f8ab6c93988e7aa423653bd40</Hashes>
+                <Hashes condition="contains">SHA256=0c512b615eac374d4d494e3c36838d8e788b3dc2691bf27916f7f42694b14467</Hashes>
+                <Hashes condition="contains">SHA256=fb81b5f8bf69637dbdf050181499088a67d24577587bc520de94b5ee8996240f</Hashes>
+                <Hashes condition="contains">SHA256=440883cd9d6a76db5e53517d0ec7fe13d5a50d2f6a7f91ecfc863bc3490e4f5c</Hashes>
+                <Hashes condition="contains">SHA256=e3936d3356573ce2e472495cd3ce769f49a613e453b010433dafce5ea498ddc2</Hashes>
+                <Hashes condition="contains">SHA256=5f487829527802983d5c120e3b99f3cf89333ca14f5e49ac32df0798cfb1f7aa</Hashes>
+                <Hashes condition="contains">SHA256=673b63b67345773cd6d66f6adcf2c753e2d949232bff818d5bb6e05786538d92</Hashes>
+                <Hashes condition="contains">SHA256=72c0d2d699d0440db17cb7cbbc06a253eaafd21465f14bb0fed8b85ae73153d1</Hashes>
+                <Hashes condition="contains">SHA256=ad8ffccfde782bc287241152cf24245a8bf21c2530d81c57e17631b3c4adb833</Hashes>
+                <Hashes condition="contains">SHA256=e61a54f6d3869b43c4eceac3016df73df67cce03878c5a6167166601c5d3f028</Hashes>
+                <Hashes condition="contains">SHA256=5cfad3d473961763306d72c12bd5ae14183a1a5778325c9acacca764b79ca185</Hashes>
+                <Hashes condition="contains">SHA256=436ccab6f62fa2d29827916e054ade7acae485b3de1d3e5c6c62d3debf1480e7</Hashes>
+                <Hashes condition="contains">SHA256=8399e5afd8e3e97139dffb1a9fb00db2186321b427f164403282217cab067c38</Hashes>
+                <Hashes condition="contains">SHA256=b48a309ee0960da3caaaaf1e794e8c409993aeb3a2b64809f36b97aac8a1e62a</Hashes>
+                <Hashes condition="contains">SHA256=dbb457ae1bd07a945a1466ce4a206c625e590aee3922fa7d86fbe956beccfc98</Hashes>
+                <Hashes condition="contains">SHA256=6071db01b50c658cf78665c24f1d21f21b4a12d16bfcfaa6813bf6bbc4d0a1e8</Hashes>
+                <Hashes condition="contains">SHA256=e428ddf9afc9b2d11e2271f0a67a2d6638b860c2c12d4b8cc63d33f3349ee93f</Hashes>
+                <Hashes condition="contains">SHA256=6c64688444d3e004da77dcfb769d064bb38afceeef7ff915dfc71e60e19ff18a</Hashes>
+                <Hashes condition="contains">SHA256=aa9ab1195dc866270e984f1bed5e1358d6ef24c515dfdb6c2a92d1e1b94bf608</Hashes>
+                <Hashes condition="contains">SHA256=1023dcd4c80db19e9f82f95b1c5e1ddb60db7ac034848dd5cc1c78104a6350f4</Hashes>
+                <Hashes condition="contains">SHA256=de3597ae7196ca8c0750dce296a8a4f58893774f764455a125464766fcc9b3b5</Hashes>
+                <Hashes condition="contains">SHA256=47f0cdaa2359a63ad1389ef4a635f1f6eee1f63bdf6ef177f114bdcdadc2e005</Hashes>
+                <Hashes condition="contains">SHA256=db2a9247177e8cdd50fe9433d066b86ffd2a84301aa6b2eb60f361cfff077004</Hashes>
+                <Hashes condition="contains">SHA256=6948480954137987a0be626c24cf594390960242cd75f094cd6aaa5c2e7a54fa</Hashes>
+                <Hashes condition="contains">SHA256=6f55c148bb27c14408cf0f16f344abcd63539174ac855e510a42d78cfaec451c</Hashes>
+                <Hashes condition="contains">SHA256=3e274df646f191d2705c0beaa35eeea84808593c3b333809f13632782e27ad75</Hashes>
+                <Hashes condition="contains">SHA256=ab8f2217e59319b88080e052782e559a706fa4fb7b8b708f709ff3617124da89</Hashes>
+                <Hashes condition="contains">SHA256=0be4912bfd7a79f6ebfa1c06a59f0fb402bd4fe0158265780509edd0e562eac1</Hashes>
+                <Hashes condition="contains">SHA256=77c5e95b872b1d815d6d3ed28b399ca39f3427eeb0143f49982120ff732285a9</Hashes>
+                <Hashes condition="contains">SHA256=42579a759f3f95f20a2c51d5ac2047a2662a2675b3fb9f46c1ed7f23393a0f00</Hashes>
+                <Hashes condition="contains">SHA256=11d258e05b850dcc9ecfacccc9486e54bd928aaa3d5e9942696c323fdbd3481b</Hashes>
+                <Hashes condition="contains">SHA256=5027fce41ed60906a0e76b97c95c2a5a83d57a2d1cd42de232a21f26c0d58e48</Hashes>
+                <Hashes condition="contains">SHA256=955dac77a0148e9f9ed744f5d341cb9c9118261e52fe622ac6213965f2bc4cad</Hashes>
+                <Hashes condition="contains">SHA256=80a59ca71fc20961ccafc0686051e86ae4afbbd4578cb26ad4570b9207651085</Hashes>
+                <Hashes condition="contains">SHA256=dfaefd06b680f9ea837e7815fc1cc7d1f4cc375641ac850667ab20739f46ad22</Hashes>
+                <Hashes condition="contains">SHA256=0d3790af5f8e5c945410929e31d06144a471ac82f828afe89a4758a5bbeb7f9f</Hashes>
+                <Hashes condition="contains">SHA256=50db5480d0392a7dd6ab5df98389dc24d1ed1e9c98c9c35964b19dabcd6dc67f</Hashes>
+                <Hashes condition="contains">SHA256=862d0ff27bb086145a33b9261142838651b0d2e1403be321145e197600eb5015</Hashes>
+                <Hashes condition="contains">SHA256=fca10cde7d331b7f614118682d834d46125a65888e97bd9fda2df3f15797166c</Hashes>
+                <Hashes condition="contains">SHA256=c50f8ab8538c557963252b702c1bd3cee4604b5fc2497705d2a6a3fd87e3cc26</Hashes>
+                <Hashes condition="contains">SHA256=1c1251784e6f61525d0082882a969cb8a0c5d5359be22f5a73e3b0cd38b51687</Hashes>
+                <Hashes condition="contains">SHA256=c8eaa5e6d3230b93c126d2d58e32409e4aeeb23ccf0dd047a17f1ef552f92fe9</Hashes>
+                <Hashes condition="contains">SHA256=31f4140c12ac31f5729a8de4dc051d3acd07783564604df831a2a6722c979192</Hashes>
+                <Hashes condition="contains">SHA256=88e2e6a705d3fb71b966d9fb46dc5a4b015548daf585fb54dfcd81dc0bd3ebdc</Hashes>
+                <Hashes condition="contains">SHA256=f8965fdce668692c3785afa3559159f9a18287bc0d53abb21902895a8ecf221b</Hashes>
+                <Hashes condition="contains">SHA256=3b6e85c8fed9e39b21b2eab0b69bc464272b2c92961510c36e2e2df7aa39861b</Hashes>
+                <Hashes condition="contains">SHA256=399effe75d32bdab6fa0a6bffe02dbf0a59219d940b654837c3be1c0bd02e9aa</Hashes>
+                <Hashes condition="contains">SHA256=092349aebdac28294dbad1656759d8461f362d1a36b01054dccf861d97beadf0</Hashes>
+                <Hashes condition="contains">SHA256=074ae477c8c7ae76c6f2b0bf77ac17935a8e8ee51b52155d2821d93ab30f3761</Hashes>
+                <Hashes condition="contains">SHA256=b47be212352d407d0ef7458a7161c66b47c2aec8391dd101df11e65728337a6a</Hashes>
+                <Hashes condition="contains">SHA256=b51ddcf8309c80384986dda9b11bf7856b030e3e885b0856efdb9e84064917e5</Hashes>
+                <Hashes condition="contains">SHA256=fd33fb2735cc5ef466a54807d3436622407287e325276fcd3ed1290c98bd0533</Hashes>
+                <Hashes condition="contains">SHA256=523d1d43e896077f32cd9acaa8e85b513bfb7b013a625e56f0d4e9675d9822ba</Hashes>
+                <Hashes condition="contains">SHA256=f4ff679066269392f6b7c3ba6257fc60dd609e4f9c491b00e1a16e4c405b0b9b</Hashes>
+                <Hashes condition="contains">SHA256=d5c4ff35eaa74ccdb80c7197d3d113c9cd38561070f2aa69c0affe8ed84a77c9</Hashes>
+                <Hashes condition="contains">SHA256=6cb51ae871fbd5d07c5aad6ff8eea43d34063089528603ca9ceb8b4f52f68ddc</Hashes>
+                <Hashes condition="contains">SHA256=7e3b0b8d3e430074109d85729201d7c34bc5b918c0bcb9f64ce88c5e37e1a456</Hashes>
+                <Hashes condition="contains">SHA256=c5050a2017490fff7aa53c73755982b339ddb0fd7cef2cde32c81bc9834331c5</Hashes>
+                <Hashes condition="contains">SHA256=0f17e5cfc5bdd74aff91bfb1a836071345ba2b5d1b47b0d5bf8e7e0d4d5e2dbf</Hashes>
+                <Hashes condition="contains">SHA256=3a95cc82173032b82a0ffc7d2e438df64c13bc16b4574214c9fe3be37250925e</Hashes>
+                <Hashes condition="contains">SHA256=4ab41816abbf14d59e75b7fad49e2cb1c1feb27a3cb27402297a2a4793ff9da7</Hashes>
+                <Hashes condition="contains">SHA256=42e170a7ab1d2c160d60abfc906872f9cfd0c2ee169ed76f6acb3f83b3eeefdb</Hashes>
+                <Hashes condition="contains">SHA256=496f4a4021226fb0f1b5f71a7634c84114c29faa308746a12c2414adb6b2a40b</Hashes>
+                <Hashes condition="contains">SHA256=9a1d66036b0868bbb1b2823209fedea61a301d5dd245f8e7d390bd31e52d663e</Hashes>
+                <Hashes condition="contains">SHA256=a7b000abbcc344444a9b00cfade7aa22ab92ce0cadec196c30eb1851ae4fa062</Hashes>
+                <Hashes condition="contains">SHA256=38bb9751a3a1f072d518afe6921a66ee6d5cf6d25bc50af49e1925f20d75d4d7</Hashes>
+                <Hashes condition="contains">SHA256=86a8e0aa29a5b52c84921188cc1f0eca9a7904dcfe09544602933d8377720219</Hashes>
+                <Hashes condition="contains">SHA256=1b00d6e5d40b1b84ca63da0e99246574cdd2a533122bc83746f06c0d66e63a6e</Hashes>
+                <Hashes condition="contains">SHA256=6c7120e40fc850e4715058b233f5ad4527d1084a909114fd6a36b7b7573c4a44</Hashes>
+                <Hashes condition="contains">SHA256=e58bbf3251906ff722aa63415bf169618e78be85cb92c8263d3715c260491e90</Hashes>
+                <Hashes condition="contains">SHA256=000547560fea0dd4b477eb28bf781ea67bf83c748945ce8923f90fdd14eb7a4b</Hashes>
+                <Hashes condition="contains">SHA256=53eaefba7e7dca9ab74e385abf18762f9f1aa51594e7f7db5ba612d6c787dd7e</Hashes>
+                <Hashes condition="contains">SHA256=7837cb350338c4958968d06b105466da6518f5bb522a6e70e87c0cad85128408</Hashes>
+                <Hashes condition="contains">SHA256=6e0aa67cfdbe27a059cbd066443337f81c5b6d37444d14792d1c765d9d122dcf</Hashes>
+                <Hashes condition="contains">SHA256=3503ea284b6819f9cb43b3e94c0bb1bf5945ccb37be6a898387e215197a4792a</Hashes>
+                <Hashes condition="contains">SHA256=37dde6bd8a7a36111c3ac57e0ac20bbb93ce3374d0852bcacc9a2c8c8c30079e</Hashes>
+                <Hashes condition="contains">SHA256=54841d9f89e195196e65aa881834804fe3678f1cf6b328cab8703edd15e3ec57</Hashes>
+                <Hashes condition="contains">SHA256=48891874441c6fa69e5518d98c53d83b723573e280c6c65ccfbde9039a6458c9</Hashes>
+                <Hashes condition="contains">SHA256=37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba</Hashes>
+                <Hashes condition="contains">SHA256=01aa278b07b58dc46c84bd0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd</Hashes>
+                <Hashes condition="contains">SHA256=f29073dc99cb52fa890aae80037b48a172138f112474a1aecddae21179c93478</Hashes>
+                <Hashes condition="contains">SHA256=e3f2ee22dec15061919583e4beb8abb3b29b283e2bcb46badf2bfde65f5ea8dd</Hashes>
+                <Hashes condition="contains">SHA256=20f11a64bc4548f4edb47e3d3418da0f6d54a83158224b71662a6292bf45b5fb</Hashes>
+                <Hashes condition="contains">SHA256=38b3eb8c86201d26353aab625cea672e60c2f66ce6f5e5eda673e8c3478bf305</Hashes>
+                <Hashes condition="contains">SHA256=ea85bbe63d6f66f7efee7007e770af820d57f914c7f179c5fee3ef2845f19c41</Hashes>
+                <Hashes condition="contains">SHA256=d74755311d127d0eb7454e56babc2db8dbaa814bc4ba8e2a7754d3e0224778e1</Hashes>
+                <Hashes condition="contains">SHA256=e32ab30d01dcff6418544d93f99ae812d2ce6396e809686620547bea05074f6f</Hashes>
+                <Hashes condition="contains">SHA256=69e3fda487a5ec2ec0f67b7d79a5a836ff0036497b2d1aec514c67d2efa789b2</Hashes>
+                <Hashes condition="contains">SHA256=9ee33ffd80611a13779df6286c1e04d3c151f1e2f65e3d664a08997fcd098ef3</Hashes>
+                <Hashes condition="contains">SHA256=de6bf572d39e2611773e7a01f0388f84fb25da6cba2f1f8b9b36ffba467de6fa</Hashes>
+                <Hashes condition="contains">SHA256=fc22977ff721b3d718b71c42440ee2d8a144f3fbc7755e4331ddd5bcc65158d2</Hashes>
+                <Hashes condition="contains">SHA256=6de84caa2ca18673e01b91af58220c60aecd5cccf269725ec3c7f226b2167492</Hashes>
+                <Hashes condition="contains">SHA256=0e53b58415fa68552928622118d5b8a3a851b2fc512709a90b63ba46acda8b6b</Hashes>
+                <Hashes condition="contains">SHA256=3279593db91bb7ad5b489a01808c645eafafda6cc9c39f50d10ccc30203f2ddf</Hashes>
+                <Hashes condition="contains">SHA256=d8459f7d707c635e2c04d6d6d47b63f73ba3f6629702c7a6e0df0462f6478ae2</Hashes>
+                <Hashes condition="contains">SHA256=61befeef14783eb0fed679fca179d2f5c33eb2dcbd40980669ca2ebeb3bf11cf</Hashes>
+                <Hashes condition="contains">SHA256=7cc9ba2df7b9ea6bb17ee342898edd7f54703b93b6ded6a819e83a7ee9f938b4</Hashes>
+                <Hashes condition="contains">SHA256=9b1ac756e35f795dd91adbc841e78db23cb7165280f8d4a01df663128b66d194</Hashes>
+                <Hashes condition="contains">SHA256=6befa481e8cca8084d9ec3a1925782cd3c28ef7a3e4384e034d48deaabb96b63</Hashes>
+                <Hashes condition="contains">SHA256=5b3705b47dc15f2b61ca3821b883b9cd114d83fcc3344d11eb1d3df495d75abe</Hashes>
+                <Hashes condition="contains">SHA256=34bee22c18ddbddbe115cf1ab55cabf0e482aba1eb2c343153577fb24b7226d3</Hashes>
+                <Hashes condition="contains">SHA256=2f60536b25ba8c9014e4a57d7a9a681bd3189fa414eea88c256d029750e15cae</Hashes>
+                <Hashes condition="contains">SHA256=3f2fda9a7a9c57b7138687bbce49a2e156d6095dddabb3454ea09737e02c3fa5</Hashes>
+                <Hashes condition="contains">SHA256=d92eab70bcece4432258c9c9a914483a2267f6ab5ce2630048d3a99e8cb1b482</Hashes>
+                <Hashes condition="contains">SHA256=81aafae4c4158d0b9a6431aff0410745a0f6a43fb20a9ab316ffeb8c2e2ccac0</Hashes>
+                <Hashes condition="contains">SHA256=1c8dfa14888bb58848b4792fb1d8a921976a9463be8334cff45cc96f1276049a</Hashes>
+                <Hashes condition="contains">SHA256=9679758455c69877fce866267d60c39d108b495dca183954e4af869902965b3d</Hashes>
+                <Hashes condition="contains">SHA256=b6fd51e1f57a03006953e84fd56cc2821cc19e7c77c0474e1110aabaacaf03df</Hashes>
+                <Hashes condition="contains">SHA256=9a91d6e83b8fdec536580f6617f10dfc64eedf14ead29a6a644eb154426622ba</Hashes>
+                <Hashes condition="contains">SHA256=6ed35f310c96920a271c59a097b382da07856e40179c2a4239f8daa04eef38e7</Hashes>
+                <Hashes condition="contains">SHA256=cff9aa9046bdfd781d34f607d901a431a51bb7e5f48f4f681cc743b2cdedc98c</Hashes>
+                <Hashes condition="contains">SHA256=dde6f28b3f7f2abbee59d4864435108791631e9cb4cdfb1f178e5aa9859956d8</Hashes>
+                <Hashes condition="contains">SHA256=59626cac380d8fe0b80a6d4c4406d62ba0683a2f0f68d50ad506ca1b1cf25347</Hashes>
+                <Hashes condition="contains">SHA256=18deed37f60b6aa8634dda2565a0485452487d7bce88afb49301a7352db4e506</Hashes>
+                <Hashes condition="contains">SHA256=01e024cb14b34b6d525c642a710bfa14497ea20fd287c39ba404b10a8b143ece</Hashes>
+                <Hashes condition="contains">SHA256=509628b6d16d2428031311d7bd2add8d5f5160e9ecc0cd909f1e82bbbb3234d6</Hashes>
+                <Hashes condition="contains">SHA256=ada4e42bf5ef58ef1aad94435441003b1cc1fcaa5d38bfdbe1a3d736dc451d47</Hashes>
+                <Hashes condition="contains">SHA256=e2d8dd5dacc24051709f55a35184f5f99aef957a83bd358b0608b4479e1ec24f</Hashes>
+                <Hashes condition="contains">SHA256=c2fcc0fec64d5647813b84b9049d430406c4c6a7b9f8b725da21bcae2ff12247</Hashes>
+                <Hashes condition="contains">SHA256=7c731c0ea7f28671ab7787800db69739ea5cd6be16ea21045b4580cf95cbf73b</Hashes>
+                <Hashes condition="contains">SHA256=34e0364a4952d914f23f271d36e11161fb6bb7b64aea22ff965a967825a4a4bf</Hashes>
+                <Hashes condition="contains">SHA256=cc687fe3741bbde1dd142eac0ef59fd1d4457daee43cdde23bb162ef28d04e64</Hashes>
+                <Hashes condition="contains">SHA256=da6ca1fb539f825ca0f012ed6976baf57ef9c70143b7a1e88b4650bf7a925e24</Hashes>
+                <Hashes condition="contains">SHA256=5fad3775feb8b6f6dcbd1642ae6b6a565ff7b64eadfc9bf9777918b51696ab36</Hashes>
+                <Hashes condition="contains">SHA256=bda99629ec6c522c3efcbcc9ca33688d31903146f05b37d0d3b43db81bfb3961</Hashes>
+                <Hashes condition="contains">SHA256=9790a7b9d624b2b18768bb655dda4a05a9929633cef0b1521e79e40d7de0a05b</Hashes>
+                <Hashes condition="contains">SHA256=1963d5a0e512b72353953aadbe694f73a9a576f0241a988378fa40bf574eda52</Hashes>
+                <Hashes condition="contains">SHA256=ae79e760c739d6214c1e314728a78a6cb6060cce206fde2440a69735d639a0a2</Hashes>
+                <Hashes condition="contains">SHA256=72288d4978ee87ea6c8b1566dbd906107357087cef7364fb3dd1e1896d00baeb</Hashes>
+                <Hashes condition="contains">SHA256=e4eca7db365929ff7c5c785e2eab04ef8ec67ea9edcf7392f2b74eccd9449148</Hashes>
+                <Hashes condition="contains">SHA256=1aaf4c1e3cb6774857e2eef27c17e68dc1ae577112e4769665f516c2e8c4e27b</Hashes>
+                <Hashes condition="contains">SHA256=131d5490ceb9a5b2324d8e927fea5becfc633015661de2f4c2f2375a3a3b64c6</Hashes>
+                <Hashes condition="contains">SHA256=89b0017bc30cc026e32b758c66a1af88bd54c6a78e11ec2908ff854e00ac46be</Hashes>
+                <Hashes condition="contains">SHA256=70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4</Hashes>
+                <Hashes condition="contains">SHA256=626fae47811450d080d08c3d9fd890aa64bfecdc45eacd42a40850c1833c8763</Hashes>
+                <Hashes condition="contains">SHA256=101402d4f5d1ae413ded499c78a5fcbbc7e3bae9b000d64c1dd64e3c48c37558</Hashes>
+                <Hashes condition="contains">SHA256=1078af0c70e03ac17c7b8aa5ee03593f5decfef2f536716646a4ded1e98c153c</Hashes>
+                <Hashes condition="contains">SHA256=8f23313adb35782adb0ba97fefbfbb8bbc5fc40ae272e07f6d4629a5305a3fa2</Hashes>
+                <Hashes condition="contains">SHA256=3a5ec83fe670e5e23aef3afa0a7241053f5b6be5e6ca01766d6b5f9177183c25</Hashes>
+                <Hashes condition="contains">SHA256=2fbbc276737047cb9b3ba5396756d28c1737342d89dce1b64c23a9c4513ae445</Hashes>
+                <Hashes condition="contains">SHA256=98a123b314cba2de65f899cdbfa386532f178333389e0f0fbd544aff85be02eb</Hashes>
+                <Hashes condition="contains">SHA256=2bbe65cbec3bb069e92233924f7ee1f95ffa16173fceb932c34f68d862781250</Hashes>
+                <Hashes condition="contains">SHA256=2470fd1b733314c9b0afa19fd39c5d19aa1b36db598b5ebbe93445caa545da5f</Hashes>
+                <Hashes condition="contains">SHA256=09043c51719d4bf6405c9a7a292bb9bb3bcc782f639b708ddcc4eedb5e5c9ce9</Hashes>
+                <Hashes condition="contains">SHA256=d884ca8cc4ef1826ca3ab03eb3c2d8f356ba25f2d20db0a7d9fc251c565be7f3</Hashes>
+                <Hashes condition="contains">SHA256=55fee54c0d0d873724864dc0b2a10b38b7f40300ee9cae4d9baaf8a202c4049a</Hashes>
+                <Hashes condition="contains">SHA256=4045ae77859b1dbf13972451972eaaf6f3c97bea423e9e78f1c2f14330cd47ca</Hashes>
+                <Hashes condition="contains">SHA256=b95b2d9b29bd25659f1c7ba5a187f8d23cde01162d9b5b1a2c4aea8f64b38441</Hashes>
+                <Hashes condition="contains">SHA256=1766fd66f846d9a21e648d649ad35d1ff94f8ca17a40a9a738444d6b8e07aacb</Hashes>
+                <Hashes condition="contains">SHA256=8111085022bda87e5f6aa4c195e743cc6dd6a3a6d41add475d267dc6b105a69f</Hashes>
+                <Hashes condition="contains">SHA256=c089a31ac95d41ed02d1e4574962f53376b36a9e60ff87769d221dc7d1a3ecfa</Hashes>
+                <Hashes condition="contains">SHA256=b2ba6efeff1860614b150916a77c9278f19d51e459e67a069ccd15f985cbc0e1</Hashes>
+                <Hashes condition="contains">SHA256=823da894b2c73ffcd39e77366b6f1abf0ae9604d9b20140a54e6d55053aadeba</Hashes>
+                <Hashes condition="contains">SHA256=79e2d37632c417138970b4feba91b7e10c2ea251c5efe3d1fc6fa0190f176b57</Hashes>
+                <Hashes condition="contains">SHA256=1aaa9aef39cb3c0a854ecb4ca7d3b213458f302025e0ec5bfbdef973cca9111c</Hashes>
+                <Hashes condition="contains">SHA256=f596e64f4c5d7c37a00493728d8756b243cfdc11e3372d6d6dfeffc13c9ab960</Hashes>
+                <Hashes condition="contains">SHA256=0da746e49fd662be910d0e366934a7e02898714eaaa577e261ab40eb44222b5c</Hashes>
+                <Hashes condition="contains">SHA256=c9cf1d627078f63a36bbde364cd0d5f2be1714124d186c06db5bcdf549a109f8</Hashes>
+                <Hashes condition="contains">SHA256=092d04284fdeb6762e65e6ac5b813920d6c69a5e99d110769c5c1a78e11c5ba0</Hashes>
+                <Hashes condition="contains">SHA256=0ee5067ce48883701824c5b1ad91695998916a3702cf8086962fbe58af74b2d6</Hashes>
+                <Hashes condition="contains">SHA256=2b4c7d3820fe08400a7791e2556132b902a9bbadc1942de57077ecb9d21bf47a</Hashes>
+                <Hashes condition="contains">SHA256=07b6d69bafcfd767f1b63a490a8843c3bb1f8e1bbea56176109b5743c8f7d357</Hashes>
+                <Hashes condition="contains">SHA256=5f5e5f1c93d961985624768b7c676d488c7c7c1d4c043f6fc1ea1904fefb75be</Hashes>
+                <Hashes condition="contains">SHA256=93b266f38c3c3eaab475d81597abbd7cc07943035068bb6fd670dbbe15de0131</Hashes>
+                <Hashes condition="contains">SHA256=dcb815eb8e9016608d0d917101b6af8c84b96fb709dc0344bceed02cbc4ed258</Hashes>
+                <Hashes condition="contains">SHA256=4b5229b3250c8c08b98cb710d6c056144271de099a57ae09f5d2097fc41bd4f1</Hashes>
+                <Hashes condition="contains">SHA256=9dab4b6fddc8e1ec0a186aa8382b184a5d52cfcabaaf04ff9e3767021eb09cf4</Hashes>
+                <Hashes condition="contains">SHA256=6b830ea0db6546a044c9900d3f335e7820c2a80e147b0751641899d1a5aa8f74</Hashes>
+                <Hashes condition="contains">SHA256=ae6fb53e4d8122dba3a65e5fa59185b36c3ac9df46e82fcfb6731ab55c6395aa</Hashes>
+                <Hashes condition="contains">SHA256=7e0124fcc7c95fdc34408cf154cb41e654dade8b898c71ad587b2090b1da30d7</Hashes>
+                <Hashes condition="contains">SHA256=5f69d6b167a1eeca3f6ac64785c3c01976ee7303171faf998d65852056988683</Hashes>
+                <Hashes condition="contains">SHA256=e4a7da2cf59a4a21fc42b611df1d59cae75051925a7ddf42bf216cc1a026eadb</Hashes>
+                <Hashes condition="contains">SHA256=0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5</Hashes>
+                <Hashes condition="contains">SHA256=e005e8d183e853a27ad3bb56f25489f369c11b0d47e3d4095aad9291b3343bf1</Hashes>
+                <Hashes condition="contains">SHA256=5177a3b7393fb5855b2ec0a45d4c91660b958ee077e76e5a7d0669f2e04bcf02</Hashes>
+                <Hashes condition="contains">SHA256=f6cd7353cb6e86e98d387473ed6340f9b44241867508e209e944f548b9db1d5f</Hashes>
+                <Hashes condition="contains">SHA256=7877c1b0e7429453b750218ca491c2825dae684ad9616642eff7b41715c70aca</Hashes>
+                <Hashes condition="contains">SHA256=8137ce22d0d0fc5ea5b174d6ad3506a4949506477b1325da2ccb76511f4c4f60</Hashes>
+                <Hashes condition="contains">SHA256=5d530e111400785d183057113d70623e17af32931668ab7c7fc826f0fd4f91a3</Hashes>
+                <Hashes condition="contains">SHA256=2d195cd4400754cc6f6c3f8ab1fe31627932c3c1bf8d5d0507c292232d1a2396</Hashes>
+                <Hashes condition="contains">SHA256=ee3ff12943ced401e2b6df9e66e8a0be8e449fa9326cab241f471b2d8ffefdd7</Hashes>
+                <Hashes condition="contains">SHA256=65008817eb97635826a8708a6411d7b50f762bab81304e457119d669382944c3</Hashes>
+                <Hashes condition="contains">SHA256=7893307df2fdde25371645a924f0333e1b2de31b6bc839d8e2a908d7830c6504</Hashes>
+                <Hashes condition="contains">SHA256=2121a2bb8ebbf2e6e82c782b6f3c6b7904f686aa495def25cf1cf52a42e16109</Hashes>
+                <Hashes condition="contains">SHA256=e1980c6592e6d2d92c1a65acad8f1071b6a404097bb6fcce494f3c8ac31385cf</Hashes>
+                <Hashes condition="contains">SHA256=f85784fa8e7a7ec86cb3fe76435802f6bb82256e1824ed7b5d61bf075f054573</Hashes>
+                <Hashes condition="contains">SHA256=8688e43d94b41eeca2ed458b8fc0d02f74696a918e375ecd3842d8627e7a8f2b</Hashes>
+                <Hashes condition="contains">SHA256=f581decc2888ef27ee1ea85ea23bbb5fb2fe6a554266ff5a1476acd1d29d53af</Hashes>
+                <Hashes condition="contains">SHA256=61a1bdddd3c512e681818debb5bee94db701768fc25e674fcad46592a3259bd0</Hashes>
+                <Hashes condition="contains">SHA256=4b4c925c3b8285aeeab9b954e8b2a0773b4d2d0e18d07d4a9d268f4be90f6cae</Hashes>
+                <Hashes condition="contains">SHA256=ac63c26ca43701dddaa7fb1aea535d42190f88752900a03040fd5aaa24991e25</Hashes>
+                <Hashes condition="contains">SHA256=7dfc2eb033d2e090540860b8853036f40736d02bd22099ff6cf665a90be659cd</Hashes>
+                <Hashes condition="contains">SHA256=b773511fdb2e370dec042530910a905472fcc2558eb108b246fd3200171b04d3</Hashes>
+                <Hashes condition="contains">SHA256=2da330a2088409efc351118445a824f11edbe51cf3d653b298053785097fe40e</Hashes>
+                <Hashes condition="contains">SHA256=f85eb576acb5db0d2f48e5f09a7244165a876fa1ca8697ebb773e4d7071d4439</Hashes>
+                <Hashes condition="contains">SHA256=e4d9f037411284e996a002b15b49bc227d085ee869ae1cd91ba54ff7c244f036</Hashes>
+                <Hashes condition="contains">SHA256=36e3127f045ef1fa7426a3ff8c441092d3b66923d2b69826034e48306609e289</Hashes>
+                <Hashes condition="contains">SHA256=950a4c0c772021cee26011a92194f0e58d61588f77f2873aa0599dff52a160c9</Hashes>
+                <Hashes condition="contains">SHA256=5c04c274a708c9a7d993e33be3ea9e6119dc29527a767410dbaf93996f87369a</Hashes>
+                <Hashes condition="contains">SHA256=0fd2df82341bf5ebb8a53682e60d08978100c01acb0bed7b6ce2876ada80f670</Hashes>
+                <Hashes condition="contains">SHA256=904e0f7d485a98e8497d5ec6dd6e6e1cf0b8d8e067fb64a9e09790af3c8c9d5a</Hashes>
+                <Hashes condition="contains">SHA256=3ec5ad51e6879464dfbccb9f4ed76c6325056a42548d5994ba869da9c4c039a8</Hashes>
+                <Hashes condition="contains">SHA256=3c4207c90c97733fae2a08679d63fbbe94dfcf96fdfdf88406aa7ab3f80ea78f</Hashes>
+                <Hashes condition="contains">SHA256=077aa8ff5e01747723b6d24cc8af460a7a00f30cd3bc80e41cc245ceb8305356</Hashes>
+                <Hashes condition="contains">SHA256=cfcf32f5662791f1f22a77acb6dddfbc970fe6e99506969b3ea67c03f67687ab</Hashes>
+                <Hashes condition="contains">SHA256=6bfc0f425de9f4e7480aa2d1f2e08892d0553ed0df1c31e9bf3d8d702f38fa2e</Hashes>
+                <Hashes condition="contains">SHA256=f15ae970e222ce06dbf3752b223270d0e726fb78ebec3598b4f8225b5a0880b1</Hashes>
+                <Hashes condition="contains">SHA256=e86cb77de7b6a8025f9a546f6c45d135f471e664963cf70b381bee2dfd0fdef4</Hashes>
+                <Hashes condition="contains">SHA256=654c5ba47f74008c8f49cbb97988017eec8c898adc3bb851bc6e1fdf9dcf54ad</Hashes>
+                <Hashes condition="contains">SHA256=ad40e6d0f77c0e579fb87c5106bf6de3d1a9f30ee2fbf8c9c011f377fa05f173</Hashes>
+                <Hashes condition="contains">SHA256=6ffdde6bc6784c13c601442e47157062941c47015891e7139c2aaba676ab59cc</Hashes>
+                <Hashes condition="contains">SHA256=81939e5c12bd627ff268e9887d6fb57e95e6049f28921f3437898757e7f21469</Hashes>
+                <Hashes condition="contains">SHA256=80cbba9f404df3e642f22c476664d63d7c229d45d34f5cd0e19c65eb41becec3</Hashes>
+                <Hashes condition="contains">SHA256=ab2632a4d93a7f3b7598c06a9fdc773a1b1b69a7dd926bdb7cf578992628e9dd</Hashes>
+                <Hashes condition="contains">SHA256=22418016e980e0a4a2d01ca210a17059916a4208352c1018b0079ccb19aaf86a</Hashes>
+                <Hashes condition="contains">SHA256=f51bdb0ad924178131c21e39a8ccd191e46b5512b0f2e1cc8486f63e84e5d960</Hashes>
+                <Hashes condition="contains">SHA256=119c48b79735fda0ecd973d77d9bdc6b329960caed09b38ab454236ca039d280</Hashes>
+                <Hashes condition="contains">SHA256=62f5e13b2edc00128716cb93e6a9eddffea67ce83d2bb426f18f5be08ead89e0</Hashes>
+                <Hashes condition="contains">SHA256=0b542e47248611a1895018ec4f4033ea53464f259c74eb014d018b19ad818917</Hashes>
+                <Hashes condition="contains">SHA256=5a826b4fa10891cf63aae832fc645ce680a483b915c608ca26cedbb173b1b80a</Hashes>
+                <Hashes condition="contains">SHA256=7133a461aeb03b4d69d43f3d26cd1a9e3ee01694e97a0645a3d8aa1a44c39129</Hashes>
+                <Hashes condition="contains">SHA256=2a6212f3b68a6f263e96420b3607b31cfdfe51afff516f3c87d27bf8a89721e8</Hashes>
+                <Hashes condition="contains">SHA256=453be8f63cc6b116e2049659e081d896491cf1a426e3d5f029f98146a3f44233</Hashes>
+                <Hashes condition="contains">SHA256=cdfbe62ef515546f1728189260d0bdf77167063b6dbb77f1db6ed8b61145a2bc</Hashes>
+                <Hashes condition="contains">SHA256=3c5d7069f85ec1d6f58147431f88c4d7c48df73baf94ffdefd664f2606baf09c</Hashes>
+                <Hashes condition="contains">SHA256=ded2927f9a4e64eefd09d0caba78e94f309e3a6292841ae81d5528cab109f95d</Hashes>
+                <Hashes condition="contains">SHA256=ac3f613d457fc4d44fa27b2e0b1baa62c09415705efb5a40a4756da39b3ac165</Hashes>
+                <Hashes condition="contains">SHA256=fa875178ae2d7604d027510b0d0a7e2d9d675e10a4c9dda2d927ee891e0bcb91</Hashes>
+                <Hashes condition="contains">SHA256=2003b478b9fd1b3d76ec5bf4172c2e8915babbbee7ad1783794acbf8d4c2519d</Hashes>
+                <Hashes condition="contains">SHA256=60c6f4f34c7319cb3f9ca682e59d92711a05a2688badbae4891b1303cd384813</Hashes>
+                <Hashes condition="contains">SHA256=47eaebc920ccf99e09fc9924feb6b19b8a28589f52783327067c9b09754b5e84</Hashes>
+                <Hashes condition="contains">SHA256=0de4247e72d378713bcf22d5c5d3874d079203bb4364e25f67a90d5570bdcce8</Hashes>
+                <Hashes condition="contains">SHA256=1a42ebde59e8f63804eaa404f79ee93a16bb33d27fb158c6bfbe6143226899a0</Hashes>
+                <Hashes condition="contains">SHA256=76614f2e372f33100a8d92bf372cdbc1e183930ca747eed0b0cf2501293b990a</Hashes>
+                <Hashes condition="contains">SHA256=405472a8f9400a54bb29d03b436ccd58cfd6442fe686f6d2ed4f63f002854659</Hashes>
+                <Hashes condition="contains">SHA256=15fb486b6b8c2a2f1b067f48fba10c2f164638fe5e6cee618fb84463578ecac9</Hashes>
+                <Hashes condition="contains">SHA256=deecbcd260849178de421d8e2f177dce5c63cf67a48abb23a0e3cf3aa3e00578</Hashes>
+                <Hashes condition="contains">SHA256=08eb2d2aa25c5f0af4e72a7e0126735536f6c2c05e9c7437282171afe5e322c6</Hashes>
+                <Hashes condition="contains">SHA256=49329fa09f584d1960b09c1b15df18c0bc1c4fdb90bf48b6b5703e872040b668</Hashes>
+                <Hashes condition="contains">SHA256=c26b51b4c37330800cff8519252e110116c3aaade94ceb9894ec5bfb1b8f9924</Hashes>
+                <Hashes condition="contains">SHA256=7ec93f34eb323823eb199fbf8d06219086d517d0e8f4b9e348d7afd41ec9fd5d</Hashes>
+                <Hashes condition="contains">SHA256=4e37592a2a415f520438330c32cfbdbd6af594deef5290b2fa4b9722b898ff69</Hashes>
+                <Hashes condition="contains">SHA256=6f1fc8287dd8d724972d7a165683f2b2ad6837e16f09fe292714e8e38ecd1e38</Hashes>
+                <Hashes condition="contains">SHA256=85866e8c25d82c1ec91d7a8076c7d073cccf421cf57d9c83d80d63943a4edd94</Hashes>
+                <Hashes condition="contains">SHA256=6f1ff29e2e710f6d064dc74e8e011331d807c32cc2a622cbe507fd4b4d43f8f4</Hashes>
+                <Hashes condition="contains">SHA256=0cf6c6c2d231eaf67dfc87561cc9a56ecef89ab50baafee5a67962748d51faf3</Hashes>
+                <Hashes condition="contains">SHA256=fafa1bb36f0ac34b762a10e9f327dcab2152a6d0b16a19697362d49a31e7f566</Hashes>
+                <Hashes condition="contains">SHA256=bb50818a07b0eb1bd317467139b7eb4bad6cd89053fecdabfeae111689825955</Hashes>
+                <Hashes condition="contains">SHA256=4324f3d1e4007f6499a3d0f0102cd92ed9f554332bc0b633305cd7b957ff16c8</Hashes>
+                <Hashes condition="contains">SHA256=be54f7279e69fb7651f98e91d24069dbc7c4c67e65850e486622ccbdc44d9a57</Hashes>
+                <Hashes condition="contains">SHA256=845f1e228de249fc1ddf8dc28c39d03e8ad328a6277b6502d3932e83b879a65a</Hashes>
+                <Hashes condition="contains">SHA256=2a652de6b680d5ad92376ad323021850dab2c653abf06edf26120f7714b8e08a</Hashes>
+                <Hashes condition="contains">SHA256=8797d9afc7a6bb0933f100a8acbb5d0666ec691779d522ac66c66817155b1c0d</Hashes>
+                <Hashes condition="contains">SHA256=30abc0cc700fdebc74e62d574addc08f6227f9c7177d9eaa8cbc37d5c017c9bb</Hashes>
+                <Hashes condition="contains">SHA256=4d0580c20c1ba74cf90d44c82d040f0039542eea96e4bbff3996e6760f457cee</Hashes>
+                <Hashes condition="contains">SHA256=51e91dd108d974ae809e5fc23f6fbd16e13f672f86aa594dae4a5c4bc629b0b5</Hashes>
+                <Hashes condition="contains">SHA256=e81230217988f3e7ec6f89a06d231ec66039bdba340fd8ebb2bbb586506e3293</Hashes>
+                <Hashes condition="contains">SHA256=14adbf0bc43414a7700e5403100cff7fc6ade50bebfab16a17acf2fdda5a9da8</Hashes>
+                <Hashes condition="contains">SHA256=db90e554ad249c2bd888282ecf7d8da4d1538dd364129a3327b54f8242dd5653</Hashes>
+                <Hashes condition="contains">SHA256=a3e507e713f11901017fc328186ae98e23de7cea5594687480229f77d45848d8</Hashes>
+                <Hashes condition="contains">SHA256=65c26276cadda7a36f8977d1d01120edb5c3418be2317d501761092d5f9916c9</Hashes>
+                <Hashes condition="contains">SHA256=e3b257357be41a18319332df7023c4407e2b93ac4c9e0c6754032e29f3763eac</Hashes>
+                <Hashes condition="contains">SHA256=591bd5e92dfa0117b3daa29750e73e2db25baa717c31217539d30ffb1f7f3a52</Hashes>
+                <Hashes condition="contains">SHA256=16a2e578bc8683f17a175480fea4f53c838cfae965f1d4caa47eaf9e0b3415c1</Hashes>
+                <Hashes condition="contains">SHA256=97b32ddf83f75637e3ba934df117081dd6a1c57d47a4c9700d35e736da11d5bd</Hashes>
+                <Hashes condition="contains">SHA256=26453afb1f808f64bec87a2532a9361b696c0ed501d6b973a1f1b5ae152a4d40</Hashes>
+                <Hashes condition="contains">SHA256=ab0925398f3fa69a67eacee2bbb7b34ac395bb309df7fc7a9a9b8103ef41ed7a</Hashes>
+                <Hashes condition="contains">SHA256=7236c8ff33c0e5cfa956778aa7303f1979f3bf709c361399fa1ce101b7e355b8</Hashes>
+                <Hashes condition="contains">SHA256=4880f40f2e557cff38100620b9aa1a3a753cb693af16cd3d95841583edcb57a8</Hashes>
+                <Hashes condition="contains">SHA256=cc586254e9e89e88334adee44e332166119307e79c2f18f6c2ab90ce8ba7fc9b</Hashes>
+                <Hashes condition="contains">SHA256=3943a796cc7c5352aa57ccf544295bfd6fb69aae147bc8235a00202dc6ed6838</Hashes>
+                <Hashes condition="contains">SHA256=3fa6379951f08ed3cb87eeba9cf0c5f5e1d0317dcfcf003b810df9d795eeb73e</Hashes>
+                <Hashes condition="contains">SHA256=29a90ae1dcee66335ece4287a06482716530509912be863c85a2a03a6450a5b6</Hashes>
+                <Hashes condition="contains">SHA256=9a95a70f68144980f2d684e96c79bdc93ebca1587f46afae6962478631e85d0c</Hashes>
+                <Hashes condition="contains">SHA256=f744abb99c97d98e4cd08072a897107829d6d8481aee96c22443f626d00f4145</Hashes>
+                <Hashes condition="contains">SHA256=76660e91f1ff3cb89630df5af4fe09de6098d09baa66b1a130c89c3c5edd5b22</Hashes>
+                <Hashes condition="contains">SHA256=3a65d14fd3b1b5981084cdbd293dc6f4558911ea18dd80177d1e5b54d85bcaa0</Hashes>
+                <Hashes condition="contains">SHA256=0909005d625866ef8ccd8ae8af5745a469f4f70561b644d6e38b80bccb53eb06</Hashes>
+                <Hashes condition="contains">SHA256=be8dd2d39a527649e34dc77ef8bc07193a4234b38597b8f51e519dadc5479ec2</Hashes>
+                <Hashes condition="contains">SHA256=c64d4ac416363c7a1aa828929544d1c1d78cf032b39769943b851cfc4c0faafc</Hashes>
+                <Hashes condition="contains">SHA256=8939116df1d6c8fd0ebd14b2d37b3dec38a8820aa666ecd487bc1bb794f2a587</Hashes>
+                <Hashes condition="contains">SHA256=1e8b0c1966e566a523d652e00f7727d8b0663f1dfdce3b9a09b9adfaef48d8ee</Hashes>
+                <Hashes condition="contains">SHA256=55963284bbd5a3297f39f12f0d8a01ed99fe59d008561e3537bcd4db4b4268fa</Hashes>
+			</FileExecutableDetected>
+		</RuleGroup>
+
 	</EventFiltering>
 </Sysmon>

From f10d77f5e903def4097e295375ac5dde4d10a5f9 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Wed, 28 Jun 2023 22:35:58 +0200
Subject: [PATCH 141/149] Update sysmonconfig-export.xml

---
 sysmonconfig-export.xml | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 09429012..34064a05 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -1410,10 +1410,7 @@
 			<TargetFilename condition="contains all">C:\Users\;\Pictures\</TargetFilename> <!-- often used staging directories in User folders --> 
 			<TargetFilename condition="contains all">C:\Users\;\Videos\</TargetFilename> <!-- often used staging directories in User folders --> 
 			<TargetFilename condition="contains all">C:\Users\;\Contacts\</TargetFilename> <!-- often used staging directories in User folders -->
-			<!-- Executables dropped to disk : softer matches -->
-			<TargetFilename condition="contains">\Appdata\Local\Temp\</TargetFilename> <!--User Temp folder-->
-			<TargetFilename condition="contains">\Appdata\Local\Microsoft\Windows\INetCache\Content.Outlook\</TargetFilename> <!--Microsoft Outlook Temp folder-->
-			
+
 			<!-- Executables double extensions -->
 			<TargetFilename condition="end with">.pdf.exe</TargetFilename>
 			<TargetFilename condition="end with">.doc.exe</TargetFilename>

From bc734a5c3dbc98868df9453d60ad236b6d930d8d Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Wed, 28 Jun 2023 22:46:10 +0200
Subject: [PATCH 142/149] fix: increase allowance for trace runs

---
 .github/workflows/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index ed2cc487..bab15675 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -45,7 +45,7 @@ jobs:
       shell: powershell
 
     - name: Check Eventcount
-      run:  '$EventCount = 0 ;Get-WinEvent -ListLog Microsoft-Windows-Sysmon* | where {$_.RecordCount -gt 0} | foreach{$_;$EventCount = $EventCount + $_.RecordCount}|Out-Null;"Eventcount: "+$EventCount; if ($EventCount -gt 2000){ Write-Output "Too many events"; $host.SetShouldExit(1)}'
+      run:  '$EventCount = 0 ;Get-WinEvent -ListLog Microsoft-Windows-Sysmon* | where {$_.RecordCount -gt 0} | foreach{$_;$EventCount = $EventCount + $_.RecordCount}|Out-Null;"Eventcount: "+$EventCount; if ($EventCount -gt 15000){ Write-Output "Too many events"; $host.SetShouldExit(1)}'
       shell: powershell
 
   msbuild-block:

From 21205e9ef4a1bf5a5f4f7d41e8c12cfa9460397b Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Wed, 28 Jun 2023 23:10:32 +0200
Subject: [PATCH 143/149] feat: blocked config

---
 sysmonconfig-export-block.xml | 1589 +++++++++++++++++++++++++++++++++
 sysmonconfig-export.xml       |    6 +
 2 files changed, 1595 insertions(+)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 42c1c9f1..9680db71 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -1531,5 +1531,1594 @@
 		</FileBlockExecutable>
 	</RuleGroup>
 
+
+	<!-- LOL DRIVER Sysmon Rules -->
+		<!--COMMENT: The following rule groups were imported from the LOLDrivers project
+
+			Note: We use only the SHA256 hash of the drivers for performance reasons, since this config generates MD5 and SHA256 hashes (see <HashAlgorithms>)
+
+			What happens: 
+				- Malicious driver load > report only
+				- Malicious driver drop > block
+				- Vulnerable driver load > report only
+				- Vulnerable driver drop > report only
+
+			Syncronisation date: 28.06.2023
+			[ https://github.com/magicsword-io/LOLDrivers/tree/main/detections/sysmon ]
+		-->
+
+		<RuleGroup name="Malicious Driver Load" groupRelation="or">
+			<DriverLoad onmatch="include">
+                <Hashes condition="contains">SHA256=56066ed07bad3b5c1474e8fae5ee2543d17d7977369b34450bd0775517e3b25c</Hashes>
+                <Hashes condition="contains">SHA256=06a0ec9a316eb89cb041b1907918e3ad3b03842ec65f004f6fa74d57955573a4</Hashes>
+                <Hashes condition="contains">SHA256=86047bb1969d1db455493955fd450d18c62a3f36294d0a6c3732c88dfbcc4f62</Hashes>
+                <Hashes condition="contains">SHA256=06c5ebd0371342d18bc81a96f5e5ce28de64101e3c2fd0161d0b54d8368d2f1f</Hashes>
+                <Hashes condition="contains">SHA256=8dafe5f3d0527b66f6857559e3c81872699003e0f2ffda9202a1b5e29db2002e</Hashes>
+                <Hashes condition="contains">SHA256=81c7bb39100d358f8286da5e9aa838606c98dfcc263e9a82ed91cd438cb130d1</Hashes>
+                <Hashes condition="contains">SHA256=6661320f779337b95bbbe1943ee64afb2101c92f92f3d1571c1bf4201c38c724</Hashes>
+                <Hashes condition="contains">SHA256=ea50f22daade04d3ca06dedb497b905215cba31aae7b4cab4b533fda0c5be620</Hashes>
+                <Hashes condition="contains">SHA256=0440ef40c46fdd2b5d86e7feef8577a8591de862cfd7928cdbcc8f47b8fa3ffc</Hashes>
+                <Hashes condition="contains">SHA256=c0d88db11d0f529754d290ed5f4c34b4dba8c4f2e5c4148866daabeab0d25f9c</Hashes>
+                <Hashes condition="contains">SHA256=e1cb86386757b947b39086cc8639da988f6e8018ca9995dd669bdc03c8d39d7d</Hashes>
+                <Hashes condition="contains">SHA256=18c909a2b8c5e16821d6ef908f56881aa0ecceeaccb5fa1e54995935fcfd12f7</Hashes>
+                <Hashes condition="contains">SHA256=139f8412a7c6fdc43dcfbbcdba256ee55654eb36a40f338249d5162a1f69b988</Hashes>
+                <Hashes condition="contains">SHA256=b0eb4d999e4e0e7c2e33ff081e847c87b49940eb24a9e0794c6aa9516832c427</Hashes>
+                <Hashes condition="contains">SHA256=1485c0ed3e875cbdfc6786a5bd26d18ea9d31727deb8df290a1c00c780419a4e</Hashes>
+                <Hashes condition="contains">SHA256=6b5cf41512255237064e9274ca8f8a3fef820c45aa6067c9c6a0e6f5751a0421</Hashes>
+                <Hashes condition="contains">SHA256=0d10c4b2f56364b475b60bd2933273c8b1ed2176353e59e65f968c61e93b7d99</Hashes>
+                <Hashes condition="contains">SHA256=ad938d15ecfd70083c474e1642a88b078c3cea02cdbddf66d4fb1c01b9b29d9a</Hashes>
+                <Hashes condition="contains">SHA256=89698cad598a56f9e45efffd15d1841e494a2409cc12279150a03842cd6bb7f3</Hashes>
+                <Hashes condition="contains">SHA256=5f6fec8f7890d032461b127332759c88a1b7360aa10c6bd38482572f59d2ba8b</Hashes>
+                <Hashes condition="contains">SHA256=fa9abb3e7e06f857be191a1e049dd37642ec41fb2520c105df2227fcac3de5d5</Hashes>
+                <Hashes condition="contains">SHA256=05b146a48a69dd62a02759487e769bd30d39f16374bc76c86453b4ae59e7ffa4</Hashes>
+                <Hashes condition="contains">SHA256=6994b32e3f3357f4a1d0abe81e8b62dd54e36b17816f2f1a80018584200a1b77</Hashes>
+                <Hashes condition="contains">SHA256=6908ebf52eb19c6719a0b508d1e2128f198d10441551cbfb9f4031d382f5229f</Hashes>
+                <Hashes condition="contains">SHA256=32882949ea084434a376451ff8364243a50485a3b4af2f2240bb5f20c164543d</Hashes>
+                <Hashes condition="contains">SHA256=fd223833abffa9cd6cc1848d77599673643585925a7ee51259d67c44d361cce8</Hashes>
+                <Hashes condition="contains">SHA256=6839fcae985774427c65fe38e773aa96ec451a412caa5354ad9e2b9b54ffe6c1</Hashes>
+                <Hashes condition="contains">SHA256=f9f2091fccb289bcf6a945f6b38676ec71dedb32f3674262928ccaf840ca131a</Hashes>
+                <Hashes condition="contains">SHA256=7a7e8df7173387aec593e4fe2b45520ea3156c5f810d2bb1b2784efd1c922376</Hashes>
+                <Hashes condition="contains">SHA256=96bf3ee7c6673b69c6aa173bb44e21fa636b1c2c73f4356a7599c121284a51cc</Hashes>
+                <Hashes condition="contains">SHA256=b9dad0131c51e2645e761b74a71ebad2bf175645fa9f42a4ab0e6921b83306e3</Hashes>
+                <Hashes condition="contains">SHA256=e6a7b0bc01a627a7d0ffb07faddb3a4dd96b6f5208ac26107bdaeb3ab1ec8217</Hashes>
+                <Hashes condition="contains">SHA256=200f98655d1f46d2599c2c8605ebb7e335fee3883a32135ca1a81e09819bc64a</Hashes>
+                <Hashes condition="contains">SHA256=8d9a2363b757d3f127b9c6ed8f7b8b018e652369bc070aa3500b3a978feaa6ce</Hashes>
+                <Hashes condition="contains">SHA256=c8f9e1ad7b8cce62fba349a00bc168c849d42cfb2ca5b2c6cc4b51d054e0c497</Hashes>
+                <Hashes condition="contains">SHA256=23e89fd30a1c7db37f3ea81b779ce9acf8a4294397cbb54cff350d54afcfd931</Hashes>
+                <Hashes condition="contains">SHA256=575e58b62afab094c20c296604dc3b7dd2e1a50f5978d8ee24b7dca028e97316</Hashes>
+                <Hashes condition="contains">SHA256=5b932eab6c67f62f097a3249477ac46d80ddccdc52654f8674060b4ddf638e5d</Hashes>
+                <Hashes condition="contains">SHA256=e6f764c3b5580cd1675cbf184938ad5a201a8c096607857869bd7c3399df0d12</Hashes>
+                <Hashes condition="contains">SHA256=9bb09752cf3a464455422909edef518ac18fe63cf5e1e8d9d6c2e68db62e0c87</Hashes>
+                <Hashes condition="contains">SHA256=f8236fc01d4efaa48f032e301be2ebba4036b2cd945982a29046eca03944d2ae</Hashes>
+                <Hashes condition="contains">SHA256=e7af7bcb86bd6bab1835f610671c3921441965a839673ac34444cf0ce7b2164e</Hashes>
+                <Hashes condition="contains">SHA256=9b1b15a3aacb0e786a608726c3abfc94968915cedcbd239ddf903c4a54bfcf0c</Hashes>
+                <Hashes condition="contains">SHA256=f936ec4c8164cbd31add659b61c16cb3a717eac90e74d89c47afb96b60120280</Hashes>
+                <Hashes condition="contains">SHA256=9c2f3e9811f7d0c7463eaa1ee6f39c23f902f3797b80891590b43bbe0fdf0e51</Hashes>
+                <Hashes condition="contains">SHA256=b8807e365be2813b7eccd2e4c49afb0d1e131086715638b7a6307cd7d7e9556c</Hashes>
+                <Hashes condition="contains">SHA256=50819a1add4c81c0d53203592d6803f022443440935ff8260ff3b6d5253c0c76</Hashes>
+                <Hashes condition="contains">SHA256=52d5c35325ce701516f8b04380c9fbdb78ec6bcc13b444f758fdb03d545b0677</Hashes>
+                <Hashes condition="contains">SHA256=7f4555a940ce1156c9bcea9a2a0b801f9a5e44ec9400b61b14a7b1a6404ffdf6</Hashes>
+                <Hashes condition="contains">SHA256=8e035beb02a411f8a9e92d4cf184ad34f52bbd0a81a50c222cdd4706e4e45104</Hashes>
+                <Hashes condition="contains">SHA256=8578bff36e3b02cc71495b647db88c67c3c5ca710b5a2bd539148550595d0330</Hashes>
+                <Hashes condition="contains">SHA256=4734a0a5d88f44a4939b8d812364cab6ca5f611b9b8ceebe27df6c1ed3a6d8a4</Hashes>
+                <Hashes condition="contains">SHA256=88076e98d45ed3adf0c5355411fe8ca793eb7cec1a1c61f5e1ec337eae267463</Hashes>
+                <Hashes condition="contains">SHA256=749b0e8c8c8b7dda8c2063c708047cfe95afa0a4d86886b31a12f3018396e67c</Hashes>
+                <Hashes condition="contains">SHA256=49c827cf48efb122a9d6fd87b426482b7496ccd4a2dbca31ebbf6b2b80c98530</Hashes>
+                <Hashes condition="contains">SHA256=d7c81b0f3c14844f6424e8bdd31a128e773cb96cccef6d05cbff473f0ccb9f9c</Hashes>
+                <Hashes condition="contains">SHA256=f6c316e2385f2694d47e936b0ac4bc9b55e279d530dd5e805f0d963cb47c3c0d</Hashes>
+                <Hashes condition="contains">SHA256=5c1585b1a1c956c7755429544f3596515dfdf928373620c51b0606a520c6245a</Hashes>
+                <Hashes condition="contains">SHA256=5bc3994612624da168750455b363f2964e1861dba4f1c305df01b970ac02a7ae</Hashes>
+                <Hashes condition="contains">SHA256=bb2422e96ea993007f25c71d55b2eddfa1e940c89e895abb50dd07d7c17ca1df</Hashes>
+                <Hashes condition="contains">SHA256=42b22faa489b5de936db33f12184f6233198bdf851a18264d31210207827ba25</Hashes>
+                <Hashes condition="contains">SHA256=f461414a2596555cece5cfee65a3c22648db0082ca211f6238af8230e41b3212</Hashes>
+                <Hashes condition="contains">SHA256=770f33259d6fb10f4a32d8a57d0d12953e8455c72bb7b60cb39ce505c507013a</Hashes>
+			</DriverLoad>
+		</RuleGroup>
+
+		<RuleGroup name="Malicious Driver Blocked" groupRelation="or">
+			<FileBlockExecutable onmatch="include">
+                <Hashes condition="contains">SHA256=56066ed07bad3b5c1474e8fae5ee2543d17d7977369b34450bd0775517e3b25c</Hashes>
+                <Hashes condition="contains">SHA256=06a0ec9a316eb89cb041b1907918e3ad3b03842ec65f004f6fa74d57955573a4</Hashes>
+                <Hashes condition="contains">SHA256=86047bb1969d1db455493955fd450d18c62a3f36294d0a6c3732c88dfbcc4f62</Hashes>
+                <Hashes condition="contains">SHA256=06c5ebd0371342d18bc81a96f5e5ce28de64101e3c2fd0161d0b54d8368d2f1f</Hashes>
+                <Hashes condition="contains">SHA256=8dafe5f3d0527b66f6857559e3c81872699003e0f2ffda9202a1b5e29db2002e</Hashes>
+                <Hashes condition="contains">SHA256=81c7bb39100d358f8286da5e9aa838606c98dfcc263e9a82ed91cd438cb130d1</Hashes>
+                <Hashes condition="contains">SHA256=6661320f779337b95bbbe1943ee64afb2101c92f92f3d1571c1bf4201c38c724</Hashes>
+                <Hashes condition="contains">SHA256=ea50f22daade04d3ca06dedb497b905215cba31aae7b4cab4b533fda0c5be620</Hashes>
+                <Hashes condition="contains">SHA256=0440ef40c46fdd2b5d86e7feef8577a8591de862cfd7928cdbcc8f47b8fa3ffc</Hashes>
+                <Hashes condition="contains">SHA256=c0d88db11d0f529754d290ed5f4c34b4dba8c4f2e5c4148866daabeab0d25f9c</Hashes>
+                <Hashes condition="contains">SHA256=e1cb86386757b947b39086cc8639da988f6e8018ca9995dd669bdc03c8d39d7d</Hashes>
+                <Hashes condition="contains">SHA256=18c909a2b8c5e16821d6ef908f56881aa0ecceeaccb5fa1e54995935fcfd12f7</Hashes>
+                <Hashes condition="contains">SHA256=139f8412a7c6fdc43dcfbbcdba256ee55654eb36a40f338249d5162a1f69b988</Hashes>
+                <Hashes condition="contains">SHA256=b0eb4d999e4e0e7c2e33ff081e847c87b49940eb24a9e0794c6aa9516832c427</Hashes>
+                <Hashes condition="contains">SHA256=1485c0ed3e875cbdfc6786a5bd26d18ea9d31727deb8df290a1c00c780419a4e</Hashes>
+                <Hashes condition="contains">SHA256=6b5cf41512255237064e9274ca8f8a3fef820c45aa6067c9c6a0e6f5751a0421</Hashes>
+                <Hashes condition="contains">SHA256=0d10c4b2f56364b475b60bd2933273c8b1ed2176353e59e65f968c61e93b7d99</Hashes>
+                <Hashes condition="contains">SHA256=ad938d15ecfd70083c474e1642a88b078c3cea02cdbddf66d4fb1c01b9b29d9a</Hashes>
+                <Hashes condition="contains">SHA256=89698cad598a56f9e45efffd15d1841e494a2409cc12279150a03842cd6bb7f3</Hashes>
+                <Hashes condition="contains">SHA256=5f6fec8f7890d032461b127332759c88a1b7360aa10c6bd38482572f59d2ba8b</Hashes>
+                <Hashes condition="contains">SHA256=fa9abb3e7e06f857be191a1e049dd37642ec41fb2520c105df2227fcac3de5d5</Hashes>
+                <Hashes condition="contains">SHA256=05b146a48a69dd62a02759487e769bd30d39f16374bc76c86453b4ae59e7ffa4</Hashes>
+                <Hashes condition="contains">SHA256=6994b32e3f3357f4a1d0abe81e8b62dd54e36b17816f2f1a80018584200a1b77</Hashes>
+                <Hashes condition="contains">SHA256=6908ebf52eb19c6719a0b508d1e2128f198d10441551cbfb9f4031d382f5229f</Hashes>
+                <Hashes condition="contains">SHA256=32882949ea084434a376451ff8364243a50485a3b4af2f2240bb5f20c164543d</Hashes>
+                <Hashes condition="contains">SHA256=fd223833abffa9cd6cc1848d77599673643585925a7ee51259d67c44d361cce8</Hashes>
+                <Hashes condition="contains">SHA256=6839fcae985774427c65fe38e773aa96ec451a412caa5354ad9e2b9b54ffe6c1</Hashes>
+                <Hashes condition="contains">SHA256=f9f2091fccb289bcf6a945f6b38676ec71dedb32f3674262928ccaf840ca131a</Hashes>
+                <Hashes condition="contains">SHA256=7a7e8df7173387aec593e4fe2b45520ea3156c5f810d2bb1b2784efd1c922376</Hashes>
+                <Hashes condition="contains">SHA256=96bf3ee7c6673b69c6aa173bb44e21fa636b1c2c73f4356a7599c121284a51cc</Hashes>
+                <Hashes condition="contains">SHA256=b9dad0131c51e2645e761b74a71ebad2bf175645fa9f42a4ab0e6921b83306e3</Hashes>
+                <Hashes condition="contains">SHA256=e6a7b0bc01a627a7d0ffb07faddb3a4dd96b6f5208ac26107bdaeb3ab1ec8217</Hashes>
+                <Hashes condition="contains">SHA256=200f98655d1f46d2599c2c8605ebb7e335fee3883a32135ca1a81e09819bc64a</Hashes>
+                <Hashes condition="contains">SHA256=8d9a2363b757d3f127b9c6ed8f7b8b018e652369bc070aa3500b3a978feaa6ce</Hashes>
+                <Hashes condition="contains">SHA256=c8f9e1ad7b8cce62fba349a00bc168c849d42cfb2ca5b2c6cc4b51d054e0c497</Hashes>
+                <Hashes condition="contains">SHA256=23e89fd30a1c7db37f3ea81b779ce9acf8a4294397cbb54cff350d54afcfd931</Hashes>
+                <Hashes condition="contains">SHA256=575e58b62afab094c20c296604dc3b7dd2e1a50f5978d8ee24b7dca028e97316</Hashes>
+                <Hashes condition="contains">SHA256=5b932eab6c67f62f097a3249477ac46d80ddccdc52654f8674060b4ddf638e5d</Hashes>
+                <Hashes condition="contains">SHA256=e6f764c3b5580cd1675cbf184938ad5a201a8c096607857869bd7c3399df0d12</Hashes>
+                <Hashes condition="contains">SHA256=9bb09752cf3a464455422909edef518ac18fe63cf5e1e8d9d6c2e68db62e0c87</Hashes>
+                <Hashes condition="contains">SHA256=f8236fc01d4efaa48f032e301be2ebba4036b2cd945982a29046eca03944d2ae</Hashes>
+                <Hashes condition="contains">SHA256=e7af7bcb86bd6bab1835f610671c3921441965a839673ac34444cf0ce7b2164e</Hashes>
+                <Hashes condition="contains">SHA256=9b1b15a3aacb0e786a608726c3abfc94968915cedcbd239ddf903c4a54bfcf0c</Hashes>
+                <Hashes condition="contains">SHA256=f936ec4c8164cbd31add659b61c16cb3a717eac90e74d89c47afb96b60120280</Hashes>
+                <Hashes condition="contains">SHA256=9c2f3e9811f7d0c7463eaa1ee6f39c23f902f3797b80891590b43bbe0fdf0e51</Hashes>
+                <Hashes condition="contains">SHA256=b8807e365be2813b7eccd2e4c49afb0d1e131086715638b7a6307cd7d7e9556c</Hashes>
+                <Hashes condition="contains">SHA256=50819a1add4c81c0d53203592d6803f022443440935ff8260ff3b6d5253c0c76</Hashes>
+                <Hashes condition="contains">SHA256=52d5c35325ce701516f8b04380c9fbdb78ec6bcc13b444f758fdb03d545b0677</Hashes>
+                <Hashes condition="contains">SHA256=7f4555a940ce1156c9bcea9a2a0b801f9a5e44ec9400b61b14a7b1a6404ffdf6</Hashes>
+                <Hashes condition="contains">SHA256=8e035beb02a411f8a9e92d4cf184ad34f52bbd0a81a50c222cdd4706e4e45104</Hashes>
+                <Hashes condition="contains">SHA256=8578bff36e3b02cc71495b647db88c67c3c5ca710b5a2bd539148550595d0330</Hashes>
+                <Hashes condition="contains">SHA256=4734a0a5d88f44a4939b8d812364cab6ca5f611b9b8ceebe27df6c1ed3a6d8a4</Hashes>
+                <Hashes condition="contains">SHA256=88076e98d45ed3adf0c5355411fe8ca793eb7cec1a1c61f5e1ec337eae267463</Hashes>
+                <Hashes condition="contains">SHA256=749b0e8c8c8b7dda8c2063c708047cfe95afa0a4d86886b31a12f3018396e67c</Hashes>
+                <Hashes condition="contains">SHA256=49c827cf48efb122a9d6fd87b426482b7496ccd4a2dbca31ebbf6b2b80c98530</Hashes>
+                <Hashes condition="contains">SHA256=d7c81b0f3c14844f6424e8bdd31a128e773cb96cccef6d05cbff473f0ccb9f9c</Hashes>
+                <Hashes condition="contains">SHA256=f6c316e2385f2694d47e936b0ac4bc9b55e279d530dd5e805f0d963cb47c3c0d</Hashes>
+                <Hashes condition="contains">SHA256=5c1585b1a1c956c7755429544f3596515dfdf928373620c51b0606a520c6245a</Hashes>
+                <Hashes condition="contains">SHA256=5bc3994612624da168750455b363f2964e1861dba4f1c305df01b970ac02a7ae</Hashes>
+                <Hashes condition="contains">SHA256=bb2422e96ea993007f25c71d55b2eddfa1e940c89e895abb50dd07d7c17ca1df</Hashes>
+                <Hashes condition="contains">SHA256=42b22faa489b5de936db33f12184f6233198bdf851a18264d31210207827ba25</Hashes>
+                <Hashes condition="contains">SHA256=f461414a2596555cece5cfee65a3c22648db0082ca211f6238af8230e41b3212</Hashes>
+                <Hashes condition="contains">SHA256=770f33259d6fb10f4a32d8a57d0d12953e8455c72bb7b60cb39ce505c507013a</Hashes>
+			</FileBlockExecutable>
+		</RuleGroup>
+
+		<RuleGroup name="Vulnerable Driver Load" groupRelation="or">
+			<DriverLoad onmatch="include">
+                <Hashes condition="contains">SHA256=7ad0ab23023bc500c3b46f414a8b363c5f8700861bc4745cecc14dd34bcee9ed</Hashes>
+                <Hashes condition="contains">SHA256=9529efb1837b1005e5e8f477773752078e0a46500c748bc30c9b5084d04082e6</Hashes>
+                <Hashes condition="contains">SHA256=0bc3685b0b8adc97931b5d31348da235cd7581a67edf6d79913e6a5709866135</Hashes>
+                <Hashes condition="contains">SHA256=ce23c2dae4cca4771ea50ec737093dfafac06c64db0f924a1ccbbf687e33f5a2</Hashes>
+                <Hashes condition="contains">SHA256=b1334a71cc73b3d0c54f62d8011bec330dfc355a239bf94a121f6e4c86a30a2e</Hashes>
+                <Hashes condition="contains">SHA256=4da08c0681fbe028b60a1eaf5cb8890bd3eba4d0e6a8b976495ddcd315e147ba</Hashes>
+                <Hashes condition="contains">SHA256=45c3d607cb57a1714c1c604a25cbadf2779f4734855d0e43aa394073b6966b26</Hashes>
+                <Hashes condition="contains">SHA256=b1d96233235a62dbb21b8dbe2d1ae333199669f67664b107bff1ad49b41d9414</Hashes>
+                <Hashes condition="contains">SHA256=bcfc2c9883e6c1b8429be44cc4db988a9eecb544988fbd756d18cfca6201876f</Hashes>
+                <Hashes condition="contains">SHA256=eea53103e7a5a55dc1df79797395a2a3e96123ebd71cdd2db4b1be80e7b3f02b</Hashes>
+                <Hashes condition="contains">SHA256=c725919e6357126d512c638f993cf572112f323da359645e4088f789eb4c7b8c</Hashes>
+                <Hashes condition="contains">SHA256=42f0b036687cbd7717c9efed6991c00d4e3e7b032dc965a2556c02177dfdad0f</Hashes>
+                <Hashes condition="contains">SHA256=3326e2d32bbabd69feb6024809afc56c7e39241ebe70a53728c77e80995422a5</Hashes>
+                <Hashes condition="contains">SHA256=76e807b6c0214e66455f09a8de8faad40b738982ca84470f0043de0290449524</Hashes>
+                <Hashes condition="contains">SHA256=7aaf2aa194b936e48bc90f01ee854768c8383c0be50cfb41b346666aec0cf853</Hashes>
+                <Hashes condition="contains">SHA256=cb57f3a7fe9e1f8e63332c563b0a319b26c944be839eabc03e9a3277756ba612</Hashes>
+                <Hashes condition="contains">SHA256=84bf1d0bcdf175cfe8aea2973e0373015793d43907410ae97e2071b2c4b8e2d4</Hashes>
+                <Hashes condition="contains">SHA256=16768203a471a19ebb541c942f45716e9f432985abbfbe6b4b7d61a798cea354</Hashes>
+                <Hashes condition="contains">SHA256=fd8669794c67b396c12fc5f08e9c004fdf851a82faf302846878173e4fbecb03</Hashes>
+                <Hashes condition="contains">SHA256=362c4f3dadc9c393682664a139d65d80e32caa2a97b6e0361dfd713a73267ecc</Hashes>
+                <Hashes condition="contains">SHA256=04a85e359525d662338cae86c1e59b1d7aa9bd12b920e8067503723dc1e03162</Hashes>
+                <Hashes condition="contains">SHA256=49ed27460730b62403c1d2e4930573121ab0c86c442854bc0a62415ca445a810</Hashes>
+                <Hashes condition="contains">SHA256=8c95d28270a4a314299cf50f05dcbe63033b2a555195d2ad2f678e09e00393e6</Hashes>
+                <Hashes condition="contains">SHA256=ff9623317287358440ec67da9ba79994d9b17b99ffdd709ec836478fe1fc22a5</Hashes>
+                <Hashes condition="contains">SHA256=b61869b7945be062630f1dd4bae919aecee8927f7e1bc3954a21ff763f4c0867</Hashes>
+                <Hashes condition="contains">SHA256=dbc604b4e01362a3e51357af4a87686834fe913852a4e0a8c0d4c1a0f7d076ed</Hashes>
+                <Hashes condition="contains">SHA256=a961f5939088238d76757669a9a81905e33f247c9c635b908daac146ae063499</Hashes>
+                <Hashes condition="contains">SHA256=e5b0772be02e2bc807804874cf669e97aa36f5aff1f12fa0a631a3c7b4dd0dc8</Hashes>
+                <Hashes condition="contains">SHA256=aebcbfca180e372a048b682a4859fd520c98b5b63f6e3a627c626cb35adc0399</Hashes>
+                <Hashes condition="contains">SHA256=4e3eb5b9bce2fd9f6878ae36288211f0997f6149aa8c290ed91228ba4cdfae80</Hashes>
+                <Hashes condition="contains">SHA256=1a4f7d7926efc3e3488758ce318246ea78a061bde759ec6c906ff005dd8213e5</Hashes>
+                <Hashes condition="contains">SHA256=f929bead59e9424ab90427b379dcdd63fbfe0c4fb5e1792e3a1685541cd5ec65</Hashes>
+                <Hashes condition="contains">SHA256=7b0f442ac0bb183906700097d65aed0b4b9d8678f9a01aca864854189fe368e7</Hashes>
+                <Hashes condition="contains">SHA256=c344e92a6d06155a217a9af7b4b35e6653665eec6569292e7b2e70f3a3027646</Hashes>
+                <Hashes condition="contains">SHA256=8cfd5b2102fbc77018c7fe6019ec15f07da497f6d73c32a31f4ba07e67ec85d9</Hashes>
+                <Hashes condition="contains">SHA256=99f4994a0e5bd1bf6e3f637d3225c69ff4cd620557e23637533e7f18d7d6cba1</Hashes>
+                <Hashes condition="contains">SHA256=89b9823ed974a5b71de8468324d45b7e9d6dc914f93615ba86c6209b25b3cbf7</Hashes>
+                <Hashes condition="contains">SHA256=d5586dc1e61796a9ae5e5d1ced397874753056c3df2eb963a8916287e1929a71</Hashes>
+                <Hashes condition="contains">SHA256=36b9e31240ab0341873c7092b63e2e0f2cab2962ebf9b25271c3a1216b7669eb</Hashes>
+                <Hashes condition="contains">SHA256=0b2ad05939b0aabbdc011082fad7960baa0c459ec16a2b29f37c1fa31795a46d</Hashes>
+                <Hashes condition="contains">SHA256=30706f110725199e338e9cc1c940d9a644d19a14f0eb8847712cba4cacda67ab</Hashes>
+                <Hashes condition="contains">SHA256=af1011c76a22af7be97a0b3e0ce11aca0509820c59fa7c8eeaaa1b2c0225f75a</Hashes>
+                <Hashes condition="contains">SHA256=8c748ae5dcc10614cc134064c99367d28f3131d1f1dda0c9c29e99279dc1bdd9</Hashes>
+                <Hashes condition="contains">SHA256=cbb8239a765bf5b2c1b6a5c8832d2cab8fef5deacadfb65d8ed43ef56d291ab6</Hashes>
+                <Hashes condition="contains">SHA256=025e7be9fcefd6a83f4471bba0c11f1c11bd5047047d26626da24ee9a419cdc4</Hashes>
+                <Hashes condition="contains">SHA256=d5562fb90b0b3deb633ab335bcbd82ce10953466a428b3f27cb5b226b453eaf3</Hashes>
+                <Hashes condition="contains">SHA256=900dd68ccc72d73774a347b3290c4b6153ae496a81de722ebb043e2e99496f88</Hashes>
+                <Hashes condition="contains">SHA256=a566af57d88f37fa033e64b1d8abbd3ffdacaba260475fbbc8dab846a824eff5</Hashes>
+                <Hashes condition="contains">SHA256=86721ee8161096348ed3dbe1ccbf933ae004c315b1691745a8af4a0df9fed675</Hashes>
+                <Hashes condition="contains">SHA256=d205286bffdf09bc033c09e95c519c1c267b40c2ee8bab703c6a2d86741ccd3e</Hashes>
+                <Hashes condition="contains">SHA256=a5a50449e2cc4d0dbc80496f757935ae38bf8a1bebdd6555a3495d8c219df2ad</Hashes>
+                <Hashes condition="contains">SHA256=ece0a900ea089e730741499614c0917432246ceb5e11599ee3a1bb679e24fd2c</Hashes>
+                <Hashes condition="contains">SHA256=881bca6dc2dafe1ae18aeb59216af939a3ac37248c13ed42ad0e1048a3855461</Hashes>
+                <Hashes condition="contains">SHA256=aafb95a443911e4c67d4e45ffa83cca103c91b42915b81100534dc439bec0c1b</Hashes>
+                <Hashes condition="contains">SHA256=cf69704755ec2643dfd245ae1d4e15d77f306aeb1a576ffa159453de1a7345cb</Hashes>
+                <Hashes condition="contains">SHA256=e4522e2cfa0b1f5d258a3cf85b87681d6969e0572f668024c465d635c236b5d9</Hashes>
+                <Hashes condition="contains">SHA256=600a2119657973112025db3c0eeab2e69d528bccfeed75f40c6ef50b059ec8a0</Hashes>
+                <Hashes condition="contains">SHA256=65329dad28e92f4bcc64de15c552b6ef424494028b18875b7dba840053bc0cdd</Hashes>
+                <Hashes condition="contains">SHA256=78827fa00ea48d96ac9af8d1c1e317d02ce11793e7f7f6e4c7aac7b5d7dd490f</Hashes>
+                <Hashes condition="contains">SHA256=cdd2a4575a46bada4837a6153a79c14d60ee3129830717ef09e0e3efd9d00812</Hashes>
+                <Hashes condition="contains">SHA256=42851a01469ba97cdc38939b10cf9ea13237aa1f6c37b1ac84904c5a12a81fa0</Hashes>
+                <Hashes condition="contains">SHA256=3d23bdbaf9905259d858df5bf991eb23d2dc9f4ecda7f9f77839691acef1b8c4</Hashes>
+                <Hashes condition="contains">SHA256=6e944ae1bfe43a8a7cd2ea65e518a30172ce8f31223bdfd39701b2cb41d8a9e7</Hashes>
+                <Hashes condition="contains">SHA256=1ddfe4756f5db9fb319d6c6da9c41c588a729d9e7817190b027b38e9c076d219</Hashes>
+                <Hashes condition="contains">SHA256=f84f8173242b95f9f3c4fea99b5555b33f9ce37ca8188b643871d261cb081496</Hashes>
+                <Hashes condition="contains">SHA256=32e1a8513eee746d17eb5402fb9d8ff9507fb6e1238e7ff06f7a5c50ff3df993</Hashes>
+                <Hashes condition="contains">SHA256=c9014b03866bf37faa8fdb16b6af7cfec976aaef179fd5797d0c0bf8079d3a8c</Hashes>
+                <Hashes condition="contains">SHA256=79e87b93fbed84ec09261b3a0145c935f7dfe4d4805edfb563b2f971a0d51463</Hashes>
+                <Hashes condition="contains">SHA256=ebe2e9ec6d5d94c2d58fbcc9d78c5f0ee7a2f2c1aed6d1b309f383186d11dfa3</Hashes>
+                <Hashes condition="contains">SHA256=9a523854fe84f15efc1635d7f5d3e71812c45d6a4d2c99c29fdc4b4d9c84954c</Hashes>
+                <Hashes condition="contains">SHA256=2ef7df384e93951893b65500dac6ee09da6b8fe9128326caad41b8be4da49a1e</Hashes>
+                <Hashes condition="contains">SHA256=2ce81759bfa236913bbbb9b2cbc093140b099486fd002910b18e2c6e31fdc4f1</Hashes>
+                <Hashes condition="contains">SHA256=909de5f21837ea2b13fdc4e5763589e6bdedb903f7c04e1d0b08776639774880</Hashes>
+                <Hashes condition="contains">SHA256=c8940e2e9b069ec94f9f711150b313b437f8429f78d522810601b6ee8b52bada</Hashes>
+                <Hashes condition="contains">SHA256=075de997497262a9d105afeadaaefc6348b25ce0e0126505c24aa9396c251e85</Hashes>
+                <Hashes condition="contains">SHA256=e68d453d333854787f8470c8baef3e0d082f26df5aa19c0493898bcf3401e39a</Hashes>
+                <Hashes condition="contains">SHA256=3390919bb28d5c36cc348f9ef23be5fa49bfd81263eb7740826e4437cbe904cd</Hashes>
+                <Hashes condition="contains">SHA256=f088b2ba27dacd5c28f8ee428f1350dca4bc7c6606309c287c801b2e1da1a53d</Hashes>
+                <Hashes condition="contains">SHA256=771a8d05f1af6214e0ef0886662be500ee910ab99f0154227067fddcfe08a3dd</Hashes>
+                <Hashes condition="contains">SHA256=910aa4685c735d8c07662aa04fafec463185699ad1a0cd1967b892fc33ec6c3c</Hashes>
+                <Hashes condition="contains">SHA256=ed2f33452ec32830ffef2d5dc832985db9600c306ed890c47f3f33ccbb335c39</Hashes>
+                <Hashes condition="contains">SHA256=98b734dda78c16ebcaa4afeb31007926542b63b2f163b2f733fa0d00dbb344d8</Hashes>
+                <Hashes condition="contains">SHA256=e83908eba2501a00ef9e74e7d1c8b4ff1279f1cd6051707fd51824f87e4378fa</Hashes>
+                <Hashes condition="contains">SHA256=21ccdd306b5183c00ecfd0475b3152e7d94b921e858e59b68a03e925d1715f21</Hashes>
+                <Hashes condition="contains">SHA256=26c28746e947389856543837aa59a5b1f4697e5721a04d00aa28151a2659b097</Hashes>
+                <Hashes condition="contains">SHA256=9f4ce6ab5e8d44f355426d9a6ab79833709f39b300733b5b251a0766e895e0e5</Hashes>
+                <Hashes condition="contains">SHA256=0040153302b88bee27eb4f1eca6855039e1a057370f5e8c615724fa5215bada3</Hashes>
+                <Hashes condition="contains">SHA256=0ebaef662b14410c198395b13347e1d175334ec67919709ad37d65eba013adff</Hashes>
+                <Hashes condition="contains">SHA256=a7c2e7910942dd5e43e2f4eb159bcd2b4e71366e34a68109548b9fb12ac0f7cc</Hashes>
+                <Hashes condition="contains">SHA256=59b09bd69923c0b3de3239e73205b1846a5f69043546d471b259887bb141d879</Hashes>
+                <Hashes condition="contains">SHA256=09bedbf7a41e0f8dabe4f41d331db58373ce15b2e9204540873a1884f38bdde1</Hashes>
+                <Hashes condition="contains">SHA256=1e0eb0811a7cf1bdaf29d3d2cab373ca51eb8d8b58889ab7728e2d3aed244abe</Hashes>
+                <Hashes condition="contains">SHA256=7049f3c939efe76a5556c2a2c04386db51daf61d56b679f4868bb0983c996ebb</Hashes>
+                <Hashes condition="contains">SHA256=4a3d4db86f580b1680d6454baee1c1a139e2dde7d55e972ba7c92ec3f555dce2</Hashes>
+                <Hashes condition="contains">SHA256=bb1135b51acca8348d285dc5461d10e8f57260e7d0c8cc4a092734d53fc40cbc</Hashes>
+                <Hashes condition="contains">SHA256=45ba688a4bded8a7e78a4f5b0dc21004e951ddceb014bb92f51a3301d2fbc56a</Hashes>
+                <Hashes condition="contains">SHA256=15c53eb3a0ea44bbd2901a45a6ebeae29bb123f9c1115c38dfb2cdbec0642229</Hashes>
+                <Hashes condition="contains">SHA256=83f7be0a13c1fccf024c31da5c68c0ea1decf4f48fc39d6e4fd324bbe789ae8a</Hashes>
+                <Hashes condition="contains">SHA256=ecfc52a22e4a41bf53865b0e28309411c60af34a44e31a5c53cdc8c5733e8282</Hashes>
+                <Hashes condition="contains">SHA256=ffc72f0bde21ba20aa97bee99d9e96870e5aa40cce9884e44c612757f939494f</Hashes>
+                <Hashes condition="contains">SHA256=673bcec3d53fab5efd6e3bac25ac9d6cc51f6bbdf8336e38aade2713dc1ae11b</Hashes>
+                <Hashes condition="contains">SHA256=7da6113183328d4fddf6937c0c85ef65ba69bfe133b1146193a25bcf6ae1f9dd</Hashes>
+                <Hashes condition="contains">SHA256=cc383ad11e9d06047a1558ed343f389492da3ac2b84b71462aee502a2fa616c8</Hashes>
+                <Hashes condition="contains">SHA256=76fb4deaee57ef30e56c382c92abffe2cf616d08dbecb3368c8ee6b02e59f303</Hashes>
+                <Hashes condition="contains">SHA256=caa85c44eb511377ea7426ff10df00a701c07ffb384eef8287636a4bca0b53ab</Hashes>
+                <Hashes condition="contains">SHA256=19696fb0db3fcae22f705ae1eb1e9f1151c823f3ff5d8857e90f2a4a6fdc5758</Hashes>
+                <Hashes condition="contains">SHA256=77950e2a40ac0447ae7ee1ee3ef1242ce22796a157074e6f04e345b1956e143c</Hashes>
+                <Hashes condition="contains">SHA256=cf3a7d4285d65bf8688215407bce1b51d7c6b22497f09021f0fce31cbeb78986</Hashes>
+                <Hashes condition="contains">SHA256=4cff6e53430b81ecc4fae453e59a0353bcfe73dd5780abfc35f299c16a97998e</Hashes>
+                <Hashes condition="contains">SHA256=65db1b259e305a52042e07e111f4fa4af16542c8bacd33655f753ef642228890</Hashes>
+                <Hashes condition="contains">SHA256=19d0fc91b70d7a719f7a28b4ad929f114bf1de94a4c7cba5ad821285a4485da0</Hashes>
+                <Hashes condition="contains">SHA256=9b2f051ac901ab47d0012a1002cb8b2db28c14e9480c0dd55e1ac11c81ba9285</Hashes>
+                <Hashes condition="contains">SHA256=159e7c5a12157af92e0d14a0d3ea116f91c09e21a9831486e6dc592c93c10980</Hashes>
+                <Hashes condition="contains">SHA256=bdcacee3695583a0ca38b9a786b9f7334bf2a9a3387e4069c8e6ca378b2791d0</Hashes>
+                <Hashes condition="contains">SHA256=7f5dc63e5742096e4accaca39ae77a2a2142b438c10f97860dee4054b51d3b35</Hashes>
+                <Hashes condition="contains">SHA256=2b120de80a5462f8395cfb7153c86dfd44f29f0776ea156ec4a34fa64e5c4797</Hashes>
+                <Hashes condition="contains">SHA256=d7e091e0d478c34232e8479b950c5513077b3a69309885cee4c61063e5f74ac0</Hashes>
+                <Hashes condition="contains">SHA256=5351c81b4ec5a0d79c39d24bac7600d10eac30c13546fde43d23636b3f421e7c</Hashes>
+                <Hashes condition="contains">SHA256=f85cca4badff17d1aa90752153ccec77a68ad282b69e3985fdc4743eaea85004</Hashes>
+                <Hashes condition="contains">SHA256=56a3c9ac137d862a85b4004f043d46542a1b61c6acb438098a9640469e2d80e7</Hashes>
+                <Hashes condition="contains">SHA256=3cb75429944e60f6c820c7638adbf688883ad44951bca3f8912428afe72bc134</Hashes>
+                <Hashes condition="contains">SHA256=d0bd1ae72aeb5f3eabf1531a635f990e5eaae7fdd560342f915f723766c80889</Hashes>
+                <Hashes condition="contains">SHA256=f8886a9c759e0426e08d55e410b02c5b05af3c287b15970175e4874316ffaf13</Hashes>
+                <Hashes condition="contains">SHA256=cf4b5fa853ce809f1924df3a3ae3c4e191878c4ea5248d8785dc7e51807a512b</Hashes>
+                <Hashes condition="contains">SHA256=d6827cd3a8f273a66ecc33bb915df6c7dea5cc1b8134b0c348303ef50db33476</Hashes>
+                <Hashes condition="contains">SHA256=f0605dda1def240dc7e14efa73927d6c6d89988c01ea8647b671667b2b167008</Hashes>
+                <Hashes condition="contains">SHA256=4d19ee789e101e5a76834fb411aadf8229f08b3ece671343ad57a6576a525036</Hashes>
+                <Hashes condition="contains">SHA256=916c535957a3b8cbf3336b63b2260ea4055163a9e6b214f2a7005d6d36a4a677</Hashes>
+                <Hashes condition="contains">SHA256=8e6363a6393eb4234667c6f614b2072e33512866b3204f8395bbe01530d63f2f</Hashes>
+                <Hashes condition="contains">SHA256=506f953bbb285aeb8af0549eb24f52f3b7af36afe740afa36735bac70573ce28</Hashes>
+                <Hashes condition="contains">SHA256=a8027daa6facf1ff81405daf6763249e9acf232a1a191b6bf106711630e6188e</Hashes>
+                <Hashes condition="contains">SHA256=74a846c61adc53692d3040aff4c1916f32987ad72b07fe226e9e7dbeff1036c4</Hashes>
+                <Hashes condition="contains">SHA256=17927b93b2d6ab4271c158f039cae2d60591d6a14458f5a5690aec86f5d54229</Hashes>
+                <Hashes condition="contains">SHA256=8e88cb80328c3dbaa2752591692e74a2fae7e146d7d8aabc9b9ac9a6fe561e6c</Hashes>
+                <Hashes condition="contains">SHA256=e07211224b02aaf68a5e4b73fc1049376623793509d9581cdaee9e601020af06</Hashes>
+                <Hashes condition="contains">SHA256=2d2c7ee9547738a8a676ab785c151e8b48ed40fe7cf6174650814c7f5f58513b</Hashes>
+                <Hashes condition="contains">SHA256=a334bdf0c0ab07803380eb6ef83eefe7c147d6962595dd9c943a6a76f2200b0d</Hashes>
+                <Hashes condition="contains">SHA256=7f190f6e5ab0edafd63391506c2360230af4c2d56c45fc8996a168a1fc12d457</Hashes>
+                <Hashes condition="contains">SHA256=b37b3c6877b70289c0f43aeb71349f7344b06063996e6347c3c18d8c5de77f3b</Hashes>
+                <Hashes condition="contains">SHA256=6191c20426dd9b131122fb97e45be64a4d6ce98cc583406f38473434636ddedc</Hashes>
+                <Hashes condition="contains">SHA256=c470c9db58840149ce002f3e6003382ecf740884a683bae8f9d10831be218fa2</Hashes>
+                <Hashes condition="contains">SHA256=61d6e40601fa368800980801a662a5b3b36e3c23296e8ae1c85726a56ef18cc8</Hashes>
+                <Hashes condition="contains">SHA256=46621554728bc55438c7c241137af401250f062edef6e7efecf1a6f0f6d0c1f7</Hashes>
+                <Hashes condition="contains">SHA256=b4d47ea790920a4531e3df5a4b4b0721b7fea6b49a35679f0652f1e590422602</Hashes>
+                <Hashes condition="contains">SHA256=0466dac557ee161503f5dfbd3549f81ec760c3d6c7c4363a21a03e7a3f66aca8</Hashes>
+                <Hashes condition="contains">SHA256=3c6f9917418e991ed41540d8d882c8ca51d582a82fd01bff6cdf26591454faf5</Hashes>
+                <Hashes condition="contains">SHA256=b50ffc60eaa4fb7429fdbb67c0aba0c7085f5129564d0a113fec231c5f8ff62e</Hashes>
+                <Hashes condition="contains">SHA256=7cb594af6a3655daebc9fad9c8abf2417b00ba31dcd118707824e5316fc0cc21</Hashes>
+                <Hashes condition="contains">SHA256=4422851a0a102f654e95d3b79c357ae3af1b096d7d1576663c027cfbc04abaf9</Hashes>
+                <Hashes condition="contains">SHA256=3ff39728f1c11d1108f65ec5eb3d722fd1a1279c530d79712e0d32b34880baaa</Hashes>
+                <Hashes condition="contains">SHA256=5c0b429e5935814457934fa9c10ac7a88e19068fa1bd152879e4e9b89c103921</Hashes>
+                <Hashes condition="contains">SHA256=0aafa9f47acf69d46c9542985994ff5321f00842a28df2396d4a3076776a83cb</Hashes>
+                <Hashes condition="contains">SHA256=0ae8d1dd56a8a000ced74a627052933d2e9bff31d251de185b3c0c5fc94a44db</Hashes>
+                <Hashes condition="contains">SHA256=94be67c319a67de75ebed050d5537cfaa795d72bba52f3d8cf349e7bd075410e</Hashes>
+                <Hashes condition="contains">SHA256=b1867d13a4cab66a76f4d4448824ca0cb3a176064626f9618c0c103ee3cb4f47</Hashes>
+                <Hashes condition="contains">SHA256=f74ffd6916333662900cbecb90aca2d6475a714ce410adf9c5c3264abbe5732c</Hashes>
+                <Hashes condition="contains">SHA256=d7ddf874304556f8a10942a29b3d387cb5155a7419f87813557fe728cb14806d</Hashes>
+                <Hashes condition="contains">SHA256=4a9093e8dbcb867e1b97a0a67ce99a8511900658f5201c34ffb8035881f2dbbe</Hashes>
+                <Hashes condition="contains">SHA256=ff115cefe624b6ca0b3878a86f6f8b352d1915b65fbbdc33ae15530a96ebdaa7</Hashes>
+                <Hashes condition="contains">SHA256=9f1229cd8dd9092c27a01f5d56e3c0d59c2bb9f0139abf042e56f343637fda33</Hashes>
+                <Hashes condition="contains">SHA256=3124b0411b8077605db2a9b7909d8240e0d554496600e2706e531c93c931e1b5</Hashes>
+                <Hashes condition="contains">SHA256=50d5eaa168c077ce5b7f15b3f2c43bd2b86b07b1e926c1b332f8cb13bd2e0793</Hashes>
+                <Hashes condition="contains">SHA256=952199c28332bc90cfd74530a77ee237967ed32b3c71322559c59f7a42187dc4</Hashes>
+                <Hashes condition="contains">SHA256=55a1535e173c998fbbc978009b02d36ca0c737340d84ac2a8da73dfc2f450ef9</Hashes>
+                <Hashes condition="contains">SHA256=57a389da784269bb2cc0a258500f6dfbf4f6269276e1192619ce439ec77f4572</Hashes>
+                <Hashes condition="contains">SHA256=84df20b1d9d87e305c92e5ffae21b10b325609d59d835a954dbd8750ef5dabf4</Hashes>
+                <Hashes condition="contains">SHA256=8ef0ad86500094e8fa3d9e7d53163aa6feef67c09575c169873c494ed66f057f</Hashes>
+                <Hashes condition="contains">SHA256=26f41e4268be59f5de07552b51fa52d18d88be94f8895eb4a16de0f3940cf712</Hashes>
+                <Hashes condition="contains">SHA256=26e3bfef255efd052a84c3c43994c73222b14c95db9a4b1fc2e98f1a5cb26e43</Hashes>
+                <Hashes condition="contains">SHA256=478917514be37b32d5ccf76e4009f6f952f39f5553953544f1b0688befd95e82</Hashes>
+                <Hashes condition="contains">SHA256=0f035948848432bc243704041739e49b528f35c82a5be922d9e3b8a4c44398ff</Hashes>
+                <Hashes condition="contains">SHA256=72b99147839bcfb062d29014ec09fe20a8f261748b5925b00171ef3cb849a4c1</Hashes>
+                <Hashes condition="contains">SHA256=8cf0cbbdc43f9b977f0fb79e0a0dd0e1adabe08a67d0f40d727c717c747de775</Hashes>
+                <Hashes condition="contains">SHA256=4429f32db1cc70567919d7d47b844a91cf1329a6cd116f582305f3b7b60cd60b</Hashes>
+                <Hashes condition="contains">SHA256=0cd4ca335155062182608cad9ef5c8351a715bce92049719dd09c76422cd7b0c</Hashes>
+                <Hashes condition="contains">SHA256=05f052c64d192cf69a462a5ec16dda0d43ca5d0245900c9fcb9201685a2e7748</Hashes>
+                <Hashes condition="contains">SHA256=b9b3878ddc5dfb237d38f8d25067267870afd67d12a330397a8853209c4d889c</Hashes>
+                <Hashes condition="contains">SHA256=93d873cdf23d5edc622b74f9544cac7fe247d7a68e1e2a7bf2879fad97a3ae63</Hashes>
+                <Hashes condition="contains">SHA256=aaa3459bcac25423f78ed72dbae4d7ef19e7c5c65770cbe5210b14e33cd1816c</Hashes>
+                <Hashes condition="contains">SHA256=5f20541f859f21b3106e12d37182b1ea39bb75ffcfcddb2ece4f6edd42c0bab2</Hashes>
+                <Hashes condition="contains">SHA256=dbe9f17313e1164f06401234b875fbc7f71d41dc7271de643865af1358841fef</Hashes>
+                <Hashes condition="contains">SHA256=e0b5a5f8333fc1213791af5c5814d7a99615b3951361ca75f8aa5022c9cfbc2b</Hashes>
+                <Hashes condition="contains">SHA256=19a212e6fc324f4cb9ee5eba60f5c1fc0191799a4432265cbeaa3307c76a7fc0</Hashes>
+                <Hashes condition="contains">SHA256=36aafa127736c7226c50061ea065f71e14f64ec60321f705bc52686d24117e0d</Hashes>
+                <Hashes condition="contains">SHA256=cfc5c585dd4e592dd1a08887ded28b92d9a5820587b6f4f8fa4f56d60289259b</Hashes>
+                <Hashes condition="contains">SHA256=f37d609ea1f06660d970415dd3916c4c153bb5940bf7d2beb47fa34e8a8ffbfc</Hashes>
+                <Hashes condition="contains">SHA256=89108a15f009b285db4ef94250b889d5b11b96b4aa7b190784a6d1396e893e10</Hashes>
+                <Hashes condition="contains">SHA256=1f4d4db4abe26e765a33afb2501ac134d14cadeaa74ae8a0fae420e4ecf58e0c</Hashes>
+                <Hashes condition="contains">SHA256=39cfde7d401efce4f550e0a9461f5fc4d71fa07235e1336e4f0b4882bd76550e</Hashes>
+                <Hashes condition="contains">SHA256=8fe9828bea83adc8b1429394db7a556a17f79846ad0bfb7f242084a5c96edf2a</Hashes>
+                <Hashes condition="contains">SHA256=2afdb3278a7b57466a103024aef9ff7f41c73a19bab843a8ebf3d3c4d4e82b30</Hashes>
+                <Hashes condition="contains">SHA256=8bda0108de82ebeae82f43108046c5feb6f042e312fa0115475a9e32274fae59</Hashes>
+                <Hashes condition="contains">SHA256=082c39fe2e3217004206535e271ebd45c11eb072efde4cc9885b25ba5c39f91d</Hashes>
+                <Hashes condition="contains">SHA256=f40435488389b4fb3b945ca21a8325a51e1b5f80f045ab019748d0ec66056a8b</Hashes>
+                <Hashes condition="contains">SHA256=9c10e2ec4f9ef591415f9a784b93dc9c9cdafa7c69602c0dc860c5b62222e449</Hashes>
+                <Hashes condition="contains">SHA256=2594b3ef3675ca3a7b465b8ed4962e3251364bab13b12af00ebba7fa2211abb2</Hashes>
+                <Hashes condition="contains">SHA256=47f08f7d30d824a8f4bb8a98916401a37c0fd8502db308aba91fe3112b892dcc</Hashes>
+                <Hashes condition="contains">SHA256=bac709c49ddee363c8e59e515f2f632324a0359e932b7d8cb1ce2d52a95981aa</Hashes>
+                <Hashes condition="contains">SHA256=31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427</Hashes>
+                <Hashes condition="contains">SHA256=7d8937c18d6e11a0952e53970a0934cf0e65515637ac24d6ca52ccf4b93d385f</Hashes>
+                <Hashes condition="contains">SHA256=3724b39e97936bb20ada51c6119aded04530ed86f6b8d6b45fbfb2f3b9a4114b</Hashes>
+                <Hashes condition="contains">SHA256=df0dcfb3971829af79629efd036b8e1c6e2127481b3644ccc6e2ddd387489a15</Hashes>
+                <Hashes condition="contains">SHA256=91314768da140999e682d2a290d48b78bb25a35525ea12c1b1f9634d14602b2c</Hashes>
+                <Hashes condition="contains">SHA256=a9706e320179993dade519a83061477ace195daa1b788662825484813001f526</Hashes>
+                <Hashes condition="contains">SHA256=314384b40626800b1cde6fbc51ebc7d13e91398be2688c2a58354aa08d00b073</Hashes>
+                <Hashes condition="contains">SHA256=a072197177aad26c31960694e38e2cae85afbab070929e67e331b99d3a418cf4</Hashes>
+                <Hashes condition="contains">SHA256=8e5aef7c66c0e92dfc037ee29ade1c8484b8d7fadebdcf521d2763b1d8215126</Hashes>
+                <Hashes condition="contains">SHA256=b7a20b5f15e1871b392782c46ebcc897929443d82073ee4dcb3874b6a5976b5d</Hashes>
+                <Hashes condition="contains">SHA256=5ee292b605cd3751a24e5949aae615d472a3c72688632c3040dc311055b75a92</Hashes>
+                <Hashes condition="contains">SHA256=5f6547e9823f94c5b94af1fb69a967c4902f72b6e0c783804835e6ce27f887b0</Hashes>
+                <Hashes condition="contains">SHA256=2732050a7d836ae0bdc5c0aea4cdf8ce205618c3e7f613b8139c176e86476d0c</Hashes>
+                <Hashes condition="contains">SHA256=ff6729518a380bf57f1bc6f1ec0aa7f3012e1618b8d9b0f31a61d299ee2b4339</Hashes>
+                <Hashes condition="contains">SHA256=43ba8d96d5e8e54cab59d82d495eeca730eeb16e4743ed134cdd495c51a4fc89</Hashes>
+                <Hashes condition="contains">SHA256=64f9e664bc6d4b8f5f68616dd50ae819c3e60452efd5e589d6604b9356841b57</Hashes>
+                <Hashes condition="contains">SHA256=31d8fc6f5fb837d5eb29db828d13ba8ee11867d86a90b2c2483a578e1d0ec43a</Hashes>
+                <Hashes condition="contains">SHA256=23ba19352b1e71a965260bf4d5120f0200709ee8657ed381043bec9a938a1ade</Hashes>
+                <Hashes condition="contains">SHA256=11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5</Hashes>
+                <Hashes condition="contains">SHA256=de8f8006d8ee429b5f333503defa54b25447f4ed6aeade5e4219e23f3473ef1c</Hashes>
+                <Hashes condition="contains">SHA256=9fc29480407e5179aa8ea41682409b4ea33f1a42026277613d6484e5419de374</Hashes>
+                <Hashes condition="contains">SHA256=e05eeb2b8c18ad2cb2d1038c043d770a0d51b96b748bc34be3e7fc6f3790ce53</Hashes>
+                <Hashes condition="contains">SHA256=9b6a84f7c40ea51c38cc4d2e93efb3375e9d98d4894a85941190d94fbe73a4e4</Hashes>
+                <Hashes condition="contains">SHA256=2bf29a2df52110ed463d51376562afceac0e80fbb1033284cf50edd86c406b14</Hashes>
+                <Hashes condition="contains">SHA256=95d50c69cdbf10c9c9d61e64fe864ac91e6f6caa637d128eb20e1d3510e776d3</Hashes>
+                <Hashes condition="contains">SHA256=927c2a580d51a598177fa54c65e9d2610f5f212f1b6cb2fbf2740b64368f010a</Hashes>
+                <Hashes condition="contains">SHA256=7539157df91923d4575f7f57c8eb8b0fd87f064c919c1db85e73eebb2910b60c</Hashes>
+                <Hashes condition="contains">SHA256=0af5ccb3d33a9ba92071c9637be6254030d61998733a5eb3583e865e17844e05</Hashes>
+                <Hashes condition="contains">SHA256=fd388cf1df06d419b14dedbeb24c6f4dff37bea26018775f09d56b3067f0de2c</Hashes>
+                <Hashes condition="contains">SHA256=0ce40a2cdd3f45c7632b858e8089ddfdd12d9acb286f2015a4b1b0c0346a572c</Hashes>
+                <Hashes condition="contains">SHA256=3e1d47a497babbfd1c83905777b517ec87c65742bee7eb57a2273eca825d2272</Hashes>
+                <Hashes condition="contains">SHA256=f9895458e73d4b0ef01eda347fb695bb00e6598d9f5e2506161b70ad96bb7298</Hashes>
+                <Hashes condition="contains">SHA256=bb68552936a6b0a68fb53ce864a6387d2698332aac10a7adfdd5a48b97027ce3</Hashes>
+                <Hashes condition="contains">SHA256=d783ace822f8fe4e25d5387e5dd249cb72e62f62079023216dc436f1853a150f</Hashes>
+                <Hashes condition="contains">SHA256=df0cc4e5c9802f8edaefeb130e375cad56b2c5490d8ebd77d8dbdcc6fdc7ecb6</Hashes>
+                <Hashes condition="contains">SHA256=607dc4c75ac7aef82ae0616a453866b3b358c6cf5c8f9d29e4d37f844306b97c</Hashes>
+                <Hashes condition="contains">SHA256=f877296e8506e6a1acbdacdc5085b18c6842320a2775a329d286bac796f08d54</Hashes>
+                <Hashes condition="contains">SHA256=18712a063574bfec315d58577dfe413ab45b650e54747d1e18a56c3c7337a12c</Hashes>
+                <Hashes condition="contains">SHA256=8b92cdb91a2e2fab3881d54f5862e723826b759749f837a11c9e9d85d52095a2</Hashes>
+                <Hashes condition="contains">SHA256=72322fa8bba20df6966acbcf41e83747893fd173cd29de99b5ad1a5d3bf8f2de</Hashes>
+                <Hashes condition="contains">SHA256=146d77e80ca70ea5cb17bfc9a5cea92334f809cbdc87a51c2d10b8579a4b9c88</Hashes>
+                <Hashes condition="contains">SHA256=45abdbcd4c0916b7d9faaf1cd08543a3a5178871074628e0126a6eda890d26e0</Hashes>
+                <Hashes condition="contains">SHA256=9f1025601d17945c3a47026814bdec353ee363966e62dba7fe2673da5ce50def</Hashes>
+                <Hashes condition="contains">SHA256=3f9530c94b689f39cc83377d76979d443275012e022782a600dcb5cad4cca6aa</Hashes>
+                <Hashes condition="contains">SHA256=9254f012009d55f555418ff85f7d93b184ab7cb0e37aecdfdab62cfe94dea96b</Hashes>
+                <Hashes condition="contains">SHA256=3384f4a892f7aa72c43280ff682d85c8e3936f37a68d978d307a9461149192de</Hashes>
+                <Hashes condition="contains">SHA256=b8b94c2646b62f6ac08f16514b6efaa9866aa3c581e4c0435a7aeafe569b2418</Hashes>
+                <Hashes condition="contains">SHA256=b03f26009de2e8eabfcf6152f49b02a55c5e5d0f73e01d48f5a745f93ce93a29</Hashes>
+                <Hashes condition="contains">SHA256=696679114f6a106ec94c21e2a33fe17af86368bcf9a796aaea37ea6e8748ad6a</Hashes>
+                <Hashes condition="contains">SHA256=b019ebd77ac19cdd72bba3318032752649bd56a7576723a8ae1cccd70ee1e61a</Hashes>
+                <Hashes condition="contains">SHA256=67734c7c0130dd66c964f76965f09a2290da4b14c94412c0056046e700654bdc</Hashes>
+                <Hashes condition="contains">SHA256=ecd07df7ad6fee9269a9e9429eb199bf3e24cf672aa1d013b7e8d90d75324566</Hashes>
+                <Hashes condition="contains">SHA256=38c18db050b0b2b07f657c03db1c9595febae0319c746c3eede677e21cd238b0</Hashes>
+                <Hashes condition="contains">SHA256=810513b3f4c8d29afb46f71816350088caacf46f1be361af55b26f3fee4662c3</Hashes>
+                <Hashes condition="contains">SHA256=1b7fb154a7b7903a3c81f12f4b094f24a3c60a6a8cffca894c67c264ab7545fa</Hashes>
+                <Hashes condition="contains">SHA256=ea0b9eecf4ad5ec8c14aec13de7d661e7615018b1a3c65464bf5eca9bbf6ded3</Hashes>
+                <Hashes condition="contains">SHA256=09b0e07af8b17db1d896b78da4dd3f55db76738ee1f4ced083a97d737334a184</Hashes>
+                <Hashes condition="contains">SHA256=5b9623da9ba8e5c80c49473f40ffe7ad315dcadffc3230afdc9d9226d60a715a</Hashes>
+                <Hashes condition="contains">SHA256=258359a7fa3d975620c9810dab3a6493972876a024135feaf3ac8482179b2e79</Hashes>
+                <Hashes condition="contains">SHA256=a2353030d4ea3ad9e874a0f7ff35bbfa10562c98c949d88cabab27102bbb8e48</Hashes>
+                <Hashes condition="contains">SHA256=a56c2a2425eb3a4260cc7fc5c8d7bed7a3b4cd2af256185f24471c668853aee8</Hashes>
+                <Hashes condition="contains">SHA256=1f8168036d636aad1680dd0f577ef9532dbb2dad3591d63e752b0ba3ee6fd501</Hashes>
+                <Hashes condition="contains">SHA256=ee45fd2d7315fd039f3585a66e7855ba4af9d4721e1448e602623de14e932bbe</Hashes>
+                <Hashes condition="contains">SHA256=d636c011b8b2896572f5de260eb997182cc6955449b044a739bd19cbe6fdabd2</Hashes>
+                <Hashes condition="contains">SHA256=6a4875ae86131a594019dec4abd46ac6ba47e57a88287b814d07d929858fe3e5</Hashes>
+                <Hashes condition="contains">SHA256=238046cfe126a1f8ab96d8b62f6aa5ec97bab830e2bae5b1b6ab2d31894c79e4</Hashes>
+                <Hashes condition="contains">SHA256=3e9b62d2ea2be50a2da670746c4dbe807db9601980af3a1014bcd72d0248d84c</Hashes>
+                <Hashes condition="contains">SHA256=c082514317bf80a2f5129d84a5a55e411a95e32d03a4df1274537704c80e41dd</Hashes>
+                <Hashes condition="contains">SHA256=cd4a249c3ef65af285d0f8f30a8a96e83688486aab515836318a2559757a89bb</Hashes>
+                <Hashes condition="contains">SHA256=32cccc4f249499061c0afa18f534c825d01034a1f6815f5506bf4c4ff55d1351</Hashes>
+                <Hashes condition="contains">SHA256=818e396595d08d724666803cd29dac566dc7db23bf50e9919d04b33afa988c01</Hashes>
+                <Hashes condition="contains">SHA256=2b186926ed815d87eaf72759a69095a11274f5d13c33b8cc2b8700a1f020be1d</Hashes>
+                <Hashes condition="contains">SHA256=e6056443537d4d2314dabca1b9168f1eaaf17a14eb41f6f5741b6b82b3119790</Hashes>
+                <Hashes condition="contains">SHA256=a13054f349b7baa8c8a3fcbd31789807a493cc52224bbff5e412eb2bd52a6433</Hashes>
+                <Hashes condition="contains">SHA256=e4c154a0073bbad3c9f8ab7218e9b3be252ae705c20c568861dae4088f17ffcc</Hashes>
+                <Hashes condition="contains">SHA256=5192ec4501d0fe0b1c8f7bf9b778f7524a7a70a26bbbb66e5dab8480f6fdbb8b</Hashes>
+                <Hashes condition="contains">SHA256=65025741ecd0ef516da01319b42c2d96e13cb8d78de53fb7e39cd53ea6d58c75</Hashes>
+                <Hashes condition="contains">SHA256=37c637a74bf20d7630281581a8fae124200920df11ad7cd68c14c26cc12c5ec9</Hashes>
+                <Hashes condition="contains">SHA256=ec5fac0b6bb267a2bd10fc80c8cca6718439d56e82e053d3ff799ce5f3475db5</Hashes>
+                <Hashes condition="contains">SHA256=c299063e3eae8ddc15839767e83b9808fd43418dc5a1af7e4f44b97ba53fbd3d</Hashes>
+                <Hashes condition="contains">SHA256=923ebbe8111e73d5b8ecc2db10f8ea2629a3264c3a535d01c3c118a3b4c91782</Hashes>
+                <Hashes condition="contains">SHA256=c1c4310e5d467d24e864177bdbfc57cb5d29aac697481bfa9c11ddbeebfd4cc8</Hashes>
+                <Hashes condition="contains">SHA256=12eda8b65ed8c1d80464a0c535ea099dffdb4981c134294cb0fa424efc85ee56</Hashes>
+                <Hashes condition="contains">SHA256=552f70374715e70c4ade591d65177be2539ec60f751223680dfaccb9e0be0ed9</Hashes>
+                <Hashes condition="contains">SHA256=49f75746eebe14e5db11706b3e58accc62d4034d2f1c05c681ecef5d1ad933ba</Hashes>
+                <Hashes condition="contains">SHA256=bc13adeb6bf62b1e10ef41205ef92382e6c18d6a20669d288a0b11058e533d63</Hashes>
+                <Hashes condition="contains">SHA256=525d9b51a80ca0cd4c5889a96f857e73f3a80da1ffbae59851e0f51bdfb0b6cd</Hashes>
+                <Hashes condition="contains">SHA256=86a1b1bacc0c51332c9979e6aad84b5fba335df6b9a096ccb7681ab0779a8882</Hashes>
+                <Hashes condition="contains">SHA256=36505921af5a09175395ebaea29c72b2a69a3a9204384a767a5be8a721f31b10</Hashes>
+                <Hashes condition="contains">SHA256=c9b49b52b493b53cd49c12c3fa9553e57c5394555b64e32d1208f5b96a5b8c6e</Hashes>
+                <Hashes condition="contains">SHA256=dd573f23d656818036fc9ae1064eda31aca86acb9bc44a6e127db3ea112a9094</Hashes>
+                <Hashes condition="contains">SHA256=b179e1ab6dc0b1aee783adbcad4ad6bb75a8a64cb798f30c0dd2ee8aaf43e6de</Hashes>
+                <Hashes condition="contains">SHA256=76b86543ce05540048f954fed37bdda66360c4a3ddb8328213d5aef7a960c184</Hashes>
+                <Hashes condition="contains">SHA256=58a74dceb2022cd8a358b92acd1b48a5e01c524c3b0195d7033e4bd55eff4495</Hashes>
+                <Hashes condition="contains">SHA256=133e542842656197c5d22429bd56d57aa33c9522897fdf29853a6d321033c743</Hashes>
+                <Hashes condition="contains">SHA256=e7cbfb16261de1c7f009431d374d90e9eb049ba78246e38bc4c8b9e06f324b6f</Hashes>
+                <Hashes condition="contains">SHA256=8cb62c5d41148de416014f80bd1fd033fd4d2bd504cb05b90eeb6992a382d58f</Hashes>
+                <Hashes condition="contains">SHA256=06508aacb4ed0a1398a2b0da5fa2dbf7da435b56da76fd83c759a50a51c75caf</Hashes>
+                <Hashes condition="contains">SHA256=5bd41a29cbba0d24e639f49d1f201b9bd119b11f5e3b8a5fefa3a5c6f1e7692c</Hashes>
+                <Hashes condition="contains">SHA256=cb9890d4e303a4c03095d7bc176c42dee1b47d8aa58e2f442ec1514c8f9e3cec</Hashes>
+                <Hashes condition="contains">SHA256=a899b659b08fbae30b182443be8ffb6a6471c1d0497b52293061754886a937a3</Hashes>
+                <Hashes condition="contains">SHA256=910479467ef17b9591d8d42305e7f6f247ad41c60ec890a1ffbe331f495ed135</Hashes>
+                <Hashes condition="contains">SHA256=cf3180f5308af002ac5d6fd5b75d1340878c375f0aebc3157e3bcad6322b7190</Hashes>
+                <Hashes condition="contains">SHA256=3ac5e01689a3d745e60925bc7faca8d4306ae693e803b5e19c94906dc30add46</Hashes>
+                <Hashes condition="contains">SHA256=afdd66562dea51001c3a9de300f91fc3eb965d6848dfce92ccb9b75853e02508</Hashes>
+                <Hashes condition="contains">SHA256=7f375639a0df7fe51e5518cf87c3f513c55bc117db47d28da8c615642eb18bfa</Hashes>
+                <Hashes condition="contains">SHA256=9d5ebd0f4585ec20a5fe3c5276df13ece5a2645d3d6f70cedcda979bd1248fc2</Hashes>
+                <Hashes condition="contains">SHA256=ae42afa9be9aa6f6a5ae09fa9c05cd2dfb7861dc72d4fd8e0130e5843756c471</Hashes>
+                <Hashes condition="contains">SHA256=3ff50c67d51553c08dcb7c98342f68a0f54ad6658c5346c428bdcd1f185569f6</Hashes>
+                <Hashes condition="contains">SHA256=8d57e416ea4bb855b78a2ff3c80de1dfbb5dc5ee9bfbdddb23e46bd8619287e2</Hashes>
+                <Hashes condition="contains">SHA256=f8430bdc6fd01f42217d66d87a3ef6f66cb2700ebb39c4f25c8b851858cc4b35</Hashes>
+                <Hashes condition="contains">SHA256=bc7ebd191e0991fd0865a5c956a92e63792a0bb2ff888af43f7a63bb65a22248</Hashes>
+                <Hashes condition="contains">SHA256=be03e9541f56ac6ed1e81407dcd7cc85c0ffc538c3c2c2c8a9c747edbcf13100</Hashes>
+                <Hashes condition="contains">SHA256=6cb6e23ba516570bbd158c32f7c7c99f19b24ca4437340ecb39253662afe4293</Hashes>
+                <Hashes condition="contains">SHA256=60b163776e7b95e0c2280d04476304d0c943b484909131f340e3ce6045a49289</Hashes>
+                <Hashes condition="contains">SHA256=455bc98ba32adab8b47d2d89bdbadca4910f91c182ab2fc3211ba07d3784537b</Hashes>
+                <Hashes condition="contains">SHA256=543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91</Hashes>
+                <Hashes condition="contains">SHA256=3c18ae965fba56d09a65770b4d8da54ccd7801f979d3ebd283397bc99646004b</Hashes>
+                <Hashes condition="contains">SHA256=94911fe6f2aba9683b10353094caf71ee4a882de63b4620797629d79f18feec5</Hashes>
+                <Hashes condition="contains">SHA256=71fe5af0f1564dc187eea8d59c0fbc897712afa07d18316d2080330ba17cf009</Hashes>
+                <Hashes condition="contains">SHA256=f05b1ee9e2f6ab704b8919d5071becbce6f9d0f9d0ba32a460c41d5272134abe</Hashes>
+                <Hashes condition="contains">SHA256=e3eff841ea0f2786e5e0fed2744c0829719ad711fc9258eeaf81ed65a52a8918</Hashes>
+                <Hashes condition="contains">SHA256=e16dc51c51b2df88c474feb52ce884d152b3511094306a289623de69dedfdf48</Hashes>
+                <Hashes condition="contains">SHA256=a59c40e7470b7003e8adfee37c77606663e78d7e3f2ebb8d60910af19924d8df</Hashes>
+                <Hashes condition="contains">SHA256=2a6db9facf9e13d35c37dd468be04bae5f70c6127a9aee76daebddbdec95d486</Hashes>
+                <Hashes condition="contains">SHA256=adc10de960f40fa9f6e28449748250fa9ddfd331115b77a79809a50c606753ee</Hashes>
+                <Hashes condition="contains">SHA256=c60fcff9c8e5243bbb22ec94618b9dcb02c59bb49b90c04d7d6ab3ebbd58dc3a</Hashes>
+                <Hashes condition="contains">SHA256=9a54ef5cfbe6db599322967ee2c84db7daabcb468be10a3ccfcaa0f64d9173c7</Hashes>
+                <Hashes condition="contains">SHA256=a4680fabf606d6580893434e81c130ff7ec9467a15e6534692443465f264d3c9</Hashes>
+                <Hashes condition="contains">SHA256=2e6b339597a89e875f175023ed952aaac64e9d20d457bbc07acf1586e7fe2df8</Hashes>
+                <Hashes condition="contains">SHA256=ef6d3c00f9d0aa31a218094480299ef73fc85146adf62fd0c2f4f88972c5c850</Hashes>
+                <Hashes condition="contains">SHA256=fcdfe570e6dc6e768ef75138033d9961f78045adca53beb6fdb520f6417e0df1</Hashes>
+                <Hashes condition="contains">SHA256=dd4a1253d47de14ef83f1bc8b40816a86ccf90d1e624c5adf9203ae9d51d4097</Hashes>
+                <Hashes condition="contains">SHA256=d8b58f6a89a7618558e37afc360cd772b6731e3ba367f8d58734ecee2244a530</Hashes>
+                <Hashes condition="contains">SHA256=a903f329b70f0078197cb7683aae1bb432eaf58572fe572f7cb4bc2080042d7e</Hashes>
+                <Hashes condition="contains">SHA256=984a77e5424c6d099051441005f2938ae92b31b5ad8f6521c6b001932862add7</Hashes>
+                <Hashes condition="contains">SHA256=3c7e5b25a33a7805c999d318a9523fcae46695a89f55bbdb8bb9087360323dfc</Hashes>
+                <Hashes condition="contains">SHA256=4bc0921ffd4acc865525d3faf98961e8decc5aec4974552cbbf2ae8d5a569de4</Hashes>
+                <Hashes condition="contains">SHA256=a2f45d95d54f4e110b577e621fefa0483fa0e3dcca14c500c298fb9209e491c1</Hashes>
+                <Hashes condition="contains">SHA256=d1f4949f76d8ac9f2fa844d16b1b45fb1375d149d46e414e4a4c9424dc66c91f</Hashes>
+                <Hashes condition="contains">SHA256=263e8f1e20612849aea95272da85773f577fd962a7a6d525b53f43407aa7ad24</Hashes>
+                <Hashes condition="contains">SHA256=22be050955347661685a4343c51f11c7811674e030386d2264cd12ecbf544b7c</Hashes>
+                <Hashes condition="contains">SHA256=c3e150eb7e7292f70299d3054ed429156a4c32b1f7466a706a2b99249022979e</Hashes>
+                <Hashes condition="contains">SHA256=06bda5a1594f7121acd2efe38ccb617fbc078bb9a70b665a5f5efd70e3013f50</Hashes>
+                <Hashes condition="contains">SHA256=221dfbc74bbb255b0879360ccc71a74b756b2e0f16e9386b38a9ce9d4e2e34f9</Hashes>
+                <Hashes condition="contains">SHA256=36875562e747136313ec5db58174e5fab870997a054ca8d3987d181599c7db6a</Hashes>
+                <Hashes condition="contains">SHA256=475e5016c9c0f5a127896f9179a1b1577a67b357f399ab5a1e68aab07134729a</Hashes>
+                <Hashes condition="contains">SHA256=18776682fcc0c6863147143759a8d4050a4115a8ede0136e49a7cf885c8a4805</Hashes>
+                <Hashes condition="contains">SHA256=dec8a933dba04463ed9bb7d53338ff87f2c23cfb79e0e988449fc631252c9dcc</Hashes>
+                <Hashes condition="contains">SHA256=d25904fbf907e19f366d54962ff543d9f53b8fdfd2416c8b9796b6a8dd430e26</Hashes>
+                <Hashes condition="contains">SHA256=771015b2620942919bb2e0683476635b7a09db55216d6fbf03534cb18513b20c</Hashes>
+                <Hashes condition="contains">SHA256=2aa1b08f47fbb1e2bd2e4a492f5d616968e703e1359a921f62b38b8e4662f0c4</Hashes>
+                <Hashes condition="contains">SHA256=40061b30b1243be76d5283cbc8abfe007e148097d4de7337670ff1536c4c7ba1</Hashes>
+                <Hashes condition="contains">SHA256=b9a4e40a5d80fedd1037eaed958f9f9efed41eb01ada73d51b5dcd86e27e0cbf</Hashes>
+                <Hashes condition="contains">SHA256=1273b74c3c1553eaa92e844fbd51f716356cc19cf77c2c780d4899ec7738fbd1</Hashes>
+                <Hashes condition="contains">SHA256=58c071cfe72e9ee867bba85cbd0abe72eb223d27978d6f0650d0103553839b59</Hashes>
+                <Hashes condition="contains">SHA256=f88ebb633406a086d9cca6bc8b66a4ea940c5476529f9033a9e0463512a23a57</Hashes>
+                <Hashes condition="contains">SHA256=d7bc7306cb489fe4c285bbeddc6d1a09e814ef55cf30bd5b8daf87a52396f102</Hashes>
+                <Hashes condition="contains">SHA256=03e0581432f5c8cc727a8aa387f5b69ff84d38d0df6f1226c19c6e960a81e1e9</Hashes>
+                <Hashes condition="contains">SHA256=7d43769b353d63093228a59eb19bba87ce6b552d7e1a99bf34a54eee641aa0ea</Hashes>
+                <Hashes condition="contains">SHA256=2a9d481ffdc5c1e2cb50cf078be32be06b21f6e2b38e90e008edfc8c4f2a9c4e</Hashes>
+                <Hashes condition="contains">SHA256=d969845ef6acc8e5d3421a7ce7e244f419989710871313b04148f9b322751e5d</Hashes>
+                <Hashes condition="contains">SHA256=708016fbe22c813a251098f8f992b177b476bd1bbc48c2ed4a122ff74910a965</Hashes>
+                <Hashes condition="contains">SHA256=7cb497abc44aad09a38160d6a071db499e05ff5871802ccc45d565d242026ee7</Hashes>
+                <Hashes condition="contains">SHA256=2e665962c827ce0adbd29fe6bcf09bbb1d7a7022075d162ff9b65d0af9794ac0</Hashes>
+                <Hashes condition="contains">SHA256=3243aab18e273a9b9c4280a57aecef278e10bfff19abb260d7a7820e41739099</Hashes>
+                <Hashes condition="contains">SHA256=fda93c6e41212e86af07f57ca95db841161f00b08dae6304a51b467056e56280</Hashes>
+                <Hashes condition="contains">SHA256=c2a4ddcc9c3b339d752c48925d62fc4cc5adbf6fae8fedef74cdd47e88da01f8</Hashes>
+                <Hashes condition="contains">SHA256=5ae23f1fcf3fb735fcf1fa27f27e610d9945d668a149c7b7b0c84ffd6409d99a</Hashes>
+                <Hashes condition="contains">SHA256=4744df6ac02ff0a3f9ad0bf47b15854bbebb73c936dd02f7c79293a2828406f6</Hashes>
+                <Hashes condition="contains">SHA256=a7860e110f7a292d621006b7208a634504fb5be417fd71e219060381b9a891e6</Hashes>
+                <Hashes condition="contains">SHA256=bdbceca41e576841cad2f2b38ee6dbf92fd77fbbfdfe6ecf99f0623d44ef182c</Hashes>
+                <Hashes condition="contains">SHA256=7a48f92a9c2d95a72e18055cac28c1e7e6cad5f47aa735cbea5c3b82813ccfaf</Hashes>
+                <Hashes condition="contains">SHA256=17687cba00ec2c9036dd3cb5430aa1f4851e64990dafb4c8f06d88de5283d6ca</Hashes>
+                <Hashes condition="contains">SHA256=3e07bb866d329a2f9aaa4802bad04fdac9163de9bf9cfa1d035f5ca610b4b9bf</Hashes>
+                <Hashes condition="contains">SHA256=b17507a3246020fa0052a172485d7b3567e0161747927f2edf27c40e310852e0</Hashes>
+                <Hashes condition="contains">SHA256=1e16a01ef44e4c56e87abfbe03b2989b0391b172c3ec162783ad640be65ab961</Hashes>
+                <Hashes condition="contains">SHA256=82fbcb371d53b8a76a25fbbafaae31147c0d1f6b9f26b3ea45262c2267386989</Hashes>
+                <Hashes condition="contains">SHA256=ad23d77a38655acb71216824e363df8ac41a48a1a0080f35a0d23aa14b54460b</Hashes>
+                <Hashes condition="contains">SHA256=28999af32b55ddb7dcfc26376a244aa2fe297233ce7abe4919a1aef2f7e2cee7</Hashes>
+                <Hashes condition="contains">SHA256=2270a8144dabaf159c2888519b11b61e5e13acdaa997820c09798137bded3dd6</Hashes>
+                <Hashes condition="contains">SHA256=27cd05527feb020084a4a76579c125458571da8843cdfc3733211760a11da970</Hashes>
+                <Hashes condition="contains">SHA256=592f56b13e7dcaa285da64a0b9a48be7562bd9b0a190208b7c8b7d8de427cf6c</Hashes>
+                <Hashes condition="contains">SHA256=3871e16758a1778907667f78589359734f7f62f9dc953ec558946dcdbe6951e3</Hashes>
+                <Hashes condition="contains">SHA256=1d0397c263d51e9fc95bcc8baf98d1a853e1c0401cd0e27c7bf5da3fba1c93a8</Hashes>
+                <Hashes condition="contains">SHA256=4941c4298f4560fc1e59d0f16f84bab5c060793700b82be2fd7c63735f1657a8</Hashes>
+                <Hashes condition="contains">SHA256=80eeb8c2890f3535ed14f5881baf2f2226e6763be099d09fb8aadaba5b4474c1</Hashes>
+                <Hashes condition="contains">SHA256=175eed7a4c6de9c3156c7ae16ae85c554959ec350f1c8aaa6dfe8c7e99de3347</Hashes>
+                <Hashes condition="contains">SHA256=5f7e47d728ac3301eb47b409801a0f4726a435f78f1ed02c30d2a926259c71f3</Hashes>
+                <Hashes condition="contains">SHA256=358ac54be252673841a1d65bfc2fb6d549c1a4c877fa7f5e1bfa188f30375d69</Hashes>
+                <Hashes condition="contains">SHA256=6fb5bc9c51f6872de116c7db8a2134461743908efc306373f6de59a0646c4f5d</Hashes>
+                <Hashes condition="contains">SHA256=0f016c80c4938fbcd47a47409969b3925f54292eba2ce01a8e45222ce8615eb8</Hashes>
+                <Hashes condition="contains">SHA256=478d855b648ef4501d3b08b3b10e94076ac67546b0ce86b454324f1bf9a78aa0</Hashes>
+                <Hashes condition="contains">SHA256=a7c8f4faf3cbb088cac7753d81f8ec4c38ccb97cd9da817741f49272e8d01200</Hashes>
+                <Hashes condition="contains">SHA256=f1c8ca232789c2f11a511c8cd95a9f3830dd719cad5aa22cb7c3539ab8cb4dc3</Hashes>
+                <Hashes condition="contains">SHA256=8f68ca89910ebe9da3d02ec82d935de1814d79c44f36cd30ea02fa49ae488f00</Hashes>
+                <Hashes condition="contains">SHA256=1afa03118f87b62c59a97617e595ebb26dde8dbdd16ee47ef3ddd1097c30ef6a</Hashes>
+                <Hashes condition="contains">SHA256=e75714f8e0ff45605f6fc7689a1a89c7dcd34aab66c6131c63fefaca584539cf</Hashes>
+                <Hashes condition="contains">SHA256=38fa0c663c8689048726666f1c5e019feaa9da8278f1df6ff62da33961891d2a</Hashes>
+                <Hashes condition="contains">SHA256=b583414fcee280128788f7b39451c511376fe821f455d4f3702795e96d560704</Hashes>
+                <Hashes condition="contains">SHA256=1ee59eb28688e73d10838c66e0d8e011c8df45b6b43a4ac5d0b75795ca3eb512</Hashes>
+                <Hashes condition="contains">SHA256=ef86c4e5ee1dbc4f81cd864e8cd2f4a2a85ee4475b9a9ab698a4ae1cc71fbeb0</Hashes>
+                <Hashes condition="contains">SHA256=29e0062a017a93b2f2f5207a608a96df4d554c5de976bd0276c2590a03bd3e94</Hashes>
+                <Hashes condition="contains">SHA256=c628cda1ef43defc00af45b79949675a8422490d32b080b3a8bb9434242bdbf2</Hashes>
+                <Hashes condition="contains">SHA256=38d87b51f4b69ba2dae1477684a1415f1a3b578eee5e1126673b1beaefee9a20</Hashes>
+                <Hashes condition="contains">SHA256=3d9e83b189fcf5c3541c62d1f54a0da0a4e5b62c3243d2989afc46644056c8e3</Hashes>
+                <Hashes condition="contains">SHA256=88df37ede18bea511f1782c1a6c4915690b29591cf2c1bf5f52201fbbb4fa2b9</Hashes>
+                <Hashes condition="contains">SHA256=e2e79f1e696f27fa70d72f97e448081b1fa14d59cbb89bb4a40428534dd5c6f6</Hashes>
+                <Hashes condition="contains">SHA256=e50b25d94c1771937b2f632e10eea875ac6b19c57da703d52e23ad2b6299f0ae</Hashes>
+                <Hashes condition="contains">SHA256=841335eeb6af68dce5b8b24151776281a751b95056a894991b23afae80e9f33b</Hashes>
+                <Hashes condition="contains">SHA256=9d58f640c7295952b71bdcb456cae37213baccdcd3032c1e3aeb54e79081f395</Hashes>
+                <Hashes condition="contains">SHA256=19bf0d0f55d2ad33ef2d105520bde8fb4286f00e9d7a721e3c9587b9408a0775</Hashes>
+                <Hashes condition="contains">SHA256=da11e9598eef033722b97873d1c046270dd039d0e3ee6cd37911e2dc2eb2608d</Hashes>
+                <Hashes condition="contains">SHA256=2d83ccb1ad9839c9f5b3f10b1f856177df1594c66cbbc7661677d4b462ebf44d</Hashes>
+                <Hashes condition="contains">SHA256=7cfa5e10dff8a99a5d544b011f676bc383991274c693e21e3af40cf6982adb8c</Hashes>
+                <Hashes condition="contains">SHA256=316a27e2bdb86222bc7c8af4e5472166b02aec7f3f526901ce939094e5861f6d</Hashes>
+                <Hashes condition="contains">SHA256=7196187fb1ef8d108b380d37b2af8efdeb3ca1f6eefd37b5dc114c609147216d</Hashes>
+                <Hashes condition="contains">SHA256=d0e25b879d830e4f867b09d6540a664b6f88bad353cd14494c33b31a8091f605</Hashes>
+                <Hashes condition="contains">SHA256=bced04bdefad6a08c763265d6993f07aa2feb57d33ed057f162a947cf0e6668f</Hashes>
+                <Hashes condition="contains">SHA256=2101d5e80e92c55ecfd8c24fcf2202a206a4fd70195a1378f88c4cc04d336f22</Hashes>
+                <Hashes condition="contains">SHA256=9778136d2441439dc470861d15d96fa21dc9f16225232cd05b76791a5e0fde6f</Hashes>
+                <Hashes condition="contains">SHA256=18e1707b319c279c7e0204074088cc39286007a1cf6cb6e269d5067d8d0628c6</Hashes>
+                <Hashes condition="contains">SHA256=2bbc6b9dd5e6d0327250b32305be20c89b19b56d33a096522ee33f22d8c82ff1</Hashes>
+                <Hashes condition="contains">SHA256=7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d</Hashes>
+                <Hashes condition="contains">SHA256=45f42c5d874369d6be270ea27a5511efcca512aeac7977f83a51b7c4dee6b5ef</Hashes>
+                <Hashes condition="contains">SHA256=fb6b0d304433bf88cc7d57728683dbb4b9833459dc33528918ead09b3907ff22</Hashes>
+                <Hashes condition="contains">SHA256=677c0b1add3990fad51f492553d3533115c50a242a919437ccb145943011d2bf</Hashes>
+                <Hashes condition="contains">SHA256=385485e643aa611e97ceae6590c6a8c47155886123dbb9de1e704d0d1624d039</Hashes>
+                <Hashes condition="contains">SHA256=71ff60722231c7641ad593756108cf6779dbaad21c7b08065fb1d4e225eab14d</Hashes>
+                <Hashes condition="contains">SHA256=ad2477632b9b07588cfe0e692f244c05fa4202975c1fe91dd3b90fa911ac6058</Hashes>
+                <Hashes condition="contains">SHA256=727e8ba66a8ff07bdc778eacb463b65f2d7167a6616ca2f259ea32571cacf8af</Hashes>
+                <Hashes condition="contains">SHA256=af095de15a16255ca1b2c27dad365dff9ac32d2a75e8e288f5a1307680781685</Hashes>
+                <Hashes condition="contains">SHA256=cfb7af8ac67a379e7869289aeee21837c448ea6f8ab6c93988e7aa423653bd40</Hashes>
+                <Hashes condition="contains">SHA256=0c512b615eac374d4d494e3c36838d8e788b3dc2691bf27916f7f42694b14467</Hashes>
+                <Hashes condition="contains">SHA256=fb81b5f8bf69637dbdf050181499088a67d24577587bc520de94b5ee8996240f</Hashes>
+                <Hashes condition="contains">SHA256=440883cd9d6a76db5e53517d0ec7fe13d5a50d2f6a7f91ecfc863bc3490e4f5c</Hashes>
+                <Hashes condition="contains">SHA256=e3936d3356573ce2e472495cd3ce769f49a613e453b010433dafce5ea498ddc2</Hashes>
+                <Hashes condition="contains">SHA256=5f487829527802983d5c120e3b99f3cf89333ca14f5e49ac32df0798cfb1f7aa</Hashes>
+                <Hashes condition="contains">SHA256=673b63b67345773cd6d66f6adcf2c753e2d949232bff818d5bb6e05786538d92</Hashes>
+                <Hashes condition="contains">SHA256=72c0d2d699d0440db17cb7cbbc06a253eaafd21465f14bb0fed8b85ae73153d1</Hashes>
+                <Hashes condition="contains">SHA256=ad8ffccfde782bc287241152cf24245a8bf21c2530d81c57e17631b3c4adb833</Hashes>
+                <Hashes condition="contains">SHA256=e61a54f6d3869b43c4eceac3016df73df67cce03878c5a6167166601c5d3f028</Hashes>
+                <Hashes condition="contains">SHA256=5cfad3d473961763306d72c12bd5ae14183a1a5778325c9acacca764b79ca185</Hashes>
+                <Hashes condition="contains">SHA256=436ccab6f62fa2d29827916e054ade7acae485b3de1d3e5c6c62d3debf1480e7</Hashes>
+                <Hashes condition="contains">SHA256=8399e5afd8e3e97139dffb1a9fb00db2186321b427f164403282217cab067c38</Hashes>
+                <Hashes condition="contains">SHA256=b48a309ee0960da3caaaaf1e794e8c409993aeb3a2b64809f36b97aac8a1e62a</Hashes>
+                <Hashes condition="contains">SHA256=dbb457ae1bd07a945a1466ce4a206c625e590aee3922fa7d86fbe956beccfc98</Hashes>
+                <Hashes condition="contains">SHA256=6071db01b50c658cf78665c24f1d21f21b4a12d16bfcfaa6813bf6bbc4d0a1e8</Hashes>
+                <Hashes condition="contains">SHA256=e428ddf9afc9b2d11e2271f0a67a2d6638b860c2c12d4b8cc63d33f3349ee93f</Hashes>
+                <Hashes condition="contains">SHA256=6c64688444d3e004da77dcfb769d064bb38afceeef7ff915dfc71e60e19ff18a</Hashes>
+                <Hashes condition="contains">SHA256=aa9ab1195dc866270e984f1bed5e1358d6ef24c515dfdb6c2a92d1e1b94bf608</Hashes>
+                <Hashes condition="contains">SHA256=1023dcd4c80db19e9f82f95b1c5e1ddb60db7ac034848dd5cc1c78104a6350f4</Hashes>
+                <Hashes condition="contains">SHA256=de3597ae7196ca8c0750dce296a8a4f58893774f764455a125464766fcc9b3b5</Hashes>
+                <Hashes condition="contains">SHA256=47f0cdaa2359a63ad1389ef4a635f1f6eee1f63bdf6ef177f114bdcdadc2e005</Hashes>
+                <Hashes condition="contains">SHA256=db2a9247177e8cdd50fe9433d066b86ffd2a84301aa6b2eb60f361cfff077004</Hashes>
+                <Hashes condition="contains">SHA256=6948480954137987a0be626c24cf594390960242cd75f094cd6aaa5c2e7a54fa</Hashes>
+                <Hashes condition="contains">SHA256=6f55c148bb27c14408cf0f16f344abcd63539174ac855e510a42d78cfaec451c</Hashes>
+                <Hashes condition="contains">SHA256=3e274df646f191d2705c0beaa35eeea84808593c3b333809f13632782e27ad75</Hashes>
+                <Hashes condition="contains">SHA256=ab8f2217e59319b88080e052782e559a706fa4fb7b8b708f709ff3617124da89</Hashes>
+                <Hashes condition="contains">SHA256=0be4912bfd7a79f6ebfa1c06a59f0fb402bd4fe0158265780509edd0e562eac1</Hashes>
+                <Hashes condition="contains">SHA256=77c5e95b872b1d815d6d3ed28b399ca39f3427eeb0143f49982120ff732285a9</Hashes>
+                <Hashes condition="contains">SHA256=42579a759f3f95f20a2c51d5ac2047a2662a2675b3fb9f46c1ed7f23393a0f00</Hashes>
+                <Hashes condition="contains">SHA256=11d258e05b850dcc9ecfacccc9486e54bd928aaa3d5e9942696c323fdbd3481b</Hashes>
+                <Hashes condition="contains">SHA256=5027fce41ed60906a0e76b97c95c2a5a83d57a2d1cd42de232a21f26c0d58e48</Hashes>
+                <Hashes condition="contains">SHA256=955dac77a0148e9f9ed744f5d341cb9c9118261e52fe622ac6213965f2bc4cad</Hashes>
+                <Hashes condition="contains">SHA256=80a59ca71fc20961ccafc0686051e86ae4afbbd4578cb26ad4570b9207651085</Hashes>
+                <Hashes condition="contains">SHA256=dfaefd06b680f9ea837e7815fc1cc7d1f4cc375641ac850667ab20739f46ad22</Hashes>
+                <Hashes condition="contains">SHA256=0d3790af5f8e5c945410929e31d06144a471ac82f828afe89a4758a5bbeb7f9f</Hashes>
+                <Hashes condition="contains">SHA256=50db5480d0392a7dd6ab5df98389dc24d1ed1e9c98c9c35964b19dabcd6dc67f</Hashes>
+                <Hashes condition="contains">SHA256=862d0ff27bb086145a33b9261142838651b0d2e1403be321145e197600eb5015</Hashes>
+                <Hashes condition="contains">SHA256=fca10cde7d331b7f614118682d834d46125a65888e97bd9fda2df3f15797166c</Hashes>
+                <Hashes condition="contains">SHA256=c50f8ab8538c557963252b702c1bd3cee4604b5fc2497705d2a6a3fd87e3cc26</Hashes>
+                <Hashes condition="contains">SHA256=1c1251784e6f61525d0082882a969cb8a0c5d5359be22f5a73e3b0cd38b51687</Hashes>
+                <Hashes condition="contains">SHA256=c8eaa5e6d3230b93c126d2d58e32409e4aeeb23ccf0dd047a17f1ef552f92fe9</Hashes>
+                <Hashes condition="contains">SHA256=31f4140c12ac31f5729a8de4dc051d3acd07783564604df831a2a6722c979192</Hashes>
+                <Hashes condition="contains">SHA256=88e2e6a705d3fb71b966d9fb46dc5a4b015548daf585fb54dfcd81dc0bd3ebdc</Hashes>
+                <Hashes condition="contains">SHA256=f8965fdce668692c3785afa3559159f9a18287bc0d53abb21902895a8ecf221b</Hashes>
+                <Hashes condition="contains">SHA256=3b6e85c8fed9e39b21b2eab0b69bc464272b2c92961510c36e2e2df7aa39861b</Hashes>
+                <Hashes condition="contains">SHA256=399effe75d32bdab6fa0a6bffe02dbf0a59219d940b654837c3be1c0bd02e9aa</Hashes>
+                <Hashes condition="contains">SHA256=092349aebdac28294dbad1656759d8461f362d1a36b01054dccf861d97beadf0</Hashes>
+                <Hashes condition="contains">SHA256=074ae477c8c7ae76c6f2b0bf77ac17935a8e8ee51b52155d2821d93ab30f3761</Hashes>
+                <Hashes condition="contains">SHA256=b47be212352d407d0ef7458a7161c66b47c2aec8391dd101df11e65728337a6a</Hashes>
+                <Hashes condition="contains">SHA256=b51ddcf8309c80384986dda9b11bf7856b030e3e885b0856efdb9e84064917e5</Hashes>
+                <Hashes condition="contains">SHA256=fd33fb2735cc5ef466a54807d3436622407287e325276fcd3ed1290c98bd0533</Hashes>
+                <Hashes condition="contains">SHA256=523d1d43e896077f32cd9acaa8e85b513bfb7b013a625e56f0d4e9675d9822ba</Hashes>
+                <Hashes condition="contains">SHA256=f4ff679066269392f6b7c3ba6257fc60dd609e4f9c491b00e1a16e4c405b0b9b</Hashes>
+                <Hashes condition="contains">SHA256=d5c4ff35eaa74ccdb80c7197d3d113c9cd38561070f2aa69c0affe8ed84a77c9</Hashes>
+                <Hashes condition="contains">SHA256=6cb51ae871fbd5d07c5aad6ff8eea43d34063089528603ca9ceb8b4f52f68ddc</Hashes>
+                <Hashes condition="contains">SHA256=7e3b0b8d3e430074109d85729201d7c34bc5b918c0bcb9f64ce88c5e37e1a456</Hashes>
+                <Hashes condition="contains">SHA256=c5050a2017490fff7aa53c73755982b339ddb0fd7cef2cde32c81bc9834331c5</Hashes>
+                <Hashes condition="contains">SHA256=0f17e5cfc5bdd74aff91bfb1a836071345ba2b5d1b47b0d5bf8e7e0d4d5e2dbf</Hashes>
+                <Hashes condition="contains">SHA256=3a95cc82173032b82a0ffc7d2e438df64c13bc16b4574214c9fe3be37250925e</Hashes>
+                <Hashes condition="contains">SHA256=4ab41816abbf14d59e75b7fad49e2cb1c1feb27a3cb27402297a2a4793ff9da7</Hashes>
+                <Hashes condition="contains">SHA256=42e170a7ab1d2c160d60abfc906872f9cfd0c2ee169ed76f6acb3f83b3eeefdb</Hashes>
+                <Hashes condition="contains">SHA256=496f4a4021226fb0f1b5f71a7634c84114c29faa308746a12c2414adb6b2a40b</Hashes>
+                <Hashes condition="contains">SHA256=9a1d66036b0868bbb1b2823209fedea61a301d5dd245f8e7d390bd31e52d663e</Hashes>
+                <Hashes condition="contains">SHA256=a7b000abbcc344444a9b00cfade7aa22ab92ce0cadec196c30eb1851ae4fa062</Hashes>
+                <Hashes condition="contains">SHA256=38bb9751a3a1f072d518afe6921a66ee6d5cf6d25bc50af49e1925f20d75d4d7</Hashes>
+                <Hashes condition="contains">SHA256=86a8e0aa29a5b52c84921188cc1f0eca9a7904dcfe09544602933d8377720219</Hashes>
+                <Hashes condition="contains">SHA256=1b00d6e5d40b1b84ca63da0e99246574cdd2a533122bc83746f06c0d66e63a6e</Hashes>
+                <Hashes condition="contains">SHA256=6c7120e40fc850e4715058b233f5ad4527d1084a909114fd6a36b7b7573c4a44</Hashes>
+                <Hashes condition="contains">SHA256=e58bbf3251906ff722aa63415bf169618e78be85cb92c8263d3715c260491e90</Hashes>
+                <Hashes condition="contains">SHA256=000547560fea0dd4b477eb28bf781ea67bf83c748945ce8923f90fdd14eb7a4b</Hashes>
+                <Hashes condition="contains">SHA256=53eaefba7e7dca9ab74e385abf18762f9f1aa51594e7f7db5ba612d6c787dd7e</Hashes>
+                <Hashes condition="contains">SHA256=7837cb350338c4958968d06b105466da6518f5bb522a6e70e87c0cad85128408</Hashes>
+                <Hashes condition="contains">SHA256=6e0aa67cfdbe27a059cbd066443337f81c5b6d37444d14792d1c765d9d122dcf</Hashes>
+                <Hashes condition="contains">SHA256=3503ea284b6819f9cb43b3e94c0bb1bf5945ccb37be6a898387e215197a4792a</Hashes>
+                <Hashes condition="contains">SHA256=37dde6bd8a7a36111c3ac57e0ac20bbb93ce3374d0852bcacc9a2c8c8c30079e</Hashes>
+                <Hashes condition="contains">SHA256=54841d9f89e195196e65aa881834804fe3678f1cf6b328cab8703edd15e3ec57</Hashes>
+                <Hashes condition="contains">SHA256=48891874441c6fa69e5518d98c53d83b723573e280c6c65ccfbde9039a6458c9</Hashes>
+                <Hashes condition="contains">SHA256=37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba</Hashes>
+                <Hashes condition="contains">SHA256=01aa278b07b58dc46c84bd0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd</Hashes>
+                <Hashes condition="contains">SHA256=f29073dc99cb52fa890aae80037b48a172138f112474a1aecddae21179c93478</Hashes>
+                <Hashes condition="contains">SHA256=e3f2ee22dec15061919583e4beb8abb3b29b283e2bcb46badf2bfde65f5ea8dd</Hashes>
+                <Hashes condition="contains">SHA256=20f11a64bc4548f4edb47e3d3418da0f6d54a83158224b71662a6292bf45b5fb</Hashes>
+                <Hashes condition="contains">SHA256=38b3eb8c86201d26353aab625cea672e60c2f66ce6f5e5eda673e8c3478bf305</Hashes>
+                <Hashes condition="contains">SHA256=ea85bbe63d6f66f7efee7007e770af820d57f914c7f179c5fee3ef2845f19c41</Hashes>
+                <Hashes condition="contains">SHA256=d74755311d127d0eb7454e56babc2db8dbaa814bc4ba8e2a7754d3e0224778e1</Hashes>
+                <Hashes condition="contains">SHA256=e32ab30d01dcff6418544d93f99ae812d2ce6396e809686620547bea05074f6f</Hashes>
+                <Hashes condition="contains">SHA256=69e3fda487a5ec2ec0f67b7d79a5a836ff0036497b2d1aec514c67d2efa789b2</Hashes>
+                <Hashes condition="contains">SHA256=9ee33ffd80611a13779df6286c1e04d3c151f1e2f65e3d664a08997fcd098ef3</Hashes>
+                <Hashes condition="contains">SHA256=de6bf572d39e2611773e7a01f0388f84fb25da6cba2f1f8b9b36ffba467de6fa</Hashes>
+                <Hashes condition="contains">SHA256=fc22977ff721b3d718b71c42440ee2d8a144f3fbc7755e4331ddd5bcc65158d2</Hashes>
+                <Hashes condition="contains">SHA256=6de84caa2ca18673e01b91af58220c60aecd5cccf269725ec3c7f226b2167492</Hashes>
+                <Hashes condition="contains">SHA256=0e53b58415fa68552928622118d5b8a3a851b2fc512709a90b63ba46acda8b6b</Hashes>
+                <Hashes condition="contains">SHA256=3279593db91bb7ad5b489a01808c645eafafda6cc9c39f50d10ccc30203f2ddf</Hashes>
+                <Hashes condition="contains">SHA256=d8459f7d707c635e2c04d6d6d47b63f73ba3f6629702c7a6e0df0462f6478ae2</Hashes>
+                <Hashes condition="contains">SHA256=61befeef14783eb0fed679fca179d2f5c33eb2dcbd40980669ca2ebeb3bf11cf</Hashes>
+                <Hashes condition="contains">SHA256=7cc9ba2df7b9ea6bb17ee342898edd7f54703b93b6ded6a819e83a7ee9f938b4</Hashes>
+                <Hashes condition="contains">SHA256=9b1ac756e35f795dd91adbc841e78db23cb7165280f8d4a01df663128b66d194</Hashes>
+                <Hashes condition="contains">SHA256=6befa481e8cca8084d9ec3a1925782cd3c28ef7a3e4384e034d48deaabb96b63</Hashes>
+                <Hashes condition="contains">SHA256=5b3705b47dc15f2b61ca3821b883b9cd114d83fcc3344d11eb1d3df495d75abe</Hashes>
+                <Hashes condition="contains">SHA256=34bee22c18ddbddbe115cf1ab55cabf0e482aba1eb2c343153577fb24b7226d3</Hashes>
+                <Hashes condition="contains">SHA256=2f60536b25ba8c9014e4a57d7a9a681bd3189fa414eea88c256d029750e15cae</Hashes>
+                <Hashes condition="contains">SHA256=3f2fda9a7a9c57b7138687bbce49a2e156d6095dddabb3454ea09737e02c3fa5</Hashes>
+                <Hashes condition="contains">SHA256=d92eab70bcece4432258c9c9a914483a2267f6ab5ce2630048d3a99e8cb1b482</Hashes>
+                <Hashes condition="contains">SHA256=81aafae4c4158d0b9a6431aff0410745a0f6a43fb20a9ab316ffeb8c2e2ccac0</Hashes>
+                <Hashes condition="contains">SHA256=1c8dfa14888bb58848b4792fb1d8a921976a9463be8334cff45cc96f1276049a</Hashes>
+                <Hashes condition="contains">SHA256=9679758455c69877fce866267d60c39d108b495dca183954e4af869902965b3d</Hashes>
+                <Hashes condition="contains">SHA256=b6fd51e1f57a03006953e84fd56cc2821cc19e7c77c0474e1110aabaacaf03df</Hashes>
+                <Hashes condition="contains">SHA256=9a91d6e83b8fdec536580f6617f10dfc64eedf14ead29a6a644eb154426622ba</Hashes>
+                <Hashes condition="contains">SHA256=6ed35f310c96920a271c59a097b382da07856e40179c2a4239f8daa04eef38e7</Hashes>
+                <Hashes condition="contains">SHA256=cff9aa9046bdfd781d34f607d901a431a51bb7e5f48f4f681cc743b2cdedc98c</Hashes>
+                <Hashes condition="contains">SHA256=dde6f28b3f7f2abbee59d4864435108791631e9cb4cdfb1f178e5aa9859956d8</Hashes>
+                <Hashes condition="contains">SHA256=59626cac380d8fe0b80a6d4c4406d62ba0683a2f0f68d50ad506ca1b1cf25347</Hashes>
+                <Hashes condition="contains">SHA256=18deed37f60b6aa8634dda2565a0485452487d7bce88afb49301a7352db4e506</Hashes>
+                <Hashes condition="contains">SHA256=01e024cb14b34b6d525c642a710bfa14497ea20fd287c39ba404b10a8b143ece</Hashes>
+                <Hashes condition="contains">SHA256=509628b6d16d2428031311d7bd2add8d5f5160e9ecc0cd909f1e82bbbb3234d6</Hashes>
+                <Hashes condition="contains">SHA256=ada4e42bf5ef58ef1aad94435441003b1cc1fcaa5d38bfdbe1a3d736dc451d47</Hashes>
+                <Hashes condition="contains">SHA256=e2d8dd5dacc24051709f55a35184f5f99aef957a83bd358b0608b4479e1ec24f</Hashes>
+                <Hashes condition="contains">SHA256=c2fcc0fec64d5647813b84b9049d430406c4c6a7b9f8b725da21bcae2ff12247</Hashes>
+                <Hashes condition="contains">SHA256=7c731c0ea7f28671ab7787800db69739ea5cd6be16ea21045b4580cf95cbf73b</Hashes>
+                <Hashes condition="contains">SHA256=34e0364a4952d914f23f271d36e11161fb6bb7b64aea22ff965a967825a4a4bf</Hashes>
+                <Hashes condition="contains">SHA256=cc687fe3741bbde1dd142eac0ef59fd1d4457daee43cdde23bb162ef28d04e64</Hashes>
+                <Hashes condition="contains">SHA256=da6ca1fb539f825ca0f012ed6976baf57ef9c70143b7a1e88b4650bf7a925e24</Hashes>
+                <Hashes condition="contains">SHA256=5fad3775feb8b6f6dcbd1642ae6b6a565ff7b64eadfc9bf9777918b51696ab36</Hashes>
+                <Hashes condition="contains">SHA256=bda99629ec6c522c3efcbcc9ca33688d31903146f05b37d0d3b43db81bfb3961</Hashes>
+                <Hashes condition="contains">SHA256=9790a7b9d624b2b18768bb655dda4a05a9929633cef0b1521e79e40d7de0a05b</Hashes>
+                <Hashes condition="contains">SHA256=1963d5a0e512b72353953aadbe694f73a9a576f0241a988378fa40bf574eda52</Hashes>
+                <Hashes condition="contains">SHA256=ae79e760c739d6214c1e314728a78a6cb6060cce206fde2440a69735d639a0a2</Hashes>
+                <Hashes condition="contains">SHA256=72288d4978ee87ea6c8b1566dbd906107357087cef7364fb3dd1e1896d00baeb</Hashes>
+                <Hashes condition="contains">SHA256=e4eca7db365929ff7c5c785e2eab04ef8ec67ea9edcf7392f2b74eccd9449148</Hashes>
+                <Hashes condition="contains">SHA256=1aaf4c1e3cb6774857e2eef27c17e68dc1ae577112e4769665f516c2e8c4e27b</Hashes>
+                <Hashes condition="contains">SHA256=131d5490ceb9a5b2324d8e927fea5becfc633015661de2f4c2f2375a3a3b64c6</Hashes>
+                <Hashes condition="contains">SHA256=89b0017bc30cc026e32b758c66a1af88bd54c6a78e11ec2908ff854e00ac46be</Hashes>
+                <Hashes condition="contains">SHA256=70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4</Hashes>
+                <Hashes condition="contains">SHA256=626fae47811450d080d08c3d9fd890aa64bfecdc45eacd42a40850c1833c8763</Hashes>
+                <Hashes condition="contains">SHA256=101402d4f5d1ae413ded499c78a5fcbbc7e3bae9b000d64c1dd64e3c48c37558</Hashes>
+                <Hashes condition="contains">SHA256=1078af0c70e03ac17c7b8aa5ee03593f5decfef2f536716646a4ded1e98c153c</Hashes>
+                <Hashes condition="contains">SHA256=8f23313adb35782adb0ba97fefbfbb8bbc5fc40ae272e07f6d4629a5305a3fa2</Hashes>
+                <Hashes condition="contains">SHA256=3a5ec83fe670e5e23aef3afa0a7241053f5b6be5e6ca01766d6b5f9177183c25</Hashes>
+                <Hashes condition="contains">SHA256=2fbbc276737047cb9b3ba5396756d28c1737342d89dce1b64c23a9c4513ae445</Hashes>
+                <Hashes condition="contains">SHA256=98a123b314cba2de65f899cdbfa386532f178333389e0f0fbd544aff85be02eb</Hashes>
+                <Hashes condition="contains">SHA256=2bbe65cbec3bb069e92233924f7ee1f95ffa16173fceb932c34f68d862781250</Hashes>
+                <Hashes condition="contains">SHA256=2470fd1b733314c9b0afa19fd39c5d19aa1b36db598b5ebbe93445caa545da5f</Hashes>
+                <Hashes condition="contains">SHA256=09043c51719d4bf6405c9a7a292bb9bb3bcc782f639b708ddcc4eedb5e5c9ce9</Hashes>
+                <Hashes condition="contains">SHA256=d884ca8cc4ef1826ca3ab03eb3c2d8f356ba25f2d20db0a7d9fc251c565be7f3</Hashes>
+                <Hashes condition="contains">SHA256=55fee54c0d0d873724864dc0b2a10b38b7f40300ee9cae4d9baaf8a202c4049a</Hashes>
+                <Hashes condition="contains">SHA256=4045ae77859b1dbf13972451972eaaf6f3c97bea423e9e78f1c2f14330cd47ca</Hashes>
+                <Hashes condition="contains">SHA256=b95b2d9b29bd25659f1c7ba5a187f8d23cde01162d9b5b1a2c4aea8f64b38441</Hashes>
+                <Hashes condition="contains">SHA256=1766fd66f846d9a21e648d649ad35d1ff94f8ca17a40a9a738444d6b8e07aacb</Hashes>
+                <Hashes condition="contains">SHA256=8111085022bda87e5f6aa4c195e743cc6dd6a3a6d41add475d267dc6b105a69f</Hashes>
+                <Hashes condition="contains">SHA256=c089a31ac95d41ed02d1e4574962f53376b36a9e60ff87769d221dc7d1a3ecfa</Hashes>
+                <Hashes condition="contains">SHA256=b2ba6efeff1860614b150916a77c9278f19d51e459e67a069ccd15f985cbc0e1</Hashes>
+                <Hashes condition="contains">SHA256=823da894b2c73ffcd39e77366b6f1abf0ae9604d9b20140a54e6d55053aadeba</Hashes>
+                <Hashes condition="contains">SHA256=79e2d37632c417138970b4feba91b7e10c2ea251c5efe3d1fc6fa0190f176b57</Hashes>
+                <Hashes condition="contains">SHA256=1aaa9aef39cb3c0a854ecb4ca7d3b213458f302025e0ec5bfbdef973cca9111c</Hashes>
+                <Hashes condition="contains">SHA256=f596e64f4c5d7c37a00493728d8756b243cfdc11e3372d6d6dfeffc13c9ab960</Hashes>
+                <Hashes condition="contains">SHA256=0da746e49fd662be910d0e366934a7e02898714eaaa577e261ab40eb44222b5c</Hashes>
+                <Hashes condition="contains">SHA256=c9cf1d627078f63a36bbde364cd0d5f2be1714124d186c06db5bcdf549a109f8</Hashes>
+                <Hashes condition="contains">SHA256=092d04284fdeb6762e65e6ac5b813920d6c69a5e99d110769c5c1a78e11c5ba0</Hashes>
+                <Hashes condition="contains">SHA256=0ee5067ce48883701824c5b1ad91695998916a3702cf8086962fbe58af74b2d6</Hashes>
+                <Hashes condition="contains">SHA256=2b4c7d3820fe08400a7791e2556132b902a9bbadc1942de57077ecb9d21bf47a</Hashes>
+                <Hashes condition="contains">SHA256=07b6d69bafcfd767f1b63a490a8843c3bb1f8e1bbea56176109b5743c8f7d357</Hashes>
+                <Hashes condition="contains">SHA256=5f5e5f1c93d961985624768b7c676d488c7c7c1d4c043f6fc1ea1904fefb75be</Hashes>
+                <Hashes condition="contains">SHA256=93b266f38c3c3eaab475d81597abbd7cc07943035068bb6fd670dbbe15de0131</Hashes>
+                <Hashes condition="contains">SHA256=dcb815eb8e9016608d0d917101b6af8c84b96fb709dc0344bceed02cbc4ed258</Hashes>
+                <Hashes condition="contains">SHA256=4b5229b3250c8c08b98cb710d6c056144271de099a57ae09f5d2097fc41bd4f1</Hashes>
+                <Hashes condition="contains">SHA256=9dab4b6fddc8e1ec0a186aa8382b184a5d52cfcabaaf04ff9e3767021eb09cf4</Hashes>
+                <Hashes condition="contains">SHA256=6b830ea0db6546a044c9900d3f335e7820c2a80e147b0751641899d1a5aa8f74</Hashes>
+                <Hashes condition="contains">SHA256=ae6fb53e4d8122dba3a65e5fa59185b36c3ac9df46e82fcfb6731ab55c6395aa</Hashes>
+                <Hashes condition="contains">SHA256=7e0124fcc7c95fdc34408cf154cb41e654dade8b898c71ad587b2090b1da30d7</Hashes>
+                <Hashes condition="contains">SHA256=5f69d6b167a1eeca3f6ac64785c3c01976ee7303171faf998d65852056988683</Hashes>
+                <Hashes condition="contains">SHA256=e4a7da2cf59a4a21fc42b611df1d59cae75051925a7ddf42bf216cc1a026eadb</Hashes>
+                <Hashes condition="contains">SHA256=0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5</Hashes>
+                <Hashes condition="contains">SHA256=e005e8d183e853a27ad3bb56f25489f369c11b0d47e3d4095aad9291b3343bf1</Hashes>
+                <Hashes condition="contains">SHA256=5177a3b7393fb5855b2ec0a45d4c91660b958ee077e76e5a7d0669f2e04bcf02</Hashes>
+                <Hashes condition="contains">SHA256=f6cd7353cb6e86e98d387473ed6340f9b44241867508e209e944f548b9db1d5f</Hashes>
+                <Hashes condition="contains">SHA256=7877c1b0e7429453b750218ca491c2825dae684ad9616642eff7b41715c70aca</Hashes>
+                <Hashes condition="contains">SHA256=8137ce22d0d0fc5ea5b174d6ad3506a4949506477b1325da2ccb76511f4c4f60</Hashes>
+                <Hashes condition="contains">SHA256=5d530e111400785d183057113d70623e17af32931668ab7c7fc826f0fd4f91a3</Hashes>
+                <Hashes condition="contains">SHA256=2d195cd4400754cc6f6c3f8ab1fe31627932c3c1bf8d5d0507c292232d1a2396</Hashes>
+                <Hashes condition="contains">SHA256=ee3ff12943ced401e2b6df9e66e8a0be8e449fa9326cab241f471b2d8ffefdd7</Hashes>
+                <Hashes condition="contains">SHA256=65008817eb97635826a8708a6411d7b50f762bab81304e457119d669382944c3</Hashes>
+                <Hashes condition="contains">SHA256=7893307df2fdde25371645a924f0333e1b2de31b6bc839d8e2a908d7830c6504</Hashes>
+                <Hashes condition="contains">SHA256=2121a2bb8ebbf2e6e82c782b6f3c6b7904f686aa495def25cf1cf52a42e16109</Hashes>
+                <Hashes condition="contains">SHA256=e1980c6592e6d2d92c1a65acad8f1071b6a404097bb6fcce494f3c8ac31385cf</Hashes>
+                <Hashes condition="contains">SHA256=f85784fa8e7a7ec86cb3fe76435802f6bb82256e1824ed7b5d61bf075f054573</Hashes>
+                <Hashes condition="contains">SHA256=8688e43d94b41eeca2ed458b8fc0d02f74696a918e375ecd3842d8627e7a8f2b</Hashes>
+                <Hashes condition="contains">SHA256=f581decc2888ef27ee1ea85ea23bbb5fb2fe6a554266ff5a1476acd1d29d53af</Hashes>
+                <Hashes condition="contains">SHA256=61a1bdddd3c512e681818debb5bee94db701768fc25e674fcad46592a3259bd0</Hashes>
+                <Hashes condition="contains">SHA256=4b4c925c3b8285aeeab9b954e8b2a0773b4d2d0e18d07d4a9d268f4be90f6cae</Hashes>
+                <Hashes condition="contains">SHA256=ac63c26ca43701dddaa7fb1aea535d42190f88752900a03040fd5aaa24991e25</Hashes>
+                <Hashes condition="contains">SHA256=7dfc2eb033d2e090540860b8853036f40736d02bd22099ff6cf665a90be659cd</Hashes>
+                <Hashes condition="contains">SHA256=b773511fdb2e370dec042530910a905472fcc2558eb108b246fd3200171b04d3</Hashes>
+                <Hashes condition="contains">SHA256=2da330a2088409efc351118445a824f11edbe51cf3d653b298053785097fe40e</Hashes>
+                <Hashes condition="contains">SHA256=f85eb576acb5db0d2f48e5f09a7244165a876fa1ca8697ebb773e4d7071d4439</Hashes>
+                <Hashes condition="contains">SHA256=e4d9f037411284e996a002b15b49bc227d085ee869ae1cd91ba54ff7c244f036</Hashes>
+                <Hashes condition="contains">SHA256=36e3127f045ef1fa7426a3ff8c441092d3b66923d2b69826034e48306609e289</Hashes>
+                <Hashes condition="contains">SHA256=950a4c0c772021cee26011a92194f0e58d61588f77f2873aa0599dff52a160c9</Hashes>
+                <Hashes condition="contains">SHA256=5c04c274a708c9a7d993e33be3ea9e6119dc29527a767410dbaf93996f87369a</Hashes>
+                <Hashes condition="contains">SHA256=0fd2df82341bf5ebb8a53682e60d08978100c01acb0bed7b6ce2876ada80f670</Hashes>
+                <Hashes condition="contains">SHA256=904e0f7d485a98e8497d5ec6dd6e6e1cf0b8d8e067fb64a9e09790af3c8c9d5a</Hashes>
+                <Hashes condition="contains">SHA256=3ec5ad51e6879464dfbccb9f4ed76c6325056a42548d5994ba869da9c4c039a8</Hashes>
+                <Hashes condition="contains">SHA256=3c4207c90c97733fae2a08679d63fbbe94dfcf96fdfdf88406aa7ab3f80ea78f</Hashes>
+                <Hashes condition="contains">SHA256=077aa8ff5e01747723b6d24cc8af460a7a00f30cd3bc80e41cc245ceb8305356</Hashes>
+                <Hashes condition="contains">SHA256=cfcf32f5662791f1f22a77acb6dddfbc970fe6e99506969b3ea67c03f67687ab</Hashes>
+                <Hashes condition="contains">SHA256=6bfc0f425de9f4e7480aa2d1f2e08892d0553ed0df1c31e9bf3d8d702f38fa2e</Hashes>
+                <Hashes condition="contains">SHA256=f15ae970e222ce06dbf3752b223270d0e726fb78ebec3598b4f8225b5a0880b1</Hashes>
+                <Hashes condition="contains">SHA256=e86cb77de7b6a8025f9a546f6c45d135f471e664963cf70b381bee2dfd0fdef4</Hashes>
+                <Hashes condition="contains">SHA256=654c5ba47f74008c8f49cbb97988017eec8c898adc3bb851bc6e1fdf9dcf54ad</Hashes>
+                <Hashes condition="contains">SHA256=ad40e6d0f77c0e579fb87c5106bf6de3d1a9f30ee2fbf8c9c011f377fa05f173</Hashes>
+                <Hashes condition="contains">SHA256=6ffdde6bc6784c13c601442e47157062941c47015891e7139c2aaba676ab59cc</Hashes>
+                <Hashes condition="contains">SHA256=81939e5c12bd627ff268e9887d6fb57e95e6049f28921f3437898757e7f21469</Hashes>
+                <Hashes condition="contains">SHA256=80cbba9f404df3e642f22c476664d63d7c229d45d34f5cd0e19c65eb41becec3</Hashes>
+                <Hashes condition="contains">SHA256=ab2632a4d93a7f3b7598c06a9fdc773a1b1b69a7dd926bdb7cf578992628e9dd</Hashes>
+                <Hashes condition="contains">SHA256=22418016e980e0a4a2d01ca210a17059916a4208352c1018b0079ccb19aaf86a</Hashes>
+                <Hashes condition="contains">SHA256=f51bdb0ad924178131c21e39a8ccd191e46b5512b0f2e1cc8486f63e84e5d960</Hashes>
+                <Hashes condition="contains">SHA256=119c48b79735fda0ecd973d77d9bdc6b329960caed09b38ab454236ca039d280</Hashes>
+                <Hashes condition="contains">SHA256=62f5e13b2edc00128716cb93e6a9eddffea67ce83d2bb426f18f5be08ead89e0</Hashes>
+                <Hashes condition="contains">SHA256=0b542e47248611a1895018ec4f4033ea53464f259c74eb014d018b19ad818917</Hashes>
+                <Hashes condition="contains">SHA256=5a826b4fa10891cf63aae832fc645ce680a483b915c608ca26cedbb173b1b80a</Hashes>
+                <Hashes condition="contains">SHA256=7133a461aeb03b4d69d43f3d26cd1a9e3ee01694e97a0645a3d8aa1a44c39129</Hashes>
+                <Hashes condition="contains">SHA256=2a6212f3b68a6f263e96420b3607b31cfdfe51afff516f3c87d27bf8a89721e8</Hashes>
+                <Hashes condition="contains">SHA256=453be8f63cc6b116e2049659e081d896491cf1a426e3d5f029f98146a3f44233</Hashes>
+                <Hashes condition="contains">SHA256=cdfbe62ef515546f1728189260d0bdf77167063b6dbb77f1db6ed8b61145a2bc</Hashes>
+                <Hashes condition="contains">SHA256=3c5d7069f85ec1d6f58147431f88c4d7c48df73baf94ffdefd664f2606baf09c</Hashes>
+                <Hashes condition="contains">SHA256=ded2927f9a4e64eefd09d0caba78e94f309e3a6292841ae81d5528cab109f95d</Hashes>
+                <Hashes condition="contains">SHA256=ac3f613d457fc4d44fa27b2e0b1baa62c09415705efb5a40a4756da39b3ac165</Hashes>
+                <Hashes condition="contains">SHA256=fa875178ae2d7604d027510b0d0a7e2d9d675e10a4c9dda2d927ee891e0bcb91</Hashes>
+                <Hashes condition="contains">SHA256=2003b478b9fd1b3d76ec5bf4172c2e8915babbbee7ad1783794acbf8d4c2519d</Hashes>
+                <Hashes condition="contains">SHA256=60c6f4f34c7319cb3f9ca682e59d92711a05a2688badbae4891b1303cd384813</Hashes>
+                <Hashes condition="contains">SHA256=47eaebc920ccf99e09fc9924feb6b19b8a28589f52783327067c9b09754b5e84</Hashes>
+                <Hashes condition="contains">SHA256=0de4247e72d378713bcf22d5c5d3874d079203bb4364e25f67a90d5570bdcce8</Hashes>
+                <Hashes condition="contains">SHA256=1a42ebde59e8f63804eaa404f79ee93a16bb33d27fb158c6bfbe6143226899a0</Hashes>
+                <Hashes condition="contains">SHA256=76614f2e372f33100a8d92bf372cdbc1e183930ca747eed0b0cf2501293b990a</Hashes>
+                <Hashes condition="contains">SHA256=405472a8f9400a54bb29d03b436ccd58cfd6442fe686f6d2ed4f63f002854659</Hashes>
+                <Hashes condition="contains">SHA256=15fb486b6b8c2a2f1b067f48fba10c2f164638fe5e6cee618fb84463578ecac9</Hashes>
+                <Hashes condition="contains">SHA256=deecbcd260849178de421d8e2f177dce5c63cf67a48abb23a0e3cf3aa3e00578</Hashes>
+                <Hashes condition="contains">SHA256=08eb2d2aa25c5f0af4e72a7e0126735536f6c2c05e9c7437282171afe5e322c6</Hashes>
+                <Hashes condition="contains">SHA256=49329fa09f584d1960b09c1b15df18c0bc1c4fdb90bf48b6b5703e872040b668</Hashes>
+                <Hashes condition="contains">SHA256=c26b51b4c37330800cff8519252e110116c3aaade94ceb9894ec5bfb1b8f9924</Hashes>
+                <Hashes condition="contains">SHA256=7ec93f34eb323823eb199fbf8d06219086d517d0e8f4b9e348d7afd41ec9fd5d</Hashes>
+                <Hashes condition="contains">SHA256=4e37592a2a415f520438330c32cfbdbd6af594deef5290b2fa4b9722b898ff69</Hashes>
+                <Hashes condition="contains">SHA256=6f1fc8287dd8d724972d7a165683f2b2ad6837e16f09fe292714e8e38ecd1e38</Hashes>
+                <Hashes condition="contains">SHA256=85866e8c25d82c1ec91d7a8076c7d073cccf421cf57d9c83d80d63943a4edd94</Hashes>
+                <Hashes condition="contains">SHA256=6f1ff29e2e710f6d064dc74e8e011331d807c32cc2a622cbe507fd4b4d43f8f4</Hashes>
+                <Hashes condition="contains">SHA256=0cf6c6c2d231eaf67dfc87561cc9a56ecef89ab50baafee5a67962748d51faf3</Hashes>
+                <Hashes condition="contains">SHA256=fafa1bb36f0ac34b762a10e9f327dcab2152a6d0b16a19697362d49a31e7f566</Hashes>
+                <Hashes condition="contains">SHA256=bb50818a07b0eb1bd317467139b7eb4bad6cd89053fecdabfeae111689825955</Hashes>
+                <Hashes condition="contains">SHA256=4324f3d1e4007f6499a3d0f0102cd92ed9f554332bc0b633305cd7b957ff16c8</Hashes>
+                <Hashes condition="contains">SHA256=be54f7279e69fb7651f98e91d24069dbc7c4c67e65850e486622ccbdc44d9a57</Hashes>
+                <Hashes condition="contains">SHA256=845f1e228de249fc1ddf8dc28c39d03e8ad328a6277b6502d3932e83b879a65a</Hashes>
+                <Hashes condition="contains">SHA256=2a652de6b680d5ad92376ad323021850dab2c653abf06edf26120f7714b8e08a</Hashes>
+                <Hashes condition="contains">SHA256=8797d9afc7a6bb0933f100a8acbb5d0666ec691779d522ac66c66817155b1c0d</Hashes>
+                <Hashes condition="contains">SHA256=30abc0cc700fdebc74e62d574addc08f6227f9c7177d9eaa8cbc37d5c017c9bb</Hashes>
+                <Hashes condition="contains">SHA256=4d0580c20c1ba74cf90d44c82d040f0039542eea96e4bbff3996e6760f457cee</Hashes>
+                <Hashes condition="contains">SHA256=51e91dd108d974ae809e5fc23f6fbd16e13f672f86aa594dae4a5c4bc629b0b5</Hashes>
+                <Hashes condition="contains">SHA256=e81230217988f3e7ec6f89a06d231ec66039bdba340fd8ebb2bbb586506e3293</Hashes>
+                <Hashes condition="contains">SHA256=14adbf0bc43414a7700e5403100cff7fc6ade50bebfab16a17acf2fdda5a9da8</Hashes>
+                <Hashes condition="contains">SHA256=db90e554ad249c2bd888282ecf7d8da4d1538dd364129a3327b54f8242dd5653</Hashes>
+                <Hashes condition="contains">SHA256=a3e507e713f11901017fc328186ae98e23de7cea5594687480229f77d45848d8</Hashes>
+                <Hashes condition="contains">SHA256=65c26276cadda7a36f8977d1d01120edb5c3418be2317d501761092d5f9916c9</Hashes>
+                <Hashes condition="contains">SHA256=e3b257357be41a18319332df7023c4407e2b93ac4c9e0c6754032e29f3763eac</Hashes>
+                <Hashes condition="contains">SHA256=591bd5e92dfa0117b3daa29750e73e2db25baa717c31217539d30ffb1f7f3a52</Hashes>
+                <Hashes condition="contains">SHA256=16a2e578bc8683f17a175480fea4f53c838cfae965f1d4caa47eaf9e0b3415c1</Hashes>
+                <Hashes condition="contains">SHA256=97b32ddf83f75637e3ba934df117081dd6a1c57d47a4c9700d35e736da11d5bd</Hashes>
+                <Hashes condition="contains">SHA256=26453afb1f808f64bec87a2532a9361b696c0ed501d6b973a1f1b5ae152a4d40</Hashes>
+                <Hashes condition="contains">SHA256=ab0925398f3fa69a67eacee2bbb7b34ac395bb309df7fc7a9a9b8103ef41ed7a</Hashes>
+                <Hashes condition="contains">SHA256=7236c8ff33c0e5cfa956778aa7303f1979f3bf709c361399fa1ce101b7e355b8</Hashes>
+                <Hashes condition="contains">SHA256=4880f40f2e557cff38100620b9aa1a3a753cb693af16cd3d95841583edcb57a8</Hashes>
+                <Hashes condition="contains">SHA256=cc586254e9e89e88334adee44e332166119307e79c2f18f6c2ab90ce8ba7fc9b</Hashes>
+                <Hashes condition="contains">SHA256=3943a796cc7c5352aa57ccf544295bfd6fb69aae147bc8235a00202dc6ed6838</Hashes>
+                <Hashes condition="contains">SHA256=3fa6379951f08ed3cb87eeba9cf0c5f5e1d0317dcfcf003b810df9d795eeb73e</Hashes>
+                <Hashes condition="contains">SHA256=29a90ae1dcee66335ece4287a06482716530509912be863c85a2a03a6450a5b6</Hashes>
+                <Hashes condition="contains">SHA256=9a95a70f68144980f2d684e96c79bdc93ebca1587f46afae6962478631e85d0c</Hashes>
+                <Hashes condition="contains">SHA256=f744abb99c97d98e4cd08072a897107829d6d8481aee96c22443f626d00f4145</Hashes>
+                <Hashes condition="contains">SHA256=76660e91f1ff3cb89630df5af4fe09de6098d09baa66b1a130c89c3c5edd5b22</Hashes>
+                <Hashes condition="contains">SHA256=3a65d14fd3b1b5981084cdbd293dc6f4558911ea18dd80177d1e5b54d85bcaa0</Hashes>
+                <Hashes condition="contains">SHA256=0909005d625866ef8ccd8ae8af5745a469f4f70561b644d6e38b80bccb53eb06</Hashes>
+                <Hashes condition="contains">SHA256=be8dd2d39a527649e34dc77ef8bc07193a4234b38597b8f51e519dadc5479ec2</Hashes>
+                <Hashes condition="contains">SHA256=c64d4ac416363c7a1aa828929544d1c1d78cf032b39769943b851cfc4c0faafc</Hashes>
+                <Hashes condition="contains">SHA256=8939116df1d6c8fd0ebd14b2d37b3dec38a8820aa666ecd487bc1bb794f2a587</Hashes>
+                <Hashes condition="contains">SHA256=1e8b0c1966e566a523d652e00f7727d8b0663f1dfdce3b9a09b9adfaef48d8ee</Hashes>
+                <Hashes condition="contains">SHA256=55963284bbd5a3297f39f12f0d8a01ed99fe59d008561e3537bcd4db4b4268fa</Hashes>
+			</DriverLoad>
+		</RuleGroup>
+
+		<RuleGroup name="Vulnerable Driver Drop Detected" groupRelation="or">
+			<FileExecutableDetected onmatch="include">
+                <Hashes condition="contains">SHA256=7ad0ab23023bc500c3b46f414a8b363c5f8700861bc4745cecc14dd34bcee9ed</Hashes>
+                <Hashes condition="contains">SHA256=9529efb1837b1005e5e8f477773752078e0a46500c748bc30c9b5084d04082e6</Hashes>
+                <Hashes condition="contains">SHA256=0bc3685b0b8adc97931b5d31348da235cd7581a67edf6d79913e6a5709866135</Hashes>
+                <Hashes condition="contains">SHA256=ce23c2dae4cca4771ea50ec737093dfafac06c64db0f924a1ccbbf687e33f5a2</Hashes>
+                <Hashes condition="contains">SHA256=b1334a71cc73b3d0c54f62d8011bec330dfc355a239bf94a121f6e4c86a30a2e</Hashes>
+                <Hashes condition="contains">SHA256=4da08c0681fbe028b60a1eaf5cb8890bd3eba4d0e6a8b976495ddcd315e147ba</Hashes>
+                <Hashes condition="contains">SHA256=45c3d607cb57a1714c1c604a25cbadf2779f4734855d0e43aa394073b6966b26</Hashes>
+                <Hashes condition="contains">SHA256=b1d96233235a62dbb21b8dbe2d1ae333199669f67664b107bff1ad49b41d9414</Hashes>
+                <Hashes condition="contains">SHA256=bcfc2c9883e6c1b8429be44cc4db988a9eecb544988fbd756d18cfca6201876f</Hashes>
+                <Hashes condition="contains">SHA256=eea53103e7a5a55dc1df79797395a2a3e96123ebd71cdd2db4b1be80e7b3f02b</Hashes>
+                <Hashes condition="contains">SHA256=c725919e6357126d512c638f993cf572112f323da359645e4088f789eb4c7b8c</Hashes>
+                <Hashes condition="contains">SHA256=42f0b036687cbd7717c9efed6991c00d4e3e7b032dc965a2556c02177dfdad0f</Hashes>
+                <Hashes condition="contains">SHA256=3326e2d32bbabd69feb6024809afc56c7e39241ebe70a53728c77e80995422a5</Hashes>
+                <Hashes condition="contains">SHA256=76e807b6c0214e66455f09a8de8faad40b738982ca84470f0043de0290449524</Hashes>
+                <Hashes condition="contains">SHA256=7aaf2aa194b936e48bc90f01ee854768c8383c0be50cfb41b346666aec0cf853</Hashes>
+                <Hashes condition="contains">SHA256=cb57f3a7fe9e1f8e63332c563b0a319b26c944be839eabc03e9a3277756ba612</Hashes>
+                <Hashes condition="contains">SHA256=84bf1d0bcdf175cfe8aea2973e0373015793d43907410ae97e2071b2c4b8e2d4</Hashes>
+                <Hashes condition="contains">SHA256=16768203a471a19ebb541c942f45716e9f432985abbfbe6b4b7d61a798cea354</Hashes>
+                <Hashes condition="contains">SHA256=fd8669794c67b396c12fc5f08e9c004fdf851a82faf302846878173e4fbecb03</Hashes>
+                <Hashes condition="contains">SHA256=362c4f3dadc9c393682664a139d65d80e32caa2a97b6e0361dfd713a73267ecc</Hashes>
+                <Hashes condition="contains">SHA256=04a85e359525d662338cae86c1e59b1d7aa9bd12b920e8067503723dc1e03162</Hashes>
+                <Hashes condition="contains">SHA256=49ed27460730b62403c1d2e4930573121ab0c86c442854bc0a62415ca445a810</Hashes>
+                <Hashes condition="contains">SHA256=8c95d28270a4a314299cf50f05dcbe63033b2a555195d2ad2f678e09e00393e6</Hashes>
+                <Hashes condition="contains">SHA256=ff9623317287358440ec67da9ba79994d9b17b99ffdd709ec836478fe1fc22a5</Hashes>
+                <Hashes condition="contains">SHA256=b61869b7945be062630f1dd4bae919aecee8927f7e1bc3954a21ff763f4c0867</Hashes>
+                <Hashes condition="contains">SHA256=dbc604b4e01362a3e51357af4a87686834fe913852a4e0a8c0d4c1a0f7d076ed</Hashes>
+                <Hashes condition="contains">SHA256=a961f5939088238d76757669a9a81905e33f247c9c635b908daac146ae063499</Hashes>
+                <Hashes condition="contains">SHA256=e5b0772be02e2bc807804874cf669e97aa36f5aff1f12fa0a631a3c7b4dd0dc8</Hashes>
+                <Hashes condition="contains">SHA256=aebcbfca180e372a048b682a4859fd520c98b5b63f6e3a627c626cb35adc0399</Hashes>
+                <Hashes condition="contains">SHA256=4e3eb5b9bce2fd9f6878ae36288211f0997f6149aa8c290ed91228ba4cdfae80</Hashes>
+                <Hashes condition="contains">SHA256=1a4f7d7926efc3e3488758ce318246ea78a061bde759ec6c906ff005dd8213e5</Hashes>
+                <Hashes condition="contains">SHA256=f929bead59e9424ab90427b379dcdd63fbfe0c4fb5e1792e3a1685541cd5ec65</Hashes>
+                <Hashes condition="contains">SHA256=7b0f442ac0bb183906700097d65aed0b4b9d8678f9a01aca864854189fe368e7</Hashes>
+                <Hashes condition="contains">SHA256=c344e92a6d06155a217a9af7b4b35e6653665eec6569292e7b2e70f3a3027646</Hashes>
+                <Hashes condition="contains">SHA256=8cfd5b2102fbc77018c7fe6019ec15f07da497f6d73c32a31f4ba07e67ec85d9</Hashes>
+                <Hashes condition="contains">SHA256=99f4994a0e5bd1bf6e3f637d3225c69ff4cd620557e23637533e7f18d7d6cba1</Hashes>
+                <Hashes condition="contains">SHA256=89b9823ed974a5b71de8468324d45b7e9d6dc914f93615ba86c6209b25b3cbf7</Hashes>
+                <Hashes condition="contains">SHA256=d5586dc1e61796a9ae5e5d1ced397874753056c3df2eb963a8916287e1929a71</Hashes>
+                <Hashes condition="contains">SHA256=36b9e31240ab0341873c7092b63e2e0f2cab2962ebf9b25271c3a1216b7669eb</Hashes>
+                <Hashes condition="contains">SHA256=0b2ad05939b0aabbdc011082fad7960baa0c459ec16a2b29f37c1fa31795a46d</Hashes>
+                <Hashes condition="contains">SHA256=30706f110725199e338e9cc1c940d9a644d19a14f0eb8847712cba4cacda67ab</Hashes>
+                <Hashes condition="contains">SHA256=af1011c76a22af7be97a0b3e0ce11aca0509820c59fa7c8eeaaa1b2c0225f75a</Hashes>
+                <Hashes condition="contains">SHA256=8c748ae5dcc10614cc134064c99367d28f3131d1f1dda0c9c29e99279dc1bdd9</Hashes>
+                <Hashes condition="contains">SHA256=cbb8239a765bf5b2c1b6a5c8832d2cab8fef5deacadfb65d8ed43ef56d291ab6</Hashes>
+                <Hashes condition="contains">SHA256=025e7be9fcefd6a83f4471bba0c11f1c11bd5047047d26626da24ee9a419cdc4</Hashes>
+                <Hashes condition="contains">SHA256=d5562fb90b0b3deb633ab335bcbd82ce10953466a428b3f27cb5b226b453eaf3</Hashes>
+                <Hashes condition="contains">SHA256=900dd68ccc72d73774a347b3290c4b6153ae496a81de722ebb043e2e99496f88</Hashes>
+                <Hashes condition="contains">SHA256=a566af57d88f37fa033e64b1d8abbd3ffdacaba260475fbbc8dab846a824eff5</Hashes>
+                <Hashes condition="contains">SHA256=86721ee8161096348ed3dbe1ccbf933ae004c315b1691745a8af4a0df9fed675</Hashes>
+                <Hashes condition="contains">SHA256=d205286bffdf09bc033c09e95c519c1c267b40c2ee8bab703c6a2d86741ccd3e</Hashes>
+                <Hashes condition="contains">SHA256=a5a50449e2cc4d0dbc80496f757935ae38bf8a1bebdd6555a3495d8c219df2ad</Hashes>
+                <Hashes condition="contains">SHA256=ece0a900ea089e730741499614c0917432246ceb5e11599ee3a1bb679e24fd2c</Hashes>
+                <Hashes condition="contains">SHA256=881bca6dc2dafe1ae18aeb59216af939a3ac37248c13ed42ad0e1048a3855461</Hashes>
+                <Hashes condition="contains">SHA256=aafb95a443911e4c67d4e45ffa83cca103c91b42915b81100534dc439bec0c1b</Hashes>
+                <Hashes condition="contains">SHA256=cf69704755ec2643dfd245ae1d4e15d77f306aeb1a576ffa159453de1a7345cb</Hashes>
+                <Hashes condition="contains">SHA256=e4522e2cfa0b1f5d258a3cf85b87681d6969e0572f668024c465d635c236b5d9</Hashes>
+                <Hashes condition="contains">SHA256=600a2119657973112025db3c0eeab2e69d528bccfeed75f40c6ef50b059ec8a0</Hashes>
+                <Hashes condition="contains">SHA256=65329dad28e92f4bcc64de15c552b6ef424494028b18875b7dba840053bc0cdd</Hashes>
+                <Hashes condition="contains">SHA256=78827fa00ea48d96ac9af8d1c1e317d02ce11793e7f7f6e4c7aac7b5d7dd490f</Hashes>
+                <Hashes condition="contains">SHA256=cdd2a4575a46bada4837a6153a79c14d60ee3129830717ef09e0e3efd9d00812</Hashes>
+                <Hashes condition="contains">SHA256=42851a01469ba97cdc38939b10cf9ea13237aa1f6c37b1ac84904c5a12a81fa0</Hashes>
+                <Hashes condition="contains">SHA256=3d23bdbaf9905259d858df5bf991eb23d2dc9f4ecda7f9f77839691acef1b8c4</Hashes>
+                <Hashes condition="contains">SHA256=6e944ae1bfe43a8a7cd2ea65e518a30172ce8f31223bdfd39701b2cb41d8a9e7</Hashes>
+                <Hashes condition="contains">SHA256=1ddfe4756f5db9fb319d6c6da9c41c588a729d9e7817190b027b38e9c076d219</Hashes>
+                <Hashes condition="contains">SHA256=f84f8173242b95f9f3c4fea99b5555b33f9ce37ca8188b643871d261cb081496</Hashes>
+                <Hashes condition="contains">SHA256=32e1a8513eee746d17eb5402fb9d8ff9507fb6e1238e7ff06f7a5c50ff3df993</Hashes>
+                <Hashes condition="contains">SHA256=c9014b03866bf37faa8fdb16b6af7cfec976aaef179fd5797d0c0bf8079d3a8c</Hashes>
+                <Hashes condition="contains">SHA256=79e87b93fbed84ec09261b3a0145c935f7dfe4d4805edfb563b2f971a0d51463</Hashes>
+                <Hashes condition="contains">SHA256=ebe2e9ec6d5d94c2d58fbcc9d78c5f0ee7a2f2c1aed6d1b309f383186d11dfa3</Hashes>
+                <Hashes condition="contains">SHA256=9a523854fe84f15efc1635d7f5d3e71812c45d6a4d2c99c29fdc4b4d9c84954c</Hashes>
+                <Hashes condition="contains">SHA256=2ef7df384e93951893b65500dac6ee09da6b8fe9128326caad41b8be4da49a1e</Hashes>
+                <Hashes condition="contains">SHA256=2ce81759bfa236913bbbb9b2cbc093140b099486fd002910b18e2c6e31fdc4f1</Hashes>
+                <Hashes condition="contains">SHA256=909de5f21837ea2b13fdc4e5763589e6bdedb903f7c04e1d0b08776639774880</Hashes>
+                <Hashes condition="contains">SHA256=c8940e2e9b069ec94f9f711150b313b437f8429f78d522810601b6ee8b52bada</Hashes>
+                <Hashes condition="contains">SHA256=075de997497262a9d105afeadaaefc6348b25ce0e0126505c24aa9396c251e85</Hashes>
+                <Hashes condition="contains">SHA256=e68d453d333854787f8470c8baef3e0d082f26df5aa19c0493898bcf3401e39a</Hashes>
+                <Hashes condition="contains">SHA256=3390919bb28d5c36cc348f9ef23be5fa49bfd81263eb7740826e4437cbe904cd</Hashes>
+                <Hashes condition="contains">SHA256=f088b2ba27dacd5c28f8ee428f1350dca4bc7c6606309c287c801b2e1da1a53d</Hashes>
+                <Hashes condition="contains">SHA256=771a8d05f1af6214e0ef0886662be500ee910ab99f0154227067fddcfe08a3dd</Hashes>
+                <Hashes condition="contains">SHA256=910aa4685c735d8c07662aa04fafec463185699ad1a0cd1967b892fc33ec6c3c</Hashes>
+                <Hashes condition="contains">SHA256=ed2f33452ec32830ffef2d5dc832985db9600c306ed890c47f3f33ccbb335c39</Hashes>
+                <Hashes condition="contains">SHA256=98b734dda78c16ebcaa4afeb31007926542b63b2f163b2f733fa0d00dbb344d8</Hashes>
+                <Hashes condition="contains">SHA256=e83908eba2501a00ef9e74e7d1c8b4ff1279f1cd6051707fd51824f87e4378fa</Hashes>
+                <Hashes condition="contains">SHA256=21ccdd306b5183c00ecfd0475b3152e7d94b921e858e59b68a03e925d1715f21</Hashes>
+                <Hashes condition="contains">SHA256=26c28746e947389856543837aa59a5b1f4697e5721a04d00aa28151a2659b097</Hashes>
+                <Hashes condition="contains">SHA256=9f4ce6ab5e8d44f355426d9a6ab79833709f39b300733b5b251a0766e895e0e5</Hashes>
+                <Hashes condition="contains">SHA256=0040153302b88bee27eb4f1eca6855039e1a057370f5e8c615724fa5215bada3</Hashes>
+                <Hashes condition="contains">SHA256=0ebaef662b14410c198395b13347e1d175334ec67919709ad37d65eba013adff</Hashes>
+                <Hashes condition="contains">SHA256=a7c2e7910942dd5e43e2f4eb159bcd2b4e71366e34a68109548b9fb12ac0f7cc</Hashes>
+                <Hashes condition="contains">SHA256=59b09bd69923c0b3de3239e73205b1846a5f69043546d471b259887bb141d879</Hashes>
+                <Hashes condition="contains">SHA256=09bedbf7a41e0f8dabe4f41d331db58373ce15b2e9204540873a1884f38bdde1</Hashes>
+                <Hashes condition="contains">SHA256=1e0eb0811a7cf1bdaf29d3d2cab373ca51eb8d8b58889ab7728e2d3aed244abe</Hashes>
+                <Hashes condition="contains">SHA256=7049f3c939efe76a5556c2a2c04386db51daf61d56b679f4868bb0983c996ebb</Hashes>
+                <Hashes condition="contains">SHA256=4a3d4db86f580b1680d6454baee1c1a139e2dde7d55e972ba7c92ec3f555dce2</Hashes>
+                <Hashes condition="contains">SHA256=bb1135b51acca8348d285dc5461d10e8f57260e7d0c8cc4a092734d53fc40cbc</Hashes>
+                <Hashes condition="contains">SHA256=45ba688a4bded8a7e78a4f5b0dc21004e951ddceb014bb92f51a3301d2fbc56a</Hashes>
+                <Hashes condition="contains">SHA256=15c53eb3a0ea44bbd2901a45a6ebeae29bb123f9c1115c38dfb2cdbec0642229</Hashes>
+                <Hashes condition="contains">SHA256=83f7be0a13c1fccf024c31da5c68c0ea1decf4f48fc39d6e4fd324bbe789ae8a</Hashes>
+                <Hashes condition="contains">SHA256=ecfc52a22e4a41bf53865b0e28309411c60af34a44e31a5c53cdc8c5733e8282</Hashes>
+                <Hashes condition="contains">SHA256=ffc72f0bde21ba20aa97bee99d9e96870e5aa40cce9884e44c612757f939494f</Hashes>
+                <Hashes condition="contains">SHA256=673bcec3d53fab5efd6e3bac25ac9d6cc51f6bbdf8336e38aade2713dc1ae11b</Hashes>
+                <Hashes condition="contains">SHA256=7da6113183328d4fddf6937c0c85ef65ba69bfe133b1146193a25bcf6ae1f9dd</Hashes>
+                <Hashes condition="contains">SHA256=cc383ad11e9d06047a1558ed343f389492da3ac2b84b71462aee502a2fa616c8</Hashes>
+                <Hashes condition="contains">SHA256=76fb4deaee57ef30e56c382c92abffe2cf616d08dbecb3368c8ee6b02e59f303</Hashes>
+                <Hashes condition="contains">SHA256=caa85c44eb511377ea7426ff10df00a701c07ffb384eef8287636a4bca0b53ab</Hashes>
+                <Hashes condition="contains">SHA256=19696fb0db3fcae22f705ae1eb1e9f1151c823f3ff5d8857e90f2a4a6fdc5758</Hashes>
+                <Hashes condition="contains">SHA256=77950e2a40ac0447ae7ee1ee3ef1242ce22796a157074e6f04e345b1956e143c</Hashes>
+                <Hashes condition="contains">SHA256=cf3a7d4285d65bf8688215407bce1b51d7c6b22497f09021f0fce31cbeb78986</Hashes>
+                <Hashes condition="contains">SHA256=4cff6e53430b81ecc4fae453e59a0353bcfe73dd5780abfc35f299c16a97998e</Hashes>
+                <Hashes condition="contains">SHA256=65db1b259e305a52042e07e111f4fa4af16542c8bacd33655f753ef642228890</Hashes>
+                <Hashes condition="contains">SHA256=19d0fc91b70d7a719f7a28b4ad929f114bf1de94a4c7cba5ad821285a4485da0</Hashes>
+                <Hashes condition="contains">SHA256=9b2f051ac901ab47d0012a1002cb8b2db28c14e9480c0dd55e1ac11c81ba9285</Hashes>
+                <Hashes condition="contains">SHA256=159e7c5a12157af92e0d14a0d3ea116f91c09e21a9831486e6dc592c93c10980</Hashes>
+                <Hashes condition="contains">SHA256=bdcacee3695583a0ca38b9a786b9f7334bf2a9a3387e4069c8e6ca378b2791d0</Hashes>
+                <Hashes condition="contains">SHA256=7f5dc63e5742096e4accaca39ae77a2a2142b438c10f97860dee4054b51d3b35</Hashes>
+                <Hashes condition="contains">SHA256=2b120de80a5462f8395cfb7153c86dfd44f29f0776ea156ec4a34fa64e5c4797</Hashes>
+                <Hashes condition="contains">SHA256=d7e091e0d478c34232e8479b950c5513077b3a69309885cee4c61063e5f74ac0</Hashes>
+                <Hashes condition="contains">SHA256=5351c81b4ec5a0d79c39d24bac7600d10eac30c13546fde43d23636b3f421e7c</Hashes>
+                <Hashes condition="contains">SHA256=f85cca4badff17d1aa90752153ccec77a68ad282b69e3985fdc4743eaea85004</Hashes>
+                <Hashes condition="contains">SHA256=56a3c9ac137d862a85b4004f043d46542a1b61c6acb438098a9640469e2d80e7</Hashes>
+                <Hashes condition="contains">SHA256=3cb75429944e60f6c820c7638adbf688883ad44951bca3f8912428afe72bc134</Hashes>
+                <Hashes condition="contains">SHA256=d0bd1ae72aeb5f3eabf1531a635f990e5eaae7fdd560342f915f723766c80889</Hashes>
+                <Hashes condition="contains">SHA256=f8886a9c759e0426e08d55e410b02c5b05af3c287b15970175e4874316ffaf13</Hashes>
+                <Hashes condition="contains">SHA256=cf4b5fa853ce809f1924df3a3ae3c4e191878c4ea5248d8785dc7e51807a512b</Hashes>
+                <Hashes condition="contains">SHA256=d6827cd3a8f273a66ecc33bb915df6c7dea5cc1b8134b0c348303ef50db33476</Hashes>
+                <Hashes condition="contains">SHA256=f0605dda1def240dc7e14efa73927d6c6d89988c01ea8647b671667b2b167008</Hashes>
+                <Hashes condition="contains">SHA256=4d19ee789e101e5a76834fb411aadf8229f08b3ece671343ad57a6576a525036</Hashes>
+                <Hashes condition="contains">SHA256=916c535957a3b8cbf3336b63b2260ea4055163a9e6b214f2a7005d6d36a4a677</Hashes>
+                <Hashes condition="contains">SHA256=8e6363a6393eb4234667c6f614b2072e33512866b3204f8395bbe01530d63f2f</Hashes>
+                <Hashes condition="contains">SHA256=506f953bbb285aeb8af0549eb24f52f3b7af36afe740afa36735bac70573ce28</Hashes>
+                <Hashes condition="contains">SHA256=a8027daa6facf1ff81405daf6763249e9acf232a1a191b6bf106711630e6188e</Hashes>
+                <Hashes condition="contains">SHA256=74a846c61adc53692d3040aff4c1916f32987ad72b07fe226e9e7dbeff1036c4</Hashes>
+                <Hashes condition="contains">SHA256=17927b93b2d6ab4271c158f039cae2d60591d6a14458f5a5690aec86f5d54229</Hashes>
+                <Hashes condition="contains">SHA256=8e88cb80328c3dbaa2752591692e74a2fae7e146d7d8aabc9b9ac9a6fe561e6c</Hashes>
+                <Hashes condition="contains">SHA256=e07211224b02aaf68a5e4b73fc1049376623793509d9581cdaee9e601020af06</Hashes>
+                <Hashes condition="contains">SHA256=2d2c7ee9547738a8a676ab785c151e8b48ed40fe7cf6174650814c7f5f58513b</Hashes>
+                <Hashes condition="contains">SHA256=a334bdf0c0ab07803380eb6ef83eefe7c147d6962595dd9c943a6a76f2200b0d</Hashes>
+                <Hashes condition="contains">SHA256=7f190f6e5ab0edafd63391506c2360230af4c2d56c45fc8996a168a1fc12d457</Hashes>
+                <Hashes condition="contains">SHA256=b37b3c6877b70289c0f43aeb71349f7344b06063996e6347c3c18d8c5de77f3b</Hashes>
+                <Hashes condition="contains">SHA256=6191c20426dd9b131122fb97e45be64a4d6ce98cc583406f38473434636ddedc</Hashes>
+                <Hashes condition="contains">SHA256=c470c9db58840149ce002f3e6003382ecf740884a683bae8f9d10831be218fa2</Hashes>
+                <Hashes condition="contains">SHA256=61d6e40601fa368800980801a662a5b3b36e3c23296e8ae1c85726a56ef18cc8</Hashes>
+                <Hashes condition="contains">SHA256=46621554728bc55438c7c241137af401250f062edef6e7efecf1a6f0f6d0c1f7</Hashes>
+                <Hashes condition="contains">SHA256=b4d47ea790920a4531e3df5a4b4b0721b7fea6b49a35679f0652f1e590422602</Hashes>
+                <Hashes condition="contains">SHA256=0466dac557ee161503f5dfbd3549f81ec760c3d6c7c4363a21a03e7a3f66aca8</Hashes>
+                <Hashes condition="contains">SHA256=3c6f9917418e991ed41540d8d882c8ca51d582a82fd01bff6cdf26591454faf5</Hashes>
+                <Hashes condition="contains">SHA256=b50ffc60eaa4fb7429fdbb67c0aba0c7085f5129564d0a113fec231c5f8ff62e</Hashes>
+                <Hashes condition="contains">SHA256=7cb594af6a3655daebc9fad9c8abf2417b00ba31dcd118707824e5316fc0cc21</Hashes>
+                <Hashes condition="contains">SHA256=4422851a0a102f654e95d3b79c357ae3af1b096d7d1576663c027cfbc04abaf9</Hashes>
+                <Hashes condition="contains">SHA256=3ff39728f1c11d1108f65ec5eb3d722fd1a1279c530d79712e0d32b34880baaa</Hashes>
+                <Hashes condition="contains">SHA256=5c0b429e5935814457934fa9c10ac7a88e19068fa1bd152879e4e9b89c103921</Hashes>
+                <Hashes condition="contains">SHA256=0aafa9f47acf69d46c9542985994ff5321f00842a28df2396d4a3076776a83cb</Hashes>
+                <Hashes condition="contains">SHA256=0ae8d1dd56a8a000ced74a627052933d2e9bff31d251de185b3c0c5fc94a44db</Hashes>
+                <Hashes condition="contains">SHA256=94be67c319a67de75ebed050d5537cfaa795d72bba52f3d8cf349e7bd075410e</Hashes>
+                <Hashes condition="contains">SHA256=b1867d13a4cab66a76f4d4448824ca0cb3a176064626f9618c0c103ee3cb4f47</Hashes>
+                <Hashes condition="contains">SHA256=f74ffd6916333662900cbecb90aca2d6475a714ce410adf9c5c3264abbe5732c</Hashes>
+                <Hashes condition="contains">SHA256=d7ddf874304556f8a10942a29b3d387cb5155a7419f87813557fe728cb14806d</Hashes>
+                <Hashes condition="contains">SHA256=4a9093e8dbcb867e1b97a0a67ce99a8511900658f5201c34ffb8035881f2dbbe</Hashes>
+                <Hashes condition="contains">SHA256=ff115cefe624b6ca0b3878a86f6f8b352d1915b65fbbdc33ae15530a96ebdaa7</Hashes>
+                <Hashes condition="contains">SHA256=9f1229cd8dd9092c27a01f5d56e3c0d59c2bb9f0139abf042e56f343637fda33</Hashes>
+                <Hashes condition="contains">SHA256=3124b0411b8077605db2a9b7909d8240e0d554496600e2706e531c93c931e1b5</Hashes>
+                <Hashes condition="contains">SHA256=50d5eaa168c077ce5b7f15b3f2c43bd2b86b07b1e926c1b332f8cb13bd2e0793</Hashes>
+                <Hashes condition="contains">SHA256=952199c28332bc90cfd74530a77ee237967ed32b3c71322559c59f7a42187dc4</Hashes>
+                <Hashes condition="contains">SHA256=55a1535e173c998fbbc978009b02d36ca0c737340d84ac2a8da73dfc2f450ef9</Hashes>
+                <Hashes condition="contains">SHA256=57a389da784269bb2cc0a258500f6dfbf4f6269276e1192619ce439ec77f4572</Hashes>
+                <Hashes condition="contains">SHA256=84df20b1d9d87e305c92e5ffae21b10b325609d59d835a954dbd8750ef5dabf4</Hashes>
+                <Hashes condition="contains">SHA256=8ef0ad86500094e8fa3d9e7d53163aa6feef67c09575c169873c494ed66f057f</Hashes>
+                <Hashes condition="contains">SHA256=26f41e4268be59f5de07552b51fa52d18d88be94f8895eb4a16de0f3940cf712</Hashes>
+                <Hashes condition="contains">SHA256=26e3bfef255efd052a84c3c43994c73222b14c95db9a4b1fc2e98f1a5cb26e43</Hashes>
+                <Hashes condition="contains">SHA256=478917514be37b32d5ccf76e4009f6f952f39f5553953544f1b0688befd95e82</Hashes>
+                <Hashes condition="contains">SHA256=0f035948848432bc243704041739e49b528f35c82a5be922d9e3b8a4c44398ff</Hashes>
+                <Hashes condition="contains">SHA256=72b99147839bcfb062d29014ec09fe20a8f261748b5925b00171ef3cb849a4c1</Hashes>
+                <Hashes condition="contains">SHA256=8cf0cbbdc43f9b977f0fb79e0a0dd0e1adabe08a67d0f40d727c717c747de775</Hashes>
+                <Hashes condition="contains">SHA256=4429f32db1cc70567919d7d47b844a91cf1329a6cd116f582305f3b7b60cd60b</Hashes>
+                <Hashes condition="contains">SHA256=0cd4ca335155062182608cad9ef5c8351a715bce92049719dd09c76422cd7b0c</Hashes>
+                <Hashes condition="contains">SHA256=05f052c64d192cf69a462a5ec16dda0d43ca5d0245900c9fcb9201685a2e7748</Hashes>
+                <Hashes condition="contains">SHA256=b9b3878ddc5dfb237d38f8d25067267870afd67d12a330397a8853209c4d889c</Hashes>
+                <Hashes condition="contains">SHA256=93d873cdf23d5edc622b74f9544cac7fe247d7a68e1e2a7bf2879fad97a3ae63</Hashes>
+                <Hashes condition="contains">SHA256=aaa3459bcac25423f78ed72dbae4d7ef19e7c5c65770cbe5210b14e33cd1816c</Hashes>
+                <Hashes condition="contains">SHA256=5f20541f859f21b3106e12d37182b1ea39bb75ffcfcddb2ece4f6edd42c0bab2</Hashes>
+                <Hashes condition="contains">SHA256=dbe9f17313e1164f06401234b875fbc7f71d41dc7271de643865af1358841fef</Hashes>
+                <Hashes condition="contains">SHA256=e0b5a5f8333fc1213791af5c5814d7a99615b3951361ca75f8aa5022c9cfbc2b</Hashes>
+                <Hashes condition="contains">SHA256=19a212e6fc324f4cb9ee5eba60f5c1fc0191799a4432265cbeaa3307c76a7fc0</Hashes>
+                <Hashes condition="contains">SHA256=36aafa127736c7226c50061ea065f71e14f64ec60321f705bc52686d24117e0d</Hashes>
+                <Hashes condition="contains">SHA256=cfc5c585dd4e592dd1a08887ded28b92d9a5820587b6f4f8fa4f56d60289259b</Hashes>
+                <Hashes condition="contains">SHA256=f37d609ea1f06660d970415dd3916c4c153bb5940bf7d2beb47fa34e8a8ffbfc</Hashes>
+                <Hashes condition="contains">SHA256=89108a15f009b285db4ef94250b889d5b11b96b4aa7b190784a6d1396e893e10</Hashes>
+                <Hashes condition="contains">SHA256=1f4d4db4abe26e765a33afb2501ac134d14cadeaa74ae8a0fae420e4ecf58e0c</Hashes>
+                <Hashes condition="contains">SHA256=39cfde7d401efce4f550e0a9461f5fc4d71fa07235e1336e4f0b4882bd76550e</Hashes>
+                <Hashes condition="contains">SHA256=8fe9828bea83adc8b1429394db7a556a17f79846ad0bfb7f242084a5c96edf2a</Hashes>
+                <Hashes condition="contains">SHA256=2afdb3278a7b57466a103024aef9ff7f41c73a19bab843a8ebf3d3c4d4e82b30</Hashes>
+                <Hashes condition="contains">SHA256=8bda0108de82ebeae82f43108046c5feb6f042e312fa0115475a9e32274fae59</Hashes>
+                <Hashes condition="contains">SHA256=082c39fe2e3217004206535e271ebd45c11eb072efde4cc9885b25ba5c39f91d</Hashes>
+                <Hashes condition="contains">SHA256=f40435488389b4fb3b945ca21a8325a51e1b5f80f045ab019748d0ec66056a8b</Hashes>
+                <Hashes condition="contains">SHA256=9c10e2ec4f9ef591415f9a784b93dc9c9cdafa7c69602c0dc860c5b62222e449</Hashes>
+                <Hashes condition="contains">SHA256=2594b3ef3675ca3a7b465b8ed4962e3251364bab13b12af00ebba7fa2211abb2</Hashes>
+                <Hashes condition="contains">SHA256=47f08f7d30d824a8f4bb8a98916401a37c0fd8502db308aba91fe3112b892dcc</Hashes>
+                <Hashes condition="contains">SHA256=bac709c49ddee363c8e59e515f2f632324a0359e932b7d8cb1ce2d52a95981aa</Hashes>
+                <Hashes condition="contains">SHA256=31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427</Hashes>
+                <Hashes condition="contains">SHA256=7d8937c18d6e11a0952e53970a0934cf0e65515637ac24d6ca52ccf4b93d385f</Hashes>
+                <Hashes condition="contains">SHA256=3724b39e97936bb20ada51c6119aded04530ed86f6b8d6b45fbfb2f3b9a4114b</Hashes>
+                <Hashes condition="contains">SHA256=df0dcfb3971829af79629efd036b8e1c6e2127481b3644ccc6e2ddd387489a15</Hashes>
+                <Hashes condition="contains">SHA256=91314768da140999e682d2a290d48b78bb25a35525ea12c1b1f9634d14602b2c</Hashes>
+                <Hashes condition="contains">SHA256=a9706e320179993dade519a83061477ace195daa1b788662825484813001f526</Hashes>
+                <Hashes condition="contains">SHA256=314384b40626800b1cde6fbc51ebc7d13e91398be2688c2a58354aa08d00b073</Hashes>
+                <Hashes condition="contains">SHA256=a072197177aad26c31960694e38e2cae85afbab070929e67e331b99d3a418cf4</Hashes>
+                <Hashes condition="contains">SHA256=8e5aef7c66c0e92dfc037ee29ade1c8484b8d7fadebdcf521d2763b1d8215126</Hashes>
+                <Hashes condition="contains">SHA256=b7a20b5f15e1871b392782c46ebcc897929443d82073ee4dcb3874b6a5976b5d</Hashes>
+                <Hashes condition="contains">SHA256=5ee292b605cd3751a24e5949aae615d472a3c72688632c3040dc311055b75a92</Hashes>
+                <Hashes condition="contains">SHA256=5f6547e9823f94c5b94af1fb69a967c4902f72b6e0c783804835e6ce27f887b0</Hashes>
+                <Hashes condition="contains">SHA256=2732050a7d836ae0bdc5c0aea4cdf8ce205618c3e7f613b8139c176e86476d0c</Hashes>
+                <Hashes condition="contains">SHA256=ff6729518a380bf57f1bc6f1ec0aa7f3012e1618b8d9b0f31a61d299ee2b4339</Hashes>
+                <Hashes condition="contains">SHA256=43ba8d96d5e8e54cab59d82d495eeca730eeb16e4743ed134cdd495c51a4fc89</Hashes>
+                <Hashes condition="contains">SHA256=64f9e664bc6d4b8f5f68616dd50ae819c3e60452efd5e589d6604b9356841b57</Hashes>
+                <Hashes condition="contains">SHA256=31d8fc6f5fb837d5eb29db828d13ba8ee11867d86a90b2c2483a578e1d0ec43a</Hashes>
+                <Hashes condition="contains">SHA256=23ba19352b1e71a965260bf4d5120f0200709ee8657ed381043bec9a938a1ade</Hashes>
+                <Hashes condition="contains">SHA256=11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5</Hashes>
+                <Hashes condition="contains">SHA256=de8f8006d8ee429b5f333503defa54b25447f4ed6aeade5e4219e23f3473ef1c</Hashes>
+                <Hashes condition="contains">SHA256=9fc29480407e5179aa8ea41682409b4ea33f1a42026277613d6484e5419de374</Hashes>
+                <Hashes condition="contains">SHA256=e05eeb2b8c18ad2cb2d1038c043d770a0d51b96b748bc34be3e7fc6f3790ce53</Hashes>
+                <Hashes condition="contains">SHA256=9b6a84f7c40ea51c38cc4d2e93efb3375e9d98d4894a85941190d94fbe73a4e4</Hashes>
+                <Hashes condition="contains">SHA256=2bf29a2df52110ed463d51376562afceac0e80fbb1033284cf50edd86c406b14</Hashes>
+                <Hashes condition="contains">SHA256=95d50c69cdbf10c9c9d61e64fe864ac91e6f6caa637d128eb20e1d3510e776d3</Hashes>
+                <Hashes condition="contains">SHA256=927c2a580d51a598177fa54c65e9d2610f5f212f1b6cb2fbf2740b64368f010a</Hashes>
+                <Hashes condition="contains">SHA256=7539157df91923d4575f7f57c8eb8b0fd87f064c919c1db85e73eebb2910b60c</Hashes>
+                <Hashes condition="contains">SHA256=0af5ccb3d33a9ba92071c9637be6254030d61998733a5eb3583e865e17844e05</Hashes>
+                <Hashes condition="contains">SHA256=fd388cf1df06d419b14dedbeb24c6f4dff37bea26018775f09d56b3067f0de2c</Hashes>
+                <Hashes condition="contains">SHA256=0ce40a2cdd3f45c7632b858e8089ddfdd12d9acb286f2015a4b1b0c0346a572c</Hashes>
+                <Hashes condition="contains">SHA256=3e1d47a497babbfd1c83905777b517ec87c65742bee7eb57a2273eca825d2272</Hashes>
+                <Hashes condition="contains">SHA256=f9895458e73d4b0ef01eda347fb695bb00e6598d9f5e2506161b70ad96bb7298</Hashes>
+                <Hashes condition="contains">SHA256=bb68552936a6b0a68fb53ce864a6387d2698332aac10a7adfdd5a48b97027ce3</Hashes>
+                <Hashes condition="contains">SHA256=d783ace822f8fe4e25d5387e5dd249cb72e62f62079023216dc436f1853a150f</Hashes>
+                <Hashes condition="contains">SHA256=df0cc4e5c9802f8edaefeb130e375cad56b2c5490d8ebd77d8dbdcc6fdc7ecb6</Hashes>
+                <Hashes condition="contains">SHA256=607dc4c75ac7aef82ae0616a453866b3b358c6cf5c8f9d29e4d37f844306b97c</Hashes>
+                <Hashes condition="contains">SHA256=f877296e8506e6a1acbdacdc5085b18c6842320a2775a329d286bac796f08d54</Hashes>
+                <Hashes condition="contains">SHA256=18712a063574bfec315d58577dfe413ab45b650e54747d1e18a56c3c7337a12c</Hashes>
+                <Hashes condition="contains">SHA256=8b92cdb91a2e2fab3881d54f5862e723826b759749f837a11c9e9d85d52095a2</Hashes>
+                <Hashes condition="contains">SHA256=72322fa8bba20df6966acbcf41e83747893fd173cd29de99b5ad1a5d3bf8f2de</Hashes>
+                <Hashes condition="contains">SHA256=146d77e80ca70ea5cb17bfc9a5cea92334f809cbdc87a51c2d10b8579a4b9c88</Hashes>
+                <Hashes condition="contains">SHA256=45abdbcd4c0916b7d9faaf1cd08543a3a5178871074628e0126a6eda890d26e0</Hashes>
+                <Hashes condition="contains">SHA256=9f1025601d17945c3a47026814bdec353ee363966e62dba7fe2673da5ce50def</Hashes>
+                <Hashes condition="contains">SHA256=3f9530c94b689f39cc83377d76979d443275012e022782a600dcb5cad4cca6aa</Hashes>
+                <Hashes condition="contains">SHA256=9254f012009d55f555418ff85f7d93b184ab7cb0e37aecdfdab62cfe94dea96b</Hashes>
+                <Hashes condition="contains">SHA256=3384f4a892f7aa72c43280ff682d85c8e3936f37a68d978d307a9461149192de</Hashes>
+                <Hashes condition="contains">SHA256=b8b94c2646b62f6ac08f16514b6efaa9866aa3c581e4c0435a7aeafe569b2418</Hashes>
+                <Hashes condition="contains">SHA256=b03f26009de2e8eabfcf6152f49b02a55c5e5d0f73e01d48f5a745f93ce93a29</Hashes>
+                <Hashes condition="contains">SHA256=696679114f6a106ec94c21e2a33fe17af86368bcf9a796aaea37ea6e8748ad6a</Hashes>
+                <Hashes condition="contains">SHA256=b019ebd77ac19cdd72bba3318032752649bd56a7576723a8ae1cccd70ee1e61a</Hashes>
+                <Hashes condition="contains">SHA256=67734c7c0130dd66c964f76965f09a2290da4b14c94412c0056046e700654bdc</Hashes>
+                <Hashes condition="contains">SHA256=ecd07df7ad6fee9269a9e9429eb199bf3e24cf672aa1d013b7e8d90d75324566</Hashes>
+                <Hashes condition="contains">SHA256=38c18db050b0b2b07f657c03db1c9595febae0319c746c3eede677e21cd238b0</Hashes>
+                <Hashes condition="contains">SHA256=810513b3f4c8d29afb46f71816350088caacf46f1be361af55b26f3fee4662c3</Hashes>
+                <Hashes condition="contains">SHA256=1b7fb154a7b7903a3c81f12f4b094f24a3c60a6a8cffca894c67c264ab7545fa</Hashes>
+                <Hashes condition="contains">SHA256=ea0b9eecf4ad5ec8c14aec13de7d661e7615018b1a3c65464bf5eca9bbf6ded3</Hashes>
+                <Hashes condition="contains">SHA256=09b0e07af8b17db1d896b78da4dd3f55db76738ee1f4ced083a97d737334a184</Hashes>
+                <Hashes condition="contains">SHA256=5b9623da9ba8e5c80c49473f40ffe7ad315dcadffc3230afdc9d9226d60a715a</Hashes>
+                <Hashes condition="contains">SHA256=258359a7fa3d975620c9810dab3a6493972876a024135feaf3ac8482179b2e79</Hashes>
+                <Hashes condition="contains">SHA256=a2353030d4ea3ad9e874a0f7ff35bbfa10562c98c949d88cabab27102bbb8e48</Hashes>
+                <Hashes condition="contains">SHA256=a56c2a2425eb3a4260cc7fc5c8d7bed7a3b4cd2af256185f24471c668853aee8</Hashes>
+                <Hashes condition="contains">SHA256=1f8168036d636aad1680dd0f577ef9532dbb2dad3591d63e752b0ba3ee6fd501</Hashes>
+                <Hashes condition="contains">SHA256=ee45fd2d7315fd039f3585a66e7855ba4af9d4721e1448e602623de14e932bbe</Hashes>
+                <Hashes condition="contains">SHA256=d636c011b8b2896572f5de260eb997182cc6955449b044a739bd19cbe6fdabd2</Hashes>
+                <Hashes condition="contains">SHA256=6a4875ae86131a594019dec4abd46ac6ba47e57a88287b814d07d929858fe3e5</Hashes>
+                <Hashes condition="contains">SHA256=238046cfe126a1f8ab96d8b62f6aa5ec97bab830e2bae5b1b6ab2d31894c79e4</Hashes>
+                <Hashes condition="contains">SHA256=3e9b62d2ea2be50a2da670746c4dbe807db9601980af3a1014bcd72d0248d84c</Hashes>
+                <Hashes condition="contains">SHA256=c082514317bf80a2f5129d84a5a55e411a95e32d03a4df1274537704c80e41dd</Hashes>
+                <Hashes condition="contains">SHA256=cd4a249c3ef65af285d0f8f30a8a96e83688486aab515836318a2559757a89bb</Hashes>
+                <Hashes condition="contains">SHA256=32cccc4f249499061c0afa18f534c825d01034a1f6815f5506bf4c4ff55d1351</Hashes>
+                <Hashes condition="contains">SHA256=818e396595d08d724666803cd29dac566dc7db23bf50e9919d04b33afa988c01</Hashes>
+                <Hashes condition="contains">SHA256=2b186926ed815d87eaf72759a69095a11274f5d13c33b8cc2b8700a1f020be1d</Hashes>
+                <Hashes condition="contains">SHA256=e6056443537d4d2314dabca1b9168f1eaaf17a14eb41f6f5741b6b82b3119790</Hashes>
+                <Hashes condition="contains">SHA256=a13054f349b7baa8c8a3fcbd31789807a493cc52224bbff5e412eb2bd52a6433</Hashes>
+                <Hashes condition="contains">SHA256=e4c154a0073bbad3c9f8ab7218e9b3be252ae705c20c568861dae4088f17ffcc</Hashes>
+                <Hashes condition="contains">SHA256=5192ec4501d0fe0b1c8f7bf9b778f7524a7a70a26bbbb66e5dab8480f6fdbb8b</Hashes>
+                <Hashes condition="contains">SHA256=65025741ecd0ef516da01319b42c2d96e13cb8d78de53fb7e39cd53ea6d58c75</Hashes>
+                <Hashes condition="contains">SHA256=37c637a74bf20d7630281581a8fae124200920df11ad7cd68c14c26cc12c5ec9</Hashes>
+                <Hashes condition="contains">SHA256=ec5fac0b6bb267a2bd10fc80c8cca6718439d56e82e053d3ff799ce5f3475db5</Hashes>
+                <Hashes condition="contains">SHA256=c299063e3eae8ddc15839767e83b9808fd43418dc5a1af7e4f44b97ba53fbd3d</Hashes>
+                <Hashes condition="contains">SHA256=923ebbe8111e73d5b8ecc2db10f8ea2629a3264c3a535d01c3c118a3b4c91782</Hashes>
+                <Hashes condition="contains">SHA256=c1c4310e5d467d24e864177bdbfc57cb5d29aac697481bfa9c11ddbeebfd4cc8</Hashes>
+                <Hashes condition="contains">SHA256=12eda8b65ed8c1d80464a0c535ea099dffdb4981c134294cb0fa424efc85ee56</Hashes>
+                <Hashes condition="contains">SHA256=552f70374715e70c4ade591d65177be2539ec60f751223680dfaccb9e0be0ed9</Hashes>
+                <Hashes condition="contains">SHA256=49f75746eebe14e5db11706b3e58accc62d4034d2f1c05c681ecef5d1ad933ba</Hashes>
+                <Hashes condition="contains">SHA256=bc13adeb6bf62b1e10ef41205ef92382e6c18d6a20669d288a0b11058e533d63</Hashes>
+                <Hashes condition="contains">SHA256=525d9b51a80ca0cd4c5889a96f857e73f3a80da1ffbae59851e0f51bdfb0b6cd</Hashes>
+                <Hashes condition="contains">SHA256=86a1b1bacc0c51332c9979e6aad84b5fba335df6b9a096ccb7681ab0779a8882</Hashes>
+                <Hashes condition="contains">SHA256=36505921af5a09175395ebaea29c72b2a69a3a9204384a767a5be8a721f31b10</Hashes>
+                <Hashes condition="contains">SHA256=c9b49b52b493b53cd49c12c3fa9553e57c5394555b64e32d1208f5b96a5b8c6e</Hashes>
+                <Hashes condition="contains">SHA256=dd573f23d656818036fc9ae1064eda31aca86acb9bc44a6e127db3ea112a9094</Hashes>
+                <Hashes condition="contains">SHA256=b179e1ab6dc0b1aee783adbcad4ad6bb75a8a64cb798f30c0dd2ee8aaf43e6de</Hashes>
+                <Hashes condition="contains">SHA256=76b86543ce05540048f954fed37bdda66360c4a3ddb8328213d5aef7a960c184</Hashes>
+                <Hashes condition="contains">SHA256=58a74dceb2022cd8a358b92acd1b48a5e01c524c3b0195d7033e4bd55eff4495</Hashes>
+                <Hashes condition="contains">SHA256=133e542842656197c5d22429bd56d57aa33c9522897fdf29853a6d321033c743</Hashes>
+                <Hashes condition="contains">SHA256=e7cbfb16261de1c7f009431d374d90e9eb049ba78246e38bc4c8b9e06f324b6f</Hashes>
+                <Hashes condition="contains">SHA256=8cb62c5d41148de416014f80bd1fd033fd4d2bd504cb05b90eeb6992a382d58f</Hashes>
+                <Hashes condition="contains">SHA256=06508aacb4ed0a1398a2b0da5fa2dbf7da435b56da76fd83c759a50a51c75caf</Hashes>
+                <Hashes condition="contains">SHA256=5bd41a29cbba0d24e639f49d1f201b9bd119b11f5e3b8a5fefa3a5c6f1e7692c</Hashes>
+                <Hashes condition="contains">SHA256=cb9890d4e303a4c03095d7bc176c42dee1b47d8aa58e2f442ec1514c8f9e3cec</Hashes>
+                <Hashes condition="contains">SHA256=a899b659b08fbae30b182443be8ffb6a6471c1d0497b52293061754886a937a3</Hashes>
+                <Hashes condition="contains">SHA256=910479467ef17b9591d8d42305e7f6f247ad41c60ec890a1ffbe331f495ed135</Hashes>
+                <Hashes condition="contains">SHA256=cf3180f5308af002ac5d6fd5b75d1340878c375f0aebc3157e3bcad6322b7190</Hashes>
+                <Hashes condition="contains">SHA256=3ac5e01689a3d745e60925bc7faca8d4306ae693e803b5e19c94906dc30add46</Hashes>
+                <Hashes condition="contains">SHA256=afdd66562dea51001c3a9de300f91fc3eb965d6848dfce92ccb9b75853e02508</Hashes>
+                <Hashes condition="contains">SHA256=7f375639a0df7fe51e5518cf87c3f513c55bc117db47d28da8c615642eb18bfa</Hashes>
+                <Hashes condition="contains">SHA256=9d5ebd0f4585ec20a5fe3c5276df13ece5a2645d3d6f70cedcda979bd1248fc2</Hashes>
+                <Hashes condition="contains">SHA256=ae42afa9be9aa6f6a5ae09fa9c05cd2dfb7861dc72d4fd8e0130e5843756c471</Hashes>
+                <Hashes condition="contains">SHA256=3ff50c67d51553c08dcb7c98342f68a0f54ad6658c5346c428bdcd1f185569f6</Hashes>
+                <Hashes condition="contains">SHA256=8d57e416ea4bb855b78a2ff3c80de1dfbb5dc5ee9bfbdddb23e46bd8619287e2</Hashes>
+                <Hashes condition="contains">SHA256=f8430bdc6fd01f42217d66d87a3ef6f66cb2700ebb39c4f25c8b851858cc4b35</Hashes>
+                <Hashes condition="contains">SHA256=bc7ebd191e0991fd0865a5c956a92e63792a0bb2ff888af43f7a63bb65a22248</Hashes>
+                <Hashes condition="contains">SHA256=be03e9541f56ac6ed1e81407dcd7cc85c0ffc538c3c2c2c8a9c747edbcf13100</Hashes>
+                <Hashes condition="contains">SHA256=6cb6e23ba516570bbd158c32f7c7c99f19b24ca4437340ecb39253662afe4293</Hashes>
+                <Hashes condition="contains">SHA256=60b163776e7b95e0c2280d04476304d0c943b484909131f340e3ce6045a49289</Hashes>
+                <Hashes condition="contains">SHA256=455bc98ba32adab8b47d2d89bdbadca4910f91c182ab2fc3211ba07d3784537b</Hashes>
+                <Hashes condition="contains">SHA256=543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91</Hashes>
+                <Hashes condition="contains">SHA256=3c18ae965fba56d09a65770b4d8da54ccd7801f979d3ebd283397bc99646004b</Hashes>
+                <Hashes condition="contains">SHA256=94911fe6f2aba9683b10353094caf71ee4a882de63b4620797629d79f18feec5</Hashes>
+                <Hashes condition="contains">SHA256=71fe5af0f1564dc187eea8d59c0fbc897712afa07d18316d2080330ba17cf009</Hashes>
+                <Hashes condition="contains">SHA256=f05b1ee9e2f6ab704b8919d5071becbce6f9d0f9d0ba32a460c41d5272134abe</Hashes>
+                <Hashes condition="contains">SHA256=e3eff841ea0f2786e5e0fed2744c0829719ad711fc9258eeaf81ed65a52a8918</Hashes>
+                <Hashes condition="contains">SHA256=e16dc51c51b2df88c474feb52ce884d152b3511094306a289623de69dedfdf48</Hashes>
+                <Hashes condition="contains">SHA256=a59c40e7470b7003e8adfee37c77606663e78d7e3f2ebb8d60910af19924d8df</Hashes>
+                <Hashes condition="contains">SHA256=2a6db9facf9e13d35c37dd468be04bae5f70c6127a9aee76daebddbdec95d486</Hashes>
+                <Hashes condition="contains">SHA256=adc10de960f40fa9f6e28449748250fa9ddfd331115b77a79809a50c606753ee</Hashes>
+                <Hashes condition="contains">SHA256=c60fcff9c8e5243bbb22ec94618b9dcb02c59bb49b90c04d7d6ab3ebbd58dc3a</Hashes>
+                <Hashes condition="contains">SHA256=9a54ef5cfbe6db599322967ee2c84db7daabcb468be10a3ccfcaa0f64d9173c7</Hashes>
+                <Hashes condition="contains">SHA256=a4680fabf606d6580893434e81c130ff7ec9467a15e6534692443465f264d3c9</Hashes>
+                <Hashes condition="contains">SHA256=2e6b339597a89e875f175023ed952aaac64e9d20d457bbc07acf1586e7fe2df8</Hashes>
+                <Hashes condition="contains">SHA256=ef6d3c00f9d0aa31a218094480299ef73fc85146adf62fd0c2f4f88972c5c850</Hashes>
+                <Hashes condition="contains">SHA256=fcdfe570e6dc6e768ef75138033d9961f78045adca53beb6fdb520f6417e0df1</Hashes>
+                <Hashes condition="contains">SHA256=dd4a1253d47de14ef83f1bc8b40816a86ccf90d1e624c5adf9203ae9d51d4097</Hashes>
+                <Hashes condition="contains">SHA256=d8b58f6a89a7618558e37afc360cd772b6731e3ba367f8d58734ecee2244a530</Hashes>
+                <Hashes condition="contains">SHA256=a903f329b70f0078197cb7683aae1bb432eaf58572fe572f7cb4bc2080042d7e</Hashes>
+                <Hashes condition="contains">SHA256=984a77e5424c6d099051441005f2938ae92b31b5ad8f6521c6b001932862add7</Hashes>
+                <Hashes condition="contains">SHA256=3c7e5b25a33a7805c999d318a9523fcae46695a89f55bbdb8bb9087360323dfc</Hashes>
+                <Hashes condition="contains">SHA256=4bc0921ffd4acc865525d3faf98961e8decc5aec4974552cbbf2ae8d5a569de4</Hashes>
+                <Hashes condition="contains">SHA256=a2f45d95d54f4e110b577e621fefa0483fa0e3dcca14c500c298fb9209e491c1</Hashes>
+                <Hashes condition="contains">SHA256=d1f4949f76d8ac9f2fa844d16b1b45fb1375d149d46e414e4a4c9424dc66c91f</Hashes>
+                <Hashes condition="contains">SHA256=263e8f1e20612849aea95272da85773f577fd962a7a6d525b53f43407aa7ad24</Hashes>
+                <Hashes condition="contains">SHA256=22be050955347661685a4343c51f11c7811674e030386d2264cd12ecbf544b7c</Hashes>
+                <Hashes condition="contains">SHA256=c3e150eb7e7292f70299d3054ed429156a4c32b1f7466a706a2b99249022979e</Hashes>
+                <Hashes condition="contains">SHA256=06bda5a1594f7121acd2efe38ccb617fbc078bb9a70b665a5f5efd70e3013f50</Hashes>
+                <Hashes condition="contains">SHA256=221dfbc74bbb255b0879360ccc71a74b756b2e0f16e9386b38a9ce9d4e2e34f9</Hashes>
+                <Hashes condition="contains">SHA256=36875562e747136313ec5db58174e5fab870997a054ca8d3987d181599c7db6a</Hashes>
+                <Hashes condition="contains">SHA256=475e5016c9c0f5a127896f9179a1b1577a67b357f399ab5a1e68aab07134729a</Hashes>
+                <Hashes condition="contains">SHA256=18776682fcc0c6863147143759a8d4050a4115a8ede0136e49a7cf885c8a4805</Hashes>
+                <Hashes condition="contains">SHA256=dec8a933dba04463ed9bb7d53338ff87f2c23cfb79e0e988449fc631252c9dcc</Hashes>
+                <Hashes condition="contains">SHA256=d25904fbf907e19f366d54962ff543d9f53b8fdfd2416c8b9796b6a8dd430e26</Hashes>
+                <Hashes condition="contains">SHA256=771015b2620942919bb2e0683476635b7a09db55216d6fbf03534cb18513b20c</Hashes>
+                <Hashes condition="contains">SHA256=2aa1b08f47fbb1e2bd2e4a492f5d616968e703e1359a921f62b38b8e4662f0c4</Hashes>
+                <Hashes condition="contains">SHA256=40061b30b1243be76d5283cbc8abfe007e148097d4de7337670ff1536c4c7ba1</Hashes>
+                <Hashes condition="contains">SHA256=b9a4e40a5d80fedd1037eaed958f9f9efed41eb01ada73d51b5dcd86e27e0cbf</Hashes>
+                <Hashes condition="contains">SHA256=1273b74c3c1553eaa92e844fbd51f716356cc19cf77c2c780d4899ec7738fbd1</Hashes>
+                <Hashes condition="contains">SHA256=58c071cfe72e9ee867bba85cbd0abe72eb223d27978d6f0650d0103553839b59</Hashes>
+                <Hashes condition="contains">SHA256=f88ebb633406a086d9cca6bc8b66a4ea940c5476529f9033a9e0463512a23a57</Hashes>
+                <Hashes condition="contains">SHA256=d7bc7306cb489fe4c285bbeddc6d1a09e814ef55cf30bd5b8daf87a52396f102</Hashes>
+                <Hashes condition="contains">SHA256=03e0581432f5c8cc727a8aa387f5b69ff84d38d0df6f1226c19c6e960a81e1e9</Hashes>
+                <Hashes condition="contains">SHA256=7d43769b353d63093228a59eb19bba87ce6b552d7e1a99bf34a54eee641aa0ea</Hashes>
+                <Hashes condition="contains">SHA256=2a9d481ffdc5c1e2cb50cf078be32be06b21f6e2b38e90e008edfc8c4f2a9c4e</Hashes>
+                <Hashes condition="contains">SHA256=d969845ef6acc8e5d3421a7ce7e244f419989710871313b04148f9b322751e5d</Hashes>
+                <Hashes condition="contains">SHA256=708016fbe22c813a251098f8f992b177b476bd1bbc48c2ed4a122ff74910a965</Hashes>
+                <Hashes condition="contains">SHA256=7cb497abc44aad09a38160d6a071db499e05ff5871802ccc45d565d242026ee7</Hashes>
+                <Hashes condition="contains">SHA256=2e665962c827ce0adbd29fe6bcf09bbb1d7a7022075d162ff9b65d0af9794ac0</Hashes>
+                <Hashes condition="contains">SHA256=3243aab18e273a9b9c4280a57aecef278e10bfff19abb260d7a7820e41739099</Hashes>
+                <Hashes condition="contains">SHA256=fda93c6e41212e86af07f57ca95db841161f00b08dae6304a51b467056e56280</Hashes>
+                <Hashes condition="contains">SHA256=c2a4ddcc9c3b339d752c48925d62fc4cc5adbf6fae8fedef74cdd47e88da01f8</Hashes>
+                <Hashes condition="contains">SHA256=5ae23f1fcf3fb735fcf1fa27f27e610d9945d668a149c7b7b0c84ffd6409d99a</Hashes>
+                <Hashes condition="contains">SHA256=4744df6ac02ff0a3f9ad0bf47b15854bbebb73c936dd02f7c79293a2828406f6</Hashes>
+                <Hashes condition="contains">SHA256=a7860e110f7a292d621006b7208a634504fb5be417fd71e219060381b9a891e6</Hashes>
+                <Hashes condition="contains">SHA256=bdbceca41e576841cad2f2b38ee6dbf92fd77fbbfdfe6ecf99f0623d44ef182c</Hashes>
+                <Hashes condition="contains">SHA256=7a48f92a9c2d95a72e18055cac28c1e7e6cad5f47aa735cbea5c3b82813ccfaf</Hashes>
+                <Hashes condition="contains">SHA256=17687cba00ec2c9036dd3cb5430aa1f4851e64990dafb4c8f06d88de5283d6ca</Hashes>
+                <Hashes condition="contains">SHA256=3e07bb866d329a2f9aaa4802bad04fdac9163de9bf9cfa1d035f5ca610b4b9bf</Hashes>
+                <Hashes condition="contains">SHA256=b17507a3246020fa0052a172485d7b3567e0161747927f2edf27c40e310852e0</Hashes>
+                <Hashes condition="contains">SHA256=1e16a01ef44e4c56e87abfbe03b2989b0391b172c3ec162783ad640be65ab961</Hashes>
+                <Hashes condition="contains">SHA256=82fbcb371d53b8a76a25fbbafaae31147c0d1f6b9f26b3ea45262c2267386989</Hashes>
+                <Hashes condition="contains">SHA256=ad23d77a38655acb71216824e363df8ac41a48a1a0080f35a0d23aa14b54460b</Hashes>
+                <Hashes condition="contains">SHA256=28999af32b55ddb7dcfc26376a244aa2fe297233ce7abe4919a1aef2f7e2cee7</Hashes>
+                <Hashes condition="contains">SHA256=2270a8144dabaf159c2888519b11b61e5e13acdaa997820c09798137bded3dd6</Hashes>
+                <Hashes condition="contains">SHA256=27cd05527feb020084a4a76579c125458571da8843cdfc3733211760a11da970</Hashes>
+                <Hashes condition="contains">SHA256=592f56b13e7dcaa285da64a0b9a48be7562bd9b0a190208b7c8b7d8de427cf6c</Hashes>
+                <Hashes condition="contains">SHA256=3871e16758a1778907667f78589359734f7f62f9dc953ec558946dcdbe6951e3</Hashes>
+                <Hashes condition="contains">SHA256=1d0397c263d51e9fc95bcc8baf98d1a853e1c0401cd0e27c7bf5da3fba1c93a8</Hashes>
+                <Hashes condition="contains">SHA256=4941c4298f4560fc1e59d0f16f84bab5c060793700b82be2fd7c63735f1657a8</Hashes>
+                <Hashes condition="contains">SHA256=80eeb8c2890f3535ed14f5881baf2f2226e6763be099d09fb8aadaba5b4474c1</Hashes>
+                <Hashes condition="contains">SHA256=175eed7a4c6de9c3156c7ae16ae85c554959ec350f1c8aaa6dfe8c7e99de3347</Hashes>
+                <Hashes condition="contains">SHA256=5f7e47d728ac3301eb47b409801a0f4726a435f78f1ed02c30d2a926259c71f3</Hashes>
+                <Hashes condition="contains">SHA256=358ac54be252673841a1d65bfc2fb6d549c1a4c877fa7f5e1bfa188f30375d69</Hashes>
+                <Hashes condition="contains">SHA256=6fb5bc9c51f6872de116c7db8a2134461743908efc306373f6de59a0646c4f5d</Hashes>
+                <Hashes condition="contains">SHA256=0f016c80c4938fbcd47a47409969b3925f54292eba2ce01a8e45222ce8615eb8</Hashes>
+                <Hashes condition="contains">SHA256=478d855b648ef4501d3b08b3b10e94076ac67546b0ce86b454324f1bf9a78aa0</Hashes>
+                <Hashes condition="contains">SHA256=a7c8f4faf3cbb088cac7753d81f8ec4c38ccb97cd9da817741f49272e8d01200</Hashes>
+                <Hashes condition="contains">SHA256=f1c8ca232789c2f11a511c8cd95a9f3830dd719cad5aa22cb7c3539ab8cb4dc3</Hashes>
+                <Hashes condition="contains">SHA256=8f68ca89910ebe9da3d02ec82d935de1814d79c44f36cd30ea02fa49ae488f00</Hashes>
+                <Hashes condition="contains">SHA256=1afa03118f87b62c59a97617e595ebb26dde8dbdd16ee47ef3ddd1097c30ef6a</Hashes>
+                <Hashes condition="contains">SHA256=e75714f8e0ff45605f6fc7689a1a89c7dcd34aab66c6131c63fefaca584539cf</Hashes>
+                <Hashes condition="contains">SHA256=38fa0c663c8689048726666f1c5e019feaa9da8278f1df6ff62da33961891d2a</Hashes>
+                <Hashes condition="contains">SHA256=b583414fcee280128788f7b39451c511376fe821f455d4f3702795e96d560704</Hashes>
+                <Hashes condition="contains">SHA256=1ee59eb28688e73d10838c66e0d8e011c8df45b6b43a4ac5d0b75795ca3eb512</Hashes>
+                <Hashes condition="contains">SHA256=ef86c4e5ee1dbc4f81cd864e8cd2f4a2a85ee4475b9a9ab698a4ae1cc71fbeb0</Hashes>
+                <Hashes condition="contains">SHA256=29e0062a017a93b2f2f5207a608a96df4d554c5de976bd0276c2590a03bd3e94</Hashes>
+                <Hashes condition="contains">SHA256=c628cda1ef43defc00af45b79949675a8422490d32b080b3a8bb9434242bdbf2</Hashes>
+                <Hashes condition="contains">SHA256=38d87b51f4b69ba2dae1477684a1415f1a3b578eee5e1126673b1beaefee9a20</Hashes>
+                <Hashes condition="contains">SHA256=3d9e83b189fcf5c3541c62d1f54a0da0a4e5b62c3243d2989afc46644056c8e3</Hashes>
+                <Hashes condition="contains">SHA256=88df37ede18bea511f1782c1a6c4915690b29591cf2c1bf5f52201fbbb4fa2b9</Hashes>
+                <Hashes condition="contains">SHA256=e2e79f1e696f27fa70d72f97e448081b1fa14d59cbb89bb4a40428534dd5c6f6</Hashes>
+                <Hashes condition="contains">SHA256=e50b25d94c1771937b2f632e10eea875ac6b19c57da703d52e23ad2b6299f0ae</Hashes>
+                <Hashes condition="contains">SHA256=841335eeb6af68dce5b8b24151776281a751b95056a894991b23afae80e9f33b</Hashes>
+                <Hashes condition="contains">SHA256=9d58f640c7295952b71bdcb456cae37213baccdcd3032c1e3aeb54e79081f395</Hashes>
+                <Hashes condition="contains">SHA256=19bf0d0f55d2ad33ef2d105520bde8fb4286f00e9d7a721e3c9587b9408a0775</Hashes>
+                <Hashes condition="contains">SHA256=da11e9598eef033722b97873d1c046270dd039d0e3ee6cd37911e2dc2eb2608d</Hashes>
+                <Hashes condition="contains">SHA256=2d83ccb1ad9839c9f5b3f10b1f856177df1594c66cbbc7661677d4b462ebf44d</Hashes>
+                <Hashes condition="contains">SHA256=7cfa5e10dff8a99a5d544b011f676bc383991274c693e21e3af40cf6982adb8c</Hashes>
+                <Hashes condition="contains">SHA256=316a27e2bdb86222bc7c8af4e5472166b02aec7f3f526901ce939094e5861f6d</Hashes>
+                <Hashes condition="contains">SHA256=7196187fb1ef8d108b380d37b2af8efdeb3ca1f6eefd37b5dc114c609147216d</Hashes>
+                <Hashes condition="contains">SHA256=d0e25b879d830e4f867b09d6540a664b6f88bad353cd14494c33b31a8091f605</Hashes>
+                <Hashes condition="contains">SHA256=bced04bdefad6a08c763265d6993f07aa2feb57d33ed057f162a947cf0e6668f</Hashes>
+                <Hashes condition="contains">SHA256=2101d5e80e92c55ecfd8c24fcf2202a206a4fd70195a1378f88c4cc04d336f22</Hashes>
+                <Hashes condition="contains">SHA256=9778136d2441439dc470861d15d96fa21dc9f16225232cd05b76791a5e0fde6f</Hashes>
+                <Hashes condition="contains">SHA256=18e1707b319c279c7e0204074088cc39286007a1cf6cb6e269d5067d8d0628c6</Hashes>
+                <Hashes condition="contains">SHA256=2bbc6b9dd5e6d0327250b32305be20c89b19b56d33a096522ee33f22d8c82ff1</Hashes>
+                <Hashes condition="contains">SHA256=7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d</Hashes>
+                <Hashes condition="contains">SHA256=45f42c5d874369d6be270ea27a5511efcca512aeac7977f83a51b7c4dee6b5ef</Hashes>
+                <Hashes condition="contains">SHA256=fb6b0d304433bf88cc7d57728683dbb4b9833459dc33528918ead09b3907ff22</Hashes>
+                <Hashes condition="contains">SHA256=677c0b1add3990fad51f492553d3533115c50a242a919437ccb145943011d2bf</Hashes>
+                <Hashes condition="contains">SHA256=385485e643aa611e97ceae6590c6a8c47155886123dbb9de1e704d0d1624d039</Hashes>
+                <Hashes condition="contains">SHA256=71ff60722231c7641ad593756108cf6779dbaad21c7b08065fb1d4e225eab14d</Hashes>
+                <Hashes condition="contains">SHA256=ad2477632b9b07588cfe0e692f244c05fa4202975c1fe91dd3b90fa911ac6058</Hashes>
+                <Hashes condition="contains">SHA256=727e8ba66a8ff07bdc778eacb463b65f2d7167a6616ca2f259ea32571cacf8af</Hashes>
+                <Hashes condition="contains">SHA256=af095de15a16255ca1b2c27dad365dff9ac32d2a75e8e288f5a1307680781685</Hashes>
+                <Hashes condition="contains">SHA256=cfb7af8ac67a379e7869289aeee21837c448ea6f8ab6c93988e7aa423653bd40</Hashes>
+                <Hashes condition="contains">SHA256=0c512b615eac374d4d494e3c36838d8e788b3dc2691bf27916f7f42694b14467</Hashes>
+                <Hashes condition="contains">SHA256=fb81b5f8bf69637dbdf050181499088a67d24577587bc520de94b5ee8996240f</Hashes>
+                <Hashes condition="contains">SHA256=440883cd9d6a76db5e53517d0ec7fe13d5a50d2f6a7f91ecfc863bc3490e4f5c</Hashes>
+                <Hashes condition="contains">SHA256=e3936d3356573ce2e472495cd3ce769f49a613e453b010433dafce5ea498ddc2</Hashes>
+                <Hashes condition="contains">SHA256=5f487829527802983d5c120e3b99f3cf89333ca14f5e49ac32df0798cfb1f7aa</Hashes>
+                <Hashes condition="contains">SHA256=673b63b67345773cd6d66f6adcf2c753e2d949232bff818d5bb6e05786538d92</Hashes>
+                <Hashes condition="contains">SHA256=72c0d2d699d0440db17cb7cbbc06a253eaafd21465f14bb0fed8b85ae73153d1</Hashes>
+                <Hashes condition="contains">SHA256=ad8ffccfde782bc287241152cf24245a8bf21c2530d81c57e17631b3c4adb833</Hashes>
+                <Hashes condition="contains">SHA256=e61a54f6d3869b43c4eceac3016df73df67cce03878c5a6167166601c5d3f028</Hashes>
+                <Hashes condition="contains">SHA256=5cfad3d473961763306d72c12bd5ae14183a1a5778325c9acacca764b79ca185</Hashes>
+                <Hashes condition="contains">SHA256=436ccab6f62fa2d29827916e054ade7acae485b3de1d3e5c6c62d3debf1480e7</Hashes>
+                <Hashes condition="contains">SHA256=8399e5afd8e3e97139dffb1a9fb00db2186321b427f164403282217cab067c38</Hashes>
+                <Hashes condition="contains">SHA256=b48a309ee0960da3caaaaf1e794e8c409993aeb3a2b64809f36b97aac8a1e62a</Hashes>
+                <Hashes condition="contains">SHA256=dbb457ae1bd07a945a1466ce4a206c625e590aee3922fa7d86fbe956beccfc98</Hashes>
+                <Hashes condition="contains">SHA256=6071db01b50c658cf78665c24f1d21f21b4a12d16bfcfaa6813bf6bbc4d0a1e8</Hashes>
+                <Hashes condition="contains">SHA256=e428ddf9afc9b2d11e2271f0a67a2d6638b860c2c12d4b8cc63d33f3349ee93f</Hashes>
+                <Hashes condition="contains">SHA256=6c64688444d3e004da77dcfb769d064bb38afceeef7ff915dfc71e60e19ff18a</Hashes>
+                <Hashes condition="contains">SHA256=aa9ab1195dc866270e984f1bed5e1358d6ef24c515dfdb6c2a92d1e1b94bf608</Hashes>
+                <Hashes condition="contains">SHA256=1023dcd4c80db19e9f82f95b1c5e1ddb60db7ac034848dd5cc1c78104a6350f4</Hashes>
+                <Hashes condition="contains">SHA256=de3597ae7196ca8c0750dce296a8a4f58893774f764455a125464766fcc9b3b5</Hashes>
+                <Hashes condition="contains">SHA256=47f0cdaa2359a63ad1389ef4a635f1f6eee1f63bdf6ef177f114bdcdadc2e005</Hashes>
+                <Hashes condition="contains">SHA256=db2a9247177e8cdd50fe9433d066b86ffd2a84301aa6b2eb60f361cfff077004</Hashes>
+                <Hashes condition="contains">SHA256=6948480954137987a0be626c24cf594390960242cd75f094cd6aaa5c2e7a54fa</Hashes>
+                <Hashes condition="contains">SHA256=6f55c148bb27c14408cf0f16f344abcd63539174ac855e510a42d78cfaec451c</Hashes>
+                <Hashes condition="contains">SHA256=3e274df646f191d2705c0beaa35eeea84808593c3b333809f13632782e27ad75</Hashes>
+                <Hashes condition="contains">SHA256=ab8f2217e59319b88080e052782e559a706fa4fb7b8b708f709ff3617124da89</Hashes>
+                <Hashes condition="contains">SHA256=0be4912bfd7a79f6ebfa1c06a59f0fb402bd4fe0158265780509edd0e562eac1</Hashes>
+                <Hashes condition="contains">SHA256=77c5e95b872b1d815d6d3ed28b399ca39f3427eeb0143f49982120ff732285a9</Hashes>
+                <Hashes condition="contains">SHA256=42579a759f3f95f20a2c51d5ac2047a2662a2675b3fb9f46c1ed7f23393a0f00</Hashes>
+                <Hashes condition="contains">SHA256=11d258e05b850dcc9ecfacccc9486e54bd928aaa3d5e9942696c323fdbd3481b</Hashes>
+                <Hashes condition="contains">SHA256=5027fce41ed60906a0e76b97c95c2a5a83d57a2d1cd42de232a21f26c0d58e48</Hashes>
+                <Hashes condition="contains">SHA256=955dac77a0148e9f9ed744f5d341cb9c9118261e52fe622ac6213965f2bc4cad</Hashes>
+                <Hashes condition="contains">SHA256=80a59ca71fc20961ccafc0686051e86ae4afbbd4578cb26ad4570b9207651085</Hashes>
+                <Hashes condition="contains">SHA256=dfaefd06b680f9ea837e7815fc1cc7d1f4cc375641ac850667ab20739f46ad22</Hashes>
+                <Hashes condition="contains">SHA256=0d3790af5f8e5c945410929e31d06144a471ac82f828afe89a4758a5bbeb7f9f</Hashes>
+                <Hashes condition="contains">SHA256=50db5480d0392a7dd6ab5df98389dc24d1ed1e9c98c9c35964b19dabcd6dc67f</Hashes>
+                <Hashes condition="contains">SHA256=862d0ff27bb086145a33b9261142838651b0d2e1403be321145e197600eb5015</Hashes>
+                <Hashes condition="contains">SHA256=fca10cde7d331b7f614118682d834d46125a65888e97bd9fda2df3f15797166c</Hashes>
+                <Hashes condition="contains">SHA256=c50f8ab8538c557963252b702c1bd3cee4604b5fc2497705d2a6a3fd87e3cc26</Hashes>
+                <Hashes condition="contains">SHA256=1c1251784e6f61525d0082882a969cb8a0c5d5359be22f5a73e3b0cd38b51687</Hashes>
+                <Hashes condition="contains">SHA256=c8eaa5e6d3230b93c126d2d58e32409e4aeeb23ccf0dd047a17f1ef552f92fe9</Hashes>
+                <Hashes condition="contains">SHA256=31f4140c12ac31f5729a8de4dc051d3acd07783564604df831a2a6722c979192</Hashes>
+                <Hashes condition="contains">SHA256=88e2e6a705d3fb71b966d9fb46dc5a4b015548daf585fb54dfcd81dc0bd3ebdc</Hashes>
+                <Hashes condition="contains">SHA256=f8965fdce668692c3785afa3559159f9a18287bc0d53abb21902895a8ecf221b</Hashes>
+                <Hashes condition="contains">SHA256=3b6e85c8fed9e39b21b2eab0b69bc464272b2c92961510c36e2e2df7aa39861b</Hashes>
+                <Hashes condition="contains">SHA256=399effe75d32bdab6fa0a6bffe02dbf0a59219d940b654837c3be1c0bd02e9aa</Hashes>
+                <Hashes condition="contains">SHA256=092349aebdac28294dbad1656759d8461f362d1a36b01054dccf861d97beadf0</Hashes>
+                <Hashes condition="contains">SHA256=074ae477c8c7ae76c6f2b0bf77ac17935a8e8ee51b52155d2821d93ab30f3761</Hashes>
+                <Hashes condition="contains">SHA256=b47be212352d407d0ef7458a7161c66b47c2aec8391dd101df11e65728337a6a</Hashes>
+                <Hashes condition="contains">SHA256=b51ddcf8309c80384986dda9b11bf7856b030e3e885b0856efdb9e84064917e5</Hashes>
+                <Hashes condition="contains">SHA256=fd33fb2735cc5ef466a54807d3436622407287e325276fcd3ed1290c98bd0533</Hashes>
+                <Hashes condition="contains">SHA256=523d1d43e896077f32cd9acaa8e85b513bfb7b013a625e56f0d4e9675d9822ba</Hashes>
+                <Hashes condition="contains">SHA256=f4ff679066269392f6b7c3ba6257fc60dd609e4f9c491b00e1a16e4c405b0b9b</Hashes>
+                <Hashes condition="contains">SHA256=d5c4ff35eaa74ccdb80c7197d3d113c9cd38561070f2aa69c0affe8ed84a77c9</Hashes>
+                <Hashes condition="contains">SHA256=6cb51ae871fbd5d07c5aad6ff8eea43d34063089528603ca9ceb8b4f52f68ddc</Hashes>
+                <Hashes condition="contains">SHA256=7e3b0b8d3e430074109d85729201d7c34bc5b918c0bcb9f64ce88c5e37e1a456</Hashes>
+                <Hashes condition="contains">SHA256=c5050a2017490fff7aa53c73755982b339ddb0fd7cef2cde32c81bc9834331c5</Hashes>
+                <Hashes condition="contains">SHA256=0f17e5cfc5bdd74aff91bfb1a836071345ba2b5d1b47b0d5bf8e7e0d4d5e2dbf</Hashes>
+                <Hashes condition="contains">SHA256=3a95cc82173032b82a0ffc7d2e438df64c13bc16b4574214c9fe3be37250925e</Hashes>
+                <Hashes condition="contains">SHA256=4ab41816abbf14d59e75b7fad49e2cb1c1feb27a3cb27402297a2a4793ff9da7</Hashes>
+                <Hashes condition="contains">SHA256=42e170a7ab1d2c160d60abfc906872f9cfd0c2ee169ed76f6acb3f83b3eeefdb</Hashes>
+                <Hashes condition="contains">SHA256=496f4a4021226fb0f1b5f71a7634c84114c29faa308746a12c2414adb6b2a40b</Hashes>
+                <Hashes condition="contains">SHA256=9a1d66036b0868bbb1b2823209fedea61a301d5dd245f8e7d390bd31e52d663e</Hashes>
+                <Hashes condition="contains">SHA256=a7b000abbcc344444a9b00cfade7aa22ab92ce0cadec196c30eb1851ae4fa062</Hashes>
+                <Hashes condition="contains">SHA256=38bb9751a3a1f072d518afe6921a66ee6d5cf6d25bc50af49e1925f20d75d4d7</Hashes>
+                <Hashes condition="contains">SHA256=86a8e0aa29a5b52c84921188cc1f0eca9a7904dcfe09544602933d8377720219</Hashes>
+                <Hashes condition="contains">SHA256=1b00d6e5d40b1b84ca63da0e99246574cdd2a533122bc83746f06c0d66e63a6e</Hashes>
+                <Hashes condition="contains">SHA256=6c7120e40fc850e4715058b233f5ad4527d1084a909114fd6a36b7b7573c4a44</Hashes>
+                <Hashes condition="contains">SHA256=e58bbf3251906ff722aa63415bf169618e78be85cb92c8263d3715c260491e90</Hashes>
+                <Hashes condition="contains">SHA256=000547560fea0dd4b477eb28bf781ea67bf83c748945ce8923f90fdd14eb7a4b</Hashes>
+                <Hashes condition="contains">SHA256=53eaefba7e7dca9ab74e385abf18762f9f1aa51594e7f7db5ba612d6c787dd7e</Hashes>
+                <Hashes condition="contains">SHA256=7837cb350338c4958968d06b105466da6518f5bb522a6e70e87c0cad85128408</Hashes>
+                <Hashes condition="contains">SHA256=6e0aa67cfdbe27a059cbd066443337f81c5b6d37444d14792d1c765d9d122dcf</Hashes>
+                <Hashes condition="contains">SHA256=3503ea284b6819f9cb43b3e94c0bb1bf5945ccb37be6a898387e215197a4792a</Hashes>
+                <Hashes condition="contains">SHA256=37dde6bd8a7a36111c3ac57e0ac20bbb93ce3374d0852bcacc9a2c8c8c30079e</Hashes>
+                <Hashes condition="contains">SHA256=54841d9f89e195196e65aa881834804fe3678f1cf6b328cab8703edd15e3ec57</Hashes>
+                <Hashes condition="contains">SHA256=48891874441c6fa69e5518d98c53d83b723573e280c6c65ccfbde9039a6458c9</Hashes>
+                <Hashes condition="contains">SHA256=37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba</Hashes>
+                <Hashes condition="contains">SHA256=01aa278b07b58dc46c84bd0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd</Hashes>
+                <Hashes condition="contains">SHA256=f29073dc99cb52fa890aae80037b48a172138f112474a1aecddae21179c93478</Hashes>
+                <Hashes condition="contains">SHA256=e3f2ee22dec15061919583e4beb8abb3b29b283e2bcb46badf2bfde65f5ea8dd</Hashes>
+                <Hashes condition="contains">SHA256=20f11a64bc4548f4edb47e3d3418da0f6d54a83158224b71662a6292bf45b5fb</Hashes>
+                <Hashes condition="contains">SHA256=38b3eb8c86201d26353aab625cea672e60c2f66ce6f5e5eda673e8c3478bf305</Hashes>
+                <Hashes condition="contains">SHA256=ea85bbe63d6f66f7efee7007e770af820d57f914c7f179c5fee3ef2845f19c41</Hashes>
+                <Hashes condition="contains">SHA256=d74755311d127d0eb7454e56babc2db8dbaa814bc4ba8e2a7754d3e0224778e1</Hashes>
+                <Hashes condition="contains">SHA256=e32ab30d01dcff6418544d93f99ae812d2ce6396e809686620547bea05074f6f</Hashes>
+                <Hashes condition="contains">SHA256=69e3fda487a5ec2ec0f67b7d79a5a836ff0036497b2d1aec514c67d2efa789b2</Hashes>
+                <Hashes condition="contains">SHA256=9ee33ffd80611a13779df6286c1e04d3c151f1e2f65e3d664a08997fcd098ef3</Hashes>
+                <Hashes condition="contains">SHA256=de6bf572d39e2611773e7a01f0388f84fb25da6cba2f1f8b9b36ffba467de6fa</Hashes>
+                <Hashes condition="contains">SHA256=fc22977ff721b3d718b71c42440ee2d8a144f3fbc7755e4331ddd5bcc65158d2</Hashes>
+                <Hashes condition="contains">SHA256=6de84caa2ca18673e01b91af58220c60aecd5cccf269725ec3c7f226b2167492</Hashes>
+                <Hashes condition="contains">SHA256=0e53b58415fa68552928622118d5b8a3a851b2fc512709a90b63ba46acda8b6b</Hashes>
+                <Hashes condition="contains">SHA256=3279593db91bb7ad5b489a01808c645eafafda6cc9c39f50d10ccc30203f2ddf</Hashes>
+                <Hashes condition="contains">SHA256=d8459f7d707c635e2c04d6d6d47b63f73ba3f6629702c7a6e0df0462f6478ae2</Hashes>
+                <Hashes condition="contains">SHA256=61befeef14783eb0fed679fca179d2f5c33eb2dcbd40980669ca2ebeb3bf11cf</Hashes>
+                <Hashes condition="contains">SHA256=7cc9ba2df7b9ea6bb17ee342898edd7f54703b93b6ded6a819e83a7ee9f938b4</Hashes>
+                <Hashes condition="contains">SHA256=9b1ac756e35f795dd91adbc841e78db23cb7165280f8d4a01df663128b66d194</Hashes>
+                <Hashes condition="contains">SHA256=6befa481e8cca8084d9ec3a1925782cd3c28ef7a3e4384e034d48deaabb96b63</Hashes>
+                <Hashes condition="contains">SHA256=5b3705b47dc15f2b61ca3821b883b9cd114d83fcc3344d11eb1d3df495d75abe</Hashes>
+                <Hashes condition="contains">SHA256=34bee22c18ddbddbe115cf1ab55cabf0e482aba1eb2c343153577fb24b7226d3</Hashes>
+                <Hashes condition="contains">SHA256=2f60536b25ba8c9014e4a57d7a9a681bd3189fa414eea88c256d029750e15cae</Hashes>
+                <Hashes condition="contains">SHA256=3f2fda9a7a9c57b7138687bbce49a2e156d6095dddabb3454ea09737e02c3fa5</Hashes>
+                <Hashes condition="contains">SHA256=d92eab70bcece4432258c9c9a914483a2267f6ab5ce2630048d3a99e8cb1b482</Hashes>
+                <Hashes condition="contains">SHA256=81aafae4c4158d0b9a6431aff0410745a0f6a43fb20a9ab316ffeb8c2e2ccac0</Hashes>
+                <Hashes condition="contains">SHA256=1c8dfa14888bb58848b4792fb1d8a921976a9463be8334cff45cc96f1276049a</Hashes>
+                <Hashes condition="contains">SHA256=9679758455c69877fce866267d60c39d108b495dca183954e4af869902965b3d</Hashes>
+                <Hashes condition="contains">SHA256=b6fd51e1f57a03006953e84fd56cc2821cc19e7c77c0474e1110aabaacaf03df</Hashes>
+                <Hashes condition="contains">SHA256=9a91d6e83b8fdec536580f6617f10dfc64eedf14ead29a6a644eb154426622ba</Hashes>
+                <Hashes condition="contains">SHA256=6ed35f310c96920a271c59a097b382da07856e40179c2a4239f8daa04eef38e7</Hashes>
+                <Hashes condition="contains">SHA256=cff9aa9046bdfd781d34f607d901a431a51bb7e5f48f4f681cc743b2cdedc98c</Hashes>
+                <Hashes condition="contains">SHA256=dde6f28b3f7f2abbee59d4864435108791631e9cb4cdfb1f178e5aa9859956d8</Hashes>
+                <Hashes condition="contains">SHA256=59626cac380d8fe0b80a6d4c4406d62ba0683a2f0f68d50ad506ca1b1cf25347</Hashes>
+                <Hashes condition="contains">SHA256=18deed37f60b6aa8634dda2565a0485452487d7bce88afb49301a7352db4e506</Hashes>
+                <Hashes condition="contains">SHA256=01e024cb14b34b6d525c642a710bfa14497ea20fd287c39ba404b10a8b143ece</Hashes>
+                <Hashes condition="contains">SHA256=509628b6d16d2428031311d7bd2add8d5f5160e9ecc0cd909f1e82bbbb3234d6</Hashes>
+                <Hashes condition="contains">SHA256=ada4e42bf5ef58ef1aad94435441003b1cc1fcaa5d38bfdbe1a3d736dc451d47</Hashes>
+                <Hashes condition="contains">SHA256=e2d8dd5dacc24051709f55a35184f5f99aef957a83bd358b0608b4479e1ec24f</Hashes>
+                <Hashes condition="contains">SHA256=c2fcc0fec64d5647813b84b9049d430406c4c6a7b9f8b725da21bcae2ff12247</Hashes>
+                <Hashes condition="contains">SHA256=7c731c0ea7f28671ab7787800db69739ea5cd6be16ea21045b4580cf95cbf73b</Hashes>
+                <Hashes condition="contains">SHA256=34e0364a4952d914f23f271d36e11161fb6bb7b64aea22ff965a967825a4a4bf</Hashes>
+                <Hashes condition="contains">SHA256=cc687fe3741bbde1dd142eac0ef59fd1d4457daee43cdde23bb162ef28d04e64</Hashes>
+                <Hashes condition="contains">SHA256=da6ca1fb539f825ca0f012ed6976baf57ef9c70143b7a1e88b4650bf7a925e24</Hashes>
+                <Hashes condition="contains">SHA256=5fad3775feb8b6f6dcbd1642ae6b6a565ff7b64eadfc9bf9777918b51696ab36</Hashes>
+                <Hashes condition="contains">SHA256=bda99629ec6c522c3efcbcc9ca33688d31903146f05b37d0d3b43db81bfb3961</Hashes>
+                <Hashes condition="contains">SHA256=9790a7b9d624b2b18768bb655dda4a05a9929633cef0b1521e79e40d7de0a05b</Hashes>
+                <Hashes condition="contains">SHA256=1963d5a0e512b72353953aadbe694f73a9a576f0241a988378fa40bf574eda52</Hashes>
+                <Hashes condition="contains">SHA256=ae79e760c739d6214c1e314728a78a6cb6060cce206fde2440a69735d639a0a2</Hashes>
+                <Hashes condition="contains">SHA256=72288d4978ee87ea6c8b1566dbd906107357087cef7364fb3dd1e1896d00baeb</Hashes>
+                <Hashes condition="contains">SHA256=e4eca7db365929ff7c5c785e2eab04ef8ec67ea9edcf7392f2b74eccd9449148</Hashes>
+                <Hashes condition="contains">SHA256=1aaf4c1e3cb6774857e2eef27c17e68dc1ae577112e4769665f516c2e8c4e27b</Hashes>
+                <Hashes condition="contains">SHA256=131d5490ceb9a5b2324d8e927fea5becfc633015661de2f4c2f2375a3a3b64c6</Hashes>
+                <Hashes condition="contains">SHA256=89b0017bc30cc026e32b758c66a1af88bd54c6a78e11ec2908ff854e00ac46be</Hashes>
+                <Hashes condition="contains">SHA256=70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4</Hashes>
+                <Hashes condition="contains">SHA256=626fae47811450d080d08c3d9fd890aa64bfecdc45eacd42a40850c1833c8763</Hashes>
+                <Hashes condition="contains">SHA256=101402d4f5d1ae413ded499c78a5fcbbc7e3bae9b000d64c1dd64e3c48c37558</Hashes>
+                <Hashes condition="contains">SHA256=1078af0c70e03ac17c7b8aa5ee03593f5decfef2f536716646a4ded1e98c153c</Hashes>
+                <Hashes condition="contains">SHA256=8f23313adb35782adb0ba97fefbfbb8bbc5fc40ae272e07f6d4629a5305a3fa2</Hashes>
+                <Hashes condition="contains">SHA256=3a5ec83fe670e5e23aef3afa0a7241053f5b6be5e6ca01766d6b5f9177183c25</Hashes>
+                <Hashes condition="contains">SHA256=2fbbc276737047cb9b3ba5396756d28c1737342d89dce1b64c23a9c4513ae445</Hashes>
+                <Hashes condition="contains">SHA256=98a123b314cba2de65f899cdbfa386532f178333389e0f0fbd544aff85be02eb</Hashes>
+                <Hashes condition="contains">SHA256=2bbe65cbec3bb069e92233924f7ee1f95ffa16173fceb932c34f68d862781250</Hashes>
+                <Hashes condition="contains">SHA256=2470fd1b733314c9b0afa19fd39c5d19aa1b36db598b5ebbe93445caa545da5f</Hashes>
+                <Hashes condition="contains">SHA256=09043c51719d4bf6405c9a7a292bb9bb3bcc782f639b708ddcc4eedb5e5c9ce9</Hashes>
+                <Hashes condition="contains">SHA256=d884ca8cc4ef1826ca3ab03eb3c2d8f356ba25f2d20db0a7d9fc251c565be7f3</Hashes>
+                <Hashes condition="contains">SHA256=55fee54c0d0d873724864dc0b2a10b38b7f40300ee9cae4d9baaf8a202c4049a</Hashes>
+                <Hashes condition="contains">SHA256=4045ae77859b1dbf13972451972eaaf6f3c97bea423e9e78f1c2f14330cd47ca</Hashes>
+                <Hashes condition="contains">SHA256=b95b2d9b29bd25659f1c7ba5a187f8d23cde01162d9b5b1a2c4aea8f64b38441</Hashes>
+                <Hashes condition="contains">SHA256=1766fd66f846d9a21e648d649ad35d1ff94f8ca17a40a9a738444d6b8e07aacb</Hashes>
+                <Hashes condition="contains">SHA256=8111085022bda87e5f6aa4c195e743cc6dd6a3a6d41add475d267dc6b105a69f</Hashes>
+                <Hashes condition="contains">SHA256=c089a31ac95d41ed02d1e4574962f53376b36a9e60ff87769d221dc7d1a3ecfa</Hashes>
+                <Hashes condition="contains">SHA256=b2ba6efeff1860614b150916a77c9278f19d51e459e67a069ccd15f985cbc0e1</Hashes>
+                <Hashes condition="contains">SHA256=823da894b2c73ffcd39e77366b6f1abf0ae9604d9b20140a54e6d55053aadeba</Hashes>
+                <Hashes condition="contains">SHA256=79e2d37632c417138970b4feba91b7e10c2ea251c5efe3d1fc6fa0190f176b57</Hashes>
+                <Hashes condition="contains">SHA256=1aaa9aef39cb3c0a854ecb4ca7d3b213458f302025e0ec5bfbdef973cca9111c</Hashes>
+                <Hashes condition="contains">SHA256=f596e64f4c5d7c37a00493728d8756b243cfdc11e3372d6d6dfeffc13c9ab960</Hashes>
+                <Hashes condition="contains">SHA256=0da746e49fd662be910d0e366934a7e02898714eaaa577e261ab40eb44222b5c</Hashes>
+                <Hashes condition="contains">SHA256=c9cf1d627078f63a36bbde364cd0d5f2be1714124d186c06db5bcdf549a109f8</Hashes>
+                <Hashes condition="contains">SHA256=092d04284fdeb6762e65e6ac5b813920d6c69a5e99d110769c5c1a78e11c5ba0</Hashes>
+                <Hashes condition="contains">SHA256=0ee5067ce48883701824c5b1ad91695998916a3702cf8086962fbe58af74b2d6</Hashes>
+                <Hashes condition="contains">SHA256=2b4c7d3820fe08400a7791e2556132b902a9bbadc1942de57077ecb9d21bf47a</Hashes>
+                <Hashes condition="contains">SHA256=07b6d69bafcfd767f1b63a490a8843c3bb1f8e1bbea56176109b5743c8f7d357</Hashes>
+                <Hashes condition="contains">SHA256=5f5e5f1c93d961985624768b7c676d488c7c7c1d4c043f6fc1ea1904fefb75be</Hashes>
+                <Hashes condition="contains">SHA256=93b266f38c3c3eaab475d81597abbd7cc07943035068bb6fd670dbbe15de0131</Hashes>
+                <Hashes condition="contains">SHA256=dcb815eb8e9016608d0d917101b6af8c84b96fb709dc0344bceed02cbc4ed258</Hashes>
+                <Hashes condition="contains">SHA256=4b5229b3250c8c08b98cb710d6c056144271de099a57ae09f5d2097fc41bd4f1</Hashes>
+                <Hashes condition="contains">SHA256=9dab4b6fddc8e1ec0a186aa8382b184a5d52cfcabaaf04ff9e3767021eb09cf4</Hashes>
+                <Hashes condition="contains">SHA256=6b830ea0db6546a044c9900d3f335e7820c2a80e147b0751641899d1a5aa8f74</Hashes>
+                <Hashes condition="contains">SHA256=ae6fb53e4d8122dba3a65e5fa59185b36c3ac9df46e82fcfb6731ab55c6395aa</Hashes>
+                <Hashes condition="contains">SHA256=7e0124fcc7c95fdc34408cf154cb41e654dade8b898c71ad587b2090b1da30d7</Hashes>
+                <Hashes condition="contains">SHA256=5f69d6b167a1eeca3f6ac64785c3c01976ee7303171faf998d65852056988683</Hashes>
+                <Hashes condition="contains">SHA256=e4a7da2cf59a4a21fc42b611df1d59cae75051925a7ddf42bf216cc1a026eadb</Hashes>
+                <Hashes condition="contains">SHA256=0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5</Hashes>
+                <Hashes condition="contains">SHA256=e005e8d183e853a27ad3bb56f25489f369c11b0d47e3d4095aad9291b3343bf1</Hashes>
+                <Hashes condition="contains">SHA256=5177a3b7393fb5855b2ec0a45d4c91660b958ee077e76e5a7d0669f2e04bcf02</Hashes>
+                <Hashes condition="contains">SHA256=f6cd7353cb6e86e98d387473ed6340f9b44241867508e209e944f548b9db1d5f</Hashes>
+                <Hashes condition="contains">SHA256=7877c1b0e7429453b750218ca491c2825dae684ad9616642eff7b41715c70aca</Hashes>
+                <Hashes condition="contains">SHA256=8137ce22d0d0fc5ea5b174d6ad3506a4949506477b1325da2ccb76511f4c4f60</Hashes>
+                <Hashes condition="contains">SHA256=5d530e111400785d183057113d70623e17af32931668ab7c7fc826f0fd4f91a3</Hashes>
+                <Hashes condition="contains">SHA256=2d195cd4400754cc6f6c3f8ab1fe31627932c3c1bf8d5d0507c292232d1a2396</Hashes>
+                <Hashes condition="contains">SHA256=ee3ff12943ced401e2b6df9e66e8a0be8e449fa9326cab241f471b2d8ffefdd7</Hashes>
+                <Hashes condition="contains">SHA256=65008817eb97635826a8708a6411d7b50f762bab81304e457119d669382944c3</Hashes>
+                <Hashes condition="contains">SHA256=7893307df2fdde25371645a924f0333e1b2de31b6bc839d8e2a908d7830c6504</Hashes>
+                <Hashes condition="contains">SHA256=2121a2bb8ebbf2e6e82c782b6f3c6b7904f686aa495def25cf1cf52a42e16109</Hashes>
+                <Hashes condition="contains">SHA256=e1980c6592e6d2d92c1a65acad8f1071b6a404097bb6fcce494f3c8ac31385cf</Hashes>
+                <Hashes condition="contains">SHA256=f85784fa8e7a7ec86cb3fe76435802f6bb82256e1824ed7b5d61bf075f054573</Hashes>
+                <Hashes condition="contains">SHA256=8688e43d94b41eeca2ed458b8fc0d02f74696a918e375ecd3842d8627e7a8f2b</Hashes>
+                <Hashes condition="contains">SHA256=f581decc2888ef27ee1ea85ea23bbb5fb2fe6a554266ff5a1476acd1d29d53af</Hashes>
+                <Hashes condition="contains">SHA256=61a1bdddd3c512e681818debb5bee94db701768fc25e674fcad46592a3259bd0</Hashes>
+                <Hashes condition="contains">SHA256=4b4c925c3b8285aeeab9b954e8b2a0773b4d2d0e18d07d4a9d268f4be90f6cae</Hashes>
+                <Hashes condition="contains">SHA256=ac63c26ca43701dddaa7fb1aea535d42190f88752900a03040fd5aaa24991e25</Hashes>
+                <Hashes condition="contains">SHA256=7dfc2eb033d2e090540860b8853036f40736d02bd22099ff6cf665a90be659cd</Hashes>
+                <Hashes condition="contains">SHA256=b773511fdb2e370dec042530910a905472fcc2558eb108b246fd3200171b04d3</Hashes>
+                <Hashes condition="contains">SHA256=2da330a2088409efc351118445a824f11edbe51cf3d653b298053785097fe40e</Hashes>
+                <Hashes condition="contains">SHA256=f85eb576acb5db0d2f48e5f09a7244165a876fa1ca8697ebb773e4d7071d4439</Hashes>
+                <Hashes condition="contains">SHA256=e4d9f037411284e996a002b15b49bc227d085ee869ae1cd91ba54ff7c244f036</Hashes>
+                <Hashes condition="contains">SHA256=36e3127f045ef1fa7426a3ff8c441092d3b66923d2b69826034e48306609e289</Hashes>
+                <Hashes condition="contains">SHA256=950a4c0c772021cee26011a92194f0e58d61588f77f2873aa0599dff52a160c9</Hashes>
+                <Hashes condition="contains">SHA256=5c04c274a708c9a7d993e33be3ea9e6119dc29527a767410dbaf93996f87369a</Hashes>
+                <Hashes condition="contains">SHA256=0fd2df82341bf5ebb8a53682e60d08978100c01acb0bed7b6ce2876ada80f670</Hashes>
+                <Hashes condition="contains">SHA256=904e0f7d485a98e8497d5ec6dd6e6e1cf0b8d8e067fb64a9e09790af3c8c9d5a</Hashes>
+                <Hashes condition="contains">SHA256=3ec5ad51e6879464dfbccb9f4ed76c6325056a42548d5994ba869da9c4c039a8</Hashes>
+                <Hashes condition="contains">SHA256=3c4207c90c97733fae2a08679d63fbbe94dfcf96fdfdf88406aa7ab3f80ea78f</Hashes>
+                <Hashes condition="contains">SHA256=077aa8ff5e01747723b6d24cc8af460a7a00f30cd3bc80e41cc245ceb8305356</Hashes>
+                <Hashes condition="contains">SHA256=cfcf32f5662791f1f22a77acb6dddfbc970fe6e99506969b3ea67c03f67687ab</Hashes>
+                <Hashes condition="contains">SHA256=6bfc0f425de9f4e7480aa2d1f2e08892d0553ed0df1c31e9bf3d8d702f38fa2e</Hashes>
+                <Hashes condition="contains">SHA256=f15ae970e222ce06dbf3752b223270d0e726fb78ebec3598b4f8225b5a0880b1</Hashes>
+                <Hashes condition="contains">SHA256=e86cb77de7b6a8025f9a546f6c45d135f471e664963cf70b381bee2dfd0fdef4</Hashes>
+                <Hashes condition="contains">SHA256=654c5ba47f74008c8f49cbb97988017eec8c898adc3bb851bc6e1fdf9dcf54ad</Hashes>
+                <Hashes condition="contains">SHA256=ad40e6d0f77c0e579fb87c5106bf6de3d1a9f30ee2fbf8c9c011f377fa05f173</Hashes>
+                <Hashes condition="contains">SHA256=6ffdde6bc6784c13c601442e47157062941c47015891e7139c2aaba676ab59cc</Hashes>
+                <Hashes condition="contains">SHA256=81939e5c12bd627ff268e9887d6fb57e95e6049f28921f3437898757e7f21469</Hashes>
+                <Hashes condition="contains">SHA256=80cbba9f404df3e642f22c476664d63d7c229d45d34f5cd0e19c65eb41becec3</Hashes>
+                <Hashes condition="contains">SHA256=ab2632a4d93a7f3b7598c06a9fdc773a1b1b69a7dd926bdb7cf578992628e9dd</Hashes>
+                <Hashes condition="contains">SHA256=22418016e980e0a4a2d01ca210a17059916a4208352c1018b0079ccb19aaf86a</Hashes>
+                <Hashes condition="contains">SHA256=f51bdb0ad924178131c21e39a8ccd191e46b5512b0f2e1cc8486f63e84e5d960</Hashes>
+                <Hashes condition="contains">SHA256=119c48b79735fda0ecd973d77d9bdc6b329960caed09b38ab454236ca039d280</Hashes>
+                <Hashes condition="contains">SHA256=62f5e13b2edc00128716cb93e6a9eddffea67ce83d2bb426f18f5be08ead89e0</Hashes>
+                <Hashes condition="contains">SHA256=0b542e47248611a1895018ec4f4033ea53464f259c74eb014d018b19ad818917</Hashes>
+                <Hashes condition="contains">SHA256=5a826b4fa10891cf63aae832fc645ce680a483b915c608ca26cedbb173b1b80a</Hashes>
+                <Hashes condition="contains">SHA256=7133a461aeb03b4d69d43f3d26cd1a9e3ee01694e97a0645a3d8aa1a44c39129</Hashes>
+                <Hashes condition="contains">SHA256=2a6212f3b68a6f263e96420b3607b31cfdfe51afff516f3c87d27bf8a89721e8</Hashes>
+                <Hashes condition="contains">SHA256=453be8f63cc6b116e2049659e081d896491cf1a426e3d5f029f98146a3f44233</Hashes>
+                <Hashes condition="contains">SHA256=cdfbe62ef515546f1728189260d0bdf77167063b6dbb77f1db6ed8b61145a2bc</Hashes>
+                <Hashes condition="contains">SHA256=3c5d7069f85ec1d6f58147431f88c4d7c48df73baf94ffdefd664f2606baf09c</Hashes>
+                <Hashes condition="contains">SHA256=ded2927f9a4e64eefd09d0caba78e94f309e3a6292841ae81d5528cab109f95d</Hashes>
+                <Hashes condition="contains">SHA256=ac3f613d457fc4d44fa27b2e0b1baa62c09415705efb5a40a4756da39b3ac165</Hashes>
+                <Hashes condition="contains">SHA256=fa875178ae2d7604d027510b0d0a7e2d9d675e10a4c9dda2d927ee891e0bcb91</Hashes>
+                <Hashes condition="contains">SHA256=2003b478b9fd1b3d76ec5bf4172c2e8915babbbee7ad1783794acbf8d4c2519d</Hashes>
+                <Hashes condition="contains">SHA256=60c6f4f34c7319cb3f9ca682e59d92711a05a2688badbae4891b1303cd384813</Hashes>
+                <Hashes condition="contains">SHA256=47eaebc920ccf99e09fc9924feb6b19b8a28589f52783327067c9b09754b5e84</Hashes>
+                <Hashes condition="contains">SHA256=0de4247e72d378713bcf22d5c5d3874d079203bb4364e25f67a90d5570bdcce8</Hashes>
+                <Hashes condition="contains">SHA256=1a42ebde59e8f63804eaa404f79ee93a16bb33d27fb158c6bfbe6143226899a0</Hashes>
+                <Hashes condition="contains">SHA256=76614f2e372f33100a8d92bf372cdbc1e183930ca747eed0b0cf2501293b990a</Hashes>
+                <Hashes condition="contains">SHA256=405472a8f9400a54bb29d03b436ccd58cfd6442fe686f6d2ed4f63f002854659</Hashes>
+                <Hashes condition="contains">SHA256=15fb486b6b8c2a2f1b067f48fba10c2f164638fe5e6cee618fb84463578ecac9</Hashes>
+                <Hashes condition="contains">SHA256=deecbcd260849178de421d8e2f177dce5c63cf67a48abb23a0e3cf3aa3e00578</Hashes>
+                <Hashes condition="contains">SHA256=08eb2d2aa25c5f0af4e72a7e0126735536f6c2c05e9c7437282171afe5e322c6</Hashes>
+                <Hashes condition="contains">SHA256=49329fa09f584d1960b09c1b15df18c0bc1c4fdb90bf48b6b5703e872040b668</Hashes>
+                <Hashes condition="contains">SHA256=c26b51b4c37330800cff8519252e110116c3aaade94ceb9894ec5bfb1b8f9924</Hashes>
+                <Hashes condition="contains">SHA256=7ec93f34eb323823eb199fbf8d06219086d517d0e8f4b9e348d7afd41ec9fd5d</Hashes>
+                <Hashes condition="contains">SHA256=4e37592a2a415f520438330c32cfbdbd6af594deef5290b2fa4b9722b898ff69</Hashes>
+                <Hashes condition="contains">SHA256=6f1fc8287dd8d724972d7a165683f2b2ad6837e16f09fe292714e8e38ecd1e38</Hashes>
+                <Hashes condition="contains">SHA256=85866e8c25d82c1ec91d7a8076c7d073cccf421cf57d9c83d80d63943a4edd94</Hashes>
+                <Hashes condition="contains">SHA256=6f1ff29e2e710f6d064dc74e8e011331d807c32cc2a622cbe507fd4b4d43f8f4</Hashes>
+                <Hashes condition="contains">SHA256=0cf6c6c2d231eaf67dfc87561cc9a56ecef89ab50baafee5a67962748d51faf3</Hashes>
+                <Hashes condition="contains">SHA256=fafa1bb36f0ac34b762a10e9f327dcab2152a6d0b16a19697362d49a31e7f566</Hashes>
+                <Hashes condition="contains">SHA256=bb50818a07b0eb1bd317467139b7eb4bad6cd89053fecdabfeae111689825955</Hashes>
+                <Hashes condition="contains">SHA256=4324f3d1e4007f6499a3d0f0102cd92ed9f554332bc0b633305cd7b957ff16c8</Hashes>
+                <Hashes condition="contains">SHA256=be54f7279e69fb7651f98e91d24069dbc7c4c67e65850e486622ccbdc44d9a57</Hashes>
+                <Hashes condition="contains">SHA256=845f1e228de249fc1ddf8dc28c39d03e8ad328a6277b6502d3932e83b879a65a</Hashes>
+                <Hashes condition="contains">SHA256=2a652de6b680d5ad92376ad323021850dab2c653abf06edf26120f7714b8e08a</Hashes>
+                <Hashes condition="contains">SHA256=8797d9afc7a6bb0933f100a8acbb5d0666ec691779d522ac66c66817155b1c0d</Hashes>
+                <Hashes condition="contains">SHA256=30abc0cc700fdebc74e62d574addc08f6227f9c7177d9eaa8cbc37d5c017c9bb</Hashes>
+                <Hashes condition="contains">SHA256=4d0580c20c1ba74cf90d44c82d040f0039542eea96e4bbff3996e6760f457cee</Hashes>
+                <Hashes condition="contains">SHA256=51e91dd108d974ae809e5fc23f6fbd16e13f672f86aa594dae4a5c4bc629b0b5</Hashes>
+                <Hashes condition="contains">SHA256=e81230217988f3e7ec6f89a06d231ec66039bdba340fd8ebb2bbb586506e3293</Hashes>
+                <Hashes condition="contains">SHA256=14adbf0bc43414a7700e5403100cff7fc6ade50bebfab16a17acf2fdda5a9da8</Hashes>
+                <Hashes condition="contains">SHA256=db90e554ad249c2bd888282ecf7d8da4d1538dd364129a3327b54f8242dd5653</Hashes>
+                <Hashes condition="contains">SHA256=a3e507e713f11901017fc328186ae98e23de7cea5594687480229f77d45848d8</Hashes>
+                <Hashes condition="contains">SHA256=65c26276cadda7a36f8977d1d01120edb5c3418be2317d501761092d5f9916c9</Hashes>
+                <Hashes condition="contains">SHA256=e3b257357be41a18319332df7023c4407e2b93ac4c9e0c6754032e29f3763eac</Hashes>
+                <Hashes condition="contains">SHA256=591bd5e92dfa0117b3daa29750e73e2db25baa717c31217539d30ffb1f7f3a52</Hashes>
+                <Hashes condition="contains">SHA256=16a2e578bc8683f17a175480fea4f53c838cfae965f1d4caa47eaf9e0b3415c1</Hashes>
+                <Hashes condition="contains">SHA256=97b32ddf83f75637e3ba934df117081dd6a1c57d47a4c9700d35e736da11d5bd</Hashes>
+                <Hashes condition="contains">SHA256=26453afb1f808f64bec87a2532a9361b696c0ed501d6b973a1f1b5ae152a4d40</Hashes>
+                <Hashes condition="contains">SHA256=ab0925398f3fa69a67eacee2bbb7b34ac395bb309df7fc7a9a9b8103ef41ed7a</Hashes>
+                <Hashes condition="contains">SHA256=7236c8ff33c0e5cfa956778aa7303f1979f3bf709c361399fa1ce101b7e355b8</Hashes>
+                <Hashes condition="contains">SHA256=4880f40f2e557cff38100620b9aa1a3a753cb693af16cd3d95841583edcb57a8</Hashes>
+                <Hashes condition="contains">SHA256=cc586254e9e89e88334adee44e332166119307e79c2f18f6c2ab90ce8ba7fc9b</Hashes>
+                <Hashes condition="contains">SHA256=3943a796cc7c5352aa57ccf544295bfd6fb69aae147bc8235a00202dc6ed6838</Hashes>
+                <Hashes condition="contains">SHA256=3fa6379951f08ed3cb87eeba9cf0c5f5e1d0317dcfcf003b810df9d795eeb73e</Hashes>
+                <Hashes condition="contains">SHA256=29a90ae1dcee66335ece4287a06482716530509912be863c85a2a03a6450a5b6</Hashes>
+                <Hashes condition="contains">SHA256=9a95a70f68144980f2d684e96c79bdc93ebca1587f46afae6962478631e85d0c</Hashes>
+                <Hashes condition="contains">SHA256=f744abb99c97d98e4cd08072a897107829d6d8481aee96c22443f626d00f4145</Hashes>
+                <Hashes condition="contains">SHA256=76660e91f1ff3cb89630df5af4fe09de6098d09baa66b1a130c89c3c5edd5b22</Hashes>
+                <Hashes condition="contains">SHA256=3a65d14fd3b1b5981084cdbd293dc6f4558911ea18dd80177d1e5b54d85bcaa0</Hashes>
+                <Hashes condition="contains">SHA256=0909005d625866ef8ccd8ae8af5745a469f4f70561b644d6e38b80bccb53eb06</Hashes>
+                <Hashes condition="contains">SHA256=be8dd2d39a527649e34dc77ef8bc07193a4234b38597b8f51e519dadc5479ec2</Hashes>
+                <Hashes condition="contains">SHA256=c64d4ac416363c7a1aa828929544d1c1d78cf032b39769943b851cfc4c0faafc</Hashes>
+                <Hashes condition="contains">SHA256=8939116df1d6c8fd0ebd14b2d37b3dec38a8820aa666ecd487bc1bb794f2a587</Hashes>
+                <Hashes condition="contains">SHA256=1e8b0c1966e566a523d652e00f7727d8b0663f1dfdce3b9a09b9adfaef48d8ee</Hashes>
+                <Hashes condition="contains">SHA256=55963284bbd5a3297f39f12f0d8a01ed99fe59d008561e3537bcd4db4b4268fa</Hashes>
+			</FileExecutableDetected>
+		</RuleGroup>
+
+
 	</EventFiltering>
 </Sysmon>
diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 34064a05..882fdc04 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -1580,6 +1580,12 @@
 
 			Note: We use only the SHA256 hash of the drivers for performance reasons, since this config generates MD5 and SHA256 hashes (see <HashAlgorithms>)
 
+			What happens: 
+				- Malicious driver load > report only
+				- Malicious driver drop > report only (if you want to block things, check the *-block.xml config)
+				- Vulnerable driver load > report only
+				- Vulnerable driver drop > report only
+
 			Syncronisation date: 28.06.2023
 			[ https://github.com/magicsword-io/LOLDrivers/tree/main/detections/sysmon ]
 		-->

From 65bc44390f0d756f61586088f770cd001481380e Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Wed, 28 Jun 2023 23:26:06 +0200
Subject: [PATCH 144/149] fix: schema version

---
 sysmonconfig-export-block.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 9680db71..0ad5470b 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -12,7 +12,7 @@
 		https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
 -->
 
-<Sysmon schemaversion="4.82">
+<Sysmon schemaversion="4.90">
 	<!--SYSMON META CONFIG-->
 	<HashAlgorithms>md5,sha256,IMPHASH</HashAlgorithms> <!-- Both MD5 and SHA256 are the industry-standard algorithms. Remove IMPHASH if you do not use DLL import fingerprinting. -->
 	<CheckRevocation/> <!-- Check loaded drivers, log if their code-signing certificate has been revoked, in case malware stole one to sign a kernel driver -->

From b2b5554b852ea2bd1b82bb86abe4729d770ed030 Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Thu, 27 Jul 2023 14:51:40 +0200
Subject: [PATCH 145/149] Update sysmonconfig-export.xml

---
 sysmonconfig-export.xml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 882fdc04..36a06d79 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -599,6 +599,7 @@
 			<TargetFilename condition="end with">.wsh</TargetFilename>
 			<TargetFilename condition="end with">.xls</TargetFilename><!--Microsoft [ https://medium.com/@threathuntingteam/msxsl-exe-and-wmic-exe-a-way-to-proxy-code-execution-8d524f642b75 ] -->
 			<TargetFilename condition="end with">.xlsm</TargetFilename> <!--Microsoft:Office:Word: Macro-->
+			<TargetFilename condition="end with">\VMware\VMware Tools\tools.conf</TargetFilename> <!-- Monitor for potential persistence using VMwareToolBoxCmd -->
 			<TargetFilename name="DefaultUserModified" condition="begin with">C:\Users\Default</TargetFilename> <!--Windows: Changes to default user profile-->
 			<TargetFilename condition="begin with">C:\Windows\system32\Drivers</TargetFilename> <!--Microsoft: Drivers dropped here-->
 			<TargetFilename condition="begin with">C:\Windows\SysWOW64\Drivers</TargetFilename> <!--Microsoft: Drivers dropped here-->

From 8b8c4195d75a5e947e6e0289404b6b6018845570 Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Thu, 27 Jul 2023 14:51:46 +0200
Subject: [PATCH 146/149] Update sysmonconfig-export-block.xml

---
 sysmonconfig-export-block.xml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 0ad5470b..2fa3f7df 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -556,6 +556,7 @@
 			<TargetFilename condition="end with">.wsh</TargetFilename>
 			<TargetFilename condition="end with">.xls</TargetFilename><!--Microsoft [ https://medium.com/@threathuntingteam/msxsl-exe-and-wmic-exe-a-way-to-proxy-code-execution-8d524f642b75 ] -->
 			<TargetFilename condition="end with">.xlsm</TargetFilename> <!--Microsoft:Office:Word: Macro-->
+			<TargetFilename condition="end with">\VMware\VMware Tools\tools.conf</TargetFilename> <!-- Monitor for potential persistence using VMwareToolBoxCmd -->
 			<TargetFilename name="DefaultUserModified" condition="begin with">C:\Users\Default</TargetFilename> <!--Windows: Changes to default user profile-->
 			<TargetFilename condition="begin with">C:\Windows\system32\Drivers</TargetFilename> <!--Microsoft: Drivers dropped here-->
 			<TargetFilename condition="begin with">C:\Windows\SysWOW64\Drivers</TargetFilename> <!--Microsoft: Drivers dropped here-->

From 65c78bab9d5988332696184e6802c2698329ae3d Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Thu, 14 Dec 2023 09:18:18 +0100
Subject: [PATCH 147/149] add: EDRSandblast

adding EDRSandblast itself (not just the drivers used by it)
---
 sysmonconfig-export-block.xml | 8 ++++++++
 sysmonconfig-export.xml       | 7 +++++++
 2 files changed, 15 insertions(+)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 2fa3f7df..f5ec664e 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -1489,6 +1489,14 @@
 			<Hashes condition="contains">IMPHASH=96DF3A3731912449521F6F8D183279B1</Hashes> <!-- Backstab -->
 			<Hashes condition="contains">IMPHASH=7E6CF3FF4576581271AC8A313B2AAB46</Hashes> <!-- Backstab -->
 			<Hashes condition="contains">IMPHASH=51791678F351C03A0EB4E2A7B05C6E17</Hashes> <!-- Backstab -->
+			<Hashes condition="contains">IMPHASH=25CE42B079282632708FC846129E98A5</Hashes> <!-- Forensia -->
+			<Hashes condition="contains">IMPHASH=021BCCA20BA3381B11BDDE26B4E62F20</Hashes> <!-- EDRSandBlast -->
+			<Hashes condition="contains">IMPHASH=59223B5F52D8799D38E0754855CBDF42</Hashes> <!-- EDRSandBlast -->
+			<Hashes condition="contains">IMPHASH=81E75D8F1D276C156653D3D8813E4A43</Hashes> <!-- EDRSandBlast -->
+			<Hashes condition="contains">IMPHASH=17244E8B6B8227E57FE709CCAD421420</Hashes> <!-- EDRSandBlast -->
+			<Hashes condition="contains">IMPHASH=5B76DA3ACDEDC8A5CDF23A798B5936B4</Hashes> <!-- EDRSandBlast -->
+			<Hashes condition="contains">IMPHASH=CB2B65BB77D995CC1C0E5DF1C860133C</Hashes> <!-- EDRSandBlast -->
+			<Hashes condition="contains">IMPHASH=40445337761D80CF465136FAFB1F63E6</Hashes> <!-- EDRSandBlast -->
 			<Hashes condition="contains">MD5=7B17F15713FCF13C764535AA2BDF52AA</Hashes>													<!-- ShaprEvtMute -->
 			<Hashes condition="contains">SHA1=4E18320493042BCD7D21B53E258974BC460ACC78</Hashes>										<!-- ShaprEvtMute -->
 			<Hashes condition="contains">SHA256=477DFE485F5BD9540CC83E88FC04AAFB6DE49CF1ADC6BD857D5D6F4C1730A6D1</Hashes>	<!-- ShaprEvtMute -->
diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 36a06d79..76f11824 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -1533,6 +1533,13 @@
 			<Hashes condition="contains">IMPHASH=7E6CF3FF4576581271AC8A313B2AAB46</Hashes> <!-- Backstab -->
 			<Hashes condition="contains">IMPHASH=51791678F351C03A0EB4E2A7B05C6E17</Hashes> <!-- Backstab -->
 			<Hashes condition="contains">IMPHASH=25CE42B079282632708FC846129E98A5</Hashes> <!-- Forensia -->
+			<Hashes condition="contains">IMPHASH=021BCCA20BA3381B11BDDE26B4E62F20</Hashes> <!-- EDRSandBlast -->
+			<Hashes condition="contains">IMPHASH=59223B5F52D8799D38E0754855CBDF42</Hashes> <!-- EDRSandBlast -->
+			<Hashes condition="contains">IMPHASH=81E75D8F1D276C156653D3D8813E4A43</Hashes> <!-- EDRSandBlast -->
+			<Hashes condition="contains">IMPHASH=17244E8B6B8227E57FE709CCAD421420</Hashes> <!-- EDRSandBlast -->
+			<Hashes condition="contains">IMPHASH=5B76DA3ACDEDC8A5CDF23A798B5936B4</Hashes> <!-- EDRSandBlast -->
+			<Hashes condition="contains">IMPHASH=CB2B65BB77D995CC1C0E5DF1C860133C</Hashes> <!-- EDRSandBlast -->
+			<Hashes condition="contains">IMPHASH=40445337761D80CF465136FAFB1F63E6</Hashes> <!-- EDRSandBlast -->
 			<Hashes condition="contains">MD5=7B17F15713FCF13C764535AA2BDF52AA</Hashes>													<!-- ShaprEvtMute -->
 			<Hashes condition="contains">SHA1=4E18320493042BCD7D21B53E258974BC460ACC78</Hashes>										<!-- ShaprEvtMute -->
 			<Hashes condition="contains">SHA256=477DFE485F5BD9540CC83E88FC04AAFB6DE49CF1ADC6BD857D5D6F4C1730A6D1</Hashes>	<!-- ShaprEvtMute -->

From 2dc85752385053115fde74f737a03cfed0a4ffdd Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Fri, 29 Dec 2023 15:32:51 +0100
Subject: [PATCH 148/149] EDRSilencer hashes

---
 sysmonconfig-export-block.xml | 1 +
 sysmonconfig-export.xml       | 1 +
 2 files changed, 2 insertions(+)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index f5ec664e..3a73bc53 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -1497,6 +1497,7 @@
 			<Hashes condition="contains">IMPHASH=5B76DA3ACDEDC8A5CDF23A798B5936B4</Hashes> <!-- EDRSandBlast -->
 			<Hashes condition="contains">IMPHASH=CB2B65BB77D995CC1C0E5DF1C860133C</Hashes> <!-- EDRSandBlast -->
 			<Hashes condition="contains">IMPHASH=40445337761D80CF465136FAFB1F63E6</Hashes> <!-- EDRSandBlast -->
+			<Hashes condition="contains">IMPHASH=8A790F401B29FA87BC1E56F7272B3AA6</Hashes> <!-- EDRSilencer -->
 			<Hashes condition="contains">MD5=7B17F15713FCF13C764535AA2BDF52AA</Hashes>													<!-- ShaprEvtMute -->
 			<Hashes condition="contains">SHA1=4E18320493042BCD7D21B53E258974BC460ACC78</Hashes>										<!-- ShaprEvtMute -->
 			<Hashes condition="contains">SHA256=477DFE485F5BD9540CC83E88FC04AAFB6DE49CF1ADC6BD857D5D6F4C1730A6D1</Hashes>	<!-- ShaprEvtMute -->
diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 76f11824..f43db054 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -1540,6 +1540,7 @@
 			<Hashes condition="contains">IMPHASH=5B76DA3ACDEDC8A5CDF23A798B5936B4</Hashes> <!-- EDRSandBlast -->
 			<Hashes condition="contains">IMPHASH=CB2B65BB77D995CC1C0E5DF1C860133C</Hashes> <!-- EDRSandBlast -->
 			<Hashes condition="contains">IMPHASH=40445337761D80CF465136FAFB1F63E6</Hashes> <!-- EDRSandBlast -->
+			<Hashes condition="contains">IMPHASH=8A790F401B29FA87BC1E56F7272B3AA6</Hashes> <!-- EDRSilencer -->
 			<Hashes condition="contains">MD5=7B17F15713FCF13C764535AA2BDF52AA</Hashes>													<!-- ShaprEvtMute -->
 			<Hashes condition="contains">SHA1=4E18320493042BCD7D21B53E258974BC460ACC78</Hashes>										<!-- ShaprEvtMute -->
 			<Hashes condition="contains">SHA256=477DFE485F5BD9540CC83E88FC04AAFB6DE49CF1ADC6BD857D5D6F4C1730A6D1</Hashes>	<!-- ShaprEvtMute -->

From f944c05d84912e55f0d01171b028748a86edefbf Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Thu, 1 Feb 2024 17:13:59 +0100
Subject: [PATCH 149/149] add: EventLogCrasher

---
 sysmonconfig-export-block.xml | 1 +
 sysmonconfig-export.xml       | 1 +
 2 files changed, 2 insertions(+)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 3a73bc53..00cf2ae8 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -1498,6 +1498,7 @@
 			<Hashes condition="contains">IMPHASH=CB2B65BB77D995CC1C0E5DF1C860133C</Hashes> <!-- EDRSandBlast -->
 			<Hashes condition="contains">IMPHASH=40445337761D80CF465136FAFB1F63E6</Hashes> <!-- EDRSandBlast -->
 			<Hashes condition="contains">IMPHASH=8A790F401B29FA87BC1E56F7272B3AA6</Hashes> <!-- EDRSilencer -->
+			<Hashes condition="contains">IMPHASH=B50199E952C875241B9CE06C971CE3C1</Hashes> <!-- EventLogCrasher -->
 			<Hashes condition="contains">MD5=7B17F15713FCF13C764535AA2BDF52AA</Hashes>													<!-- ShaprEvtMute -->
 			<Hashes condition="contains">SHA1=4E18320493042BCD7D21B53E258974BC460ACC78</Hashes>										<!-- ShaprEvtMute -->
 			<Hashes condition="contains">SHA256=477DFE485F5BD9540CC83E88FC04AAFB6DE49CF1ADC6BD857D5D6F4C1730A6D1</Hashes>	<!-- ShaprEvtMute -->
diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index f43db054..056b4171 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -1541,6 +1541,7 @@
 			<Hashes condition="contains">IMPHASH=CB2B65BB77D995CC1C0E5DF1C860133C</Hashes> <!-- EDRSandBlast -->
 			<Hashes condition="contains">IMPHASH=40445337761D80CF465136FAFB1F63E6</Hashes> <!-- EDRSandBlast -->
 			<Hashes condition="contains">IMPHASH=8A790F401B29FA87BC1E56F7272B3AA6</Hashes> <!-- EDRSilencer -->
+			<Hashes condition="contains">IMPHASH=B50199E952C875241B9CE06C971CE3C1</Hashes> <!-- EventLogCrasher -->
 			<Hashes condition="contains">MD5=7B17F15713FCF13C764535AA2BDF52AA</Hashes>													<!-- ShaprEvtMute -->
 			<Hashes condition="contains">SHA1=4E18320493042BCD7D21B53E258974BC460ACC78</Hashes>										<!-- ShaprEvtMute -->
 			<Hashes condition="contains">SHA256=477DFE485F5BD9540CC83E88FC04AAFB6DE49CF1ADC6BD857D5D6F4C1730A6D1</Hashes>	<!-- ShaprEvtMute -->