sysmonconfig-v10.xml

<Sysmon schemaversion="4.21">
  <EventFiltering>
   <RuleGroup name="" groupRelation="or">
    <ProcessCreate onmatch="include">
      <Image condition="image" name="technique_id=T1202,technique_name=Indirect Command Execution">wscript.exe</Image>
      <Image condition="begin with" name="technique_id=T1036,technique_name=Masquerading">C:\Windows\Fonts\</Image>
      <Image condition="contains" name="technique_id=T1036,technique_name=Masquerading">\htdocs\</Image>
      <Image condition="image">cmdkey.exe</Image>
      <Image condition="image" name="technique_id=T1033,technique_name=System Owner/User Discovery">systeminfo.exe</Image>
      <Image condition="image" name="technique_id=T1007,technique_name=System Service Discovery">LoadOrder.exe</Image>
      <Image condition="image" name="technique_id=T1057,technique_name=Process Discovery">PsInfo.exe</Image>
      <Image condition="begin with" name="technique_id=T1036,technique_name=Masquerading">C:\Windows\Media\</Image>
      <Image condition="image" name="technique_id=T1088,technique_name=Bypass User Account Control">ShellRunas.exe</Image>
      <Image condition="image" name="technique_id=T1112,technique_name=Modify Registry">reg.exe</Image>
      <Image condition="begin with" name="technique_id=T1036,technique_name=Masquerading">C:\Users\Public\</Image>
      <Image condition="image" name="technique_id=T1016,technique_name=System Network Configuration Discovery">nbtstat.exe</Image>
      <Image condition="image" name="technique_id=T1197,technique_name=BITS Jobs">bitsadmin.exe</Image>
      <Image condition="image" name="technique_id=T1033,technique_name=System Owner/User Discovery">PsLoggedOn.exe</Image>
      <Image condition="image">klist.exe</Image>
      <Image condition="begin with" name="technique_id=T1036,technique_name=Masquerading">C:\Windows\system32\config\systemprofile\</Image>
      <Image condition="image" name="technique_id=T1016,technique_name=System Network Configuration Discovery">ipconfig.exe</Image>
      <Image condition="image" name="technique_id=T1063,technique_name=Security Software Discovery">netsh.exe</Image>
      <Image condition="image" name="technique_id=T1033,technique_name=System Owner/User Discovery">quser.exe</Image>
      <Image condition="image" name="technique_id=T1057,technique_name=Process Discovery">query.exe</Image>
      <Image condition="image" name="technique_id=T1218,technique_name=Signed Binary Proxy Execution">Mavinject.exe</Image>
      <Image condition="begin with" name="technique_id=T1036,technique_name=Masquerading">C:\Windows\addins\</Image>
      <Image condition="image">hh.exe</Image>
      <Image condition="image" name="technique_id=T1191,technique_name=CMSTP">CMSTP.exe</Image>
      <Image condition="image" name="technique_id=T1089,technique_name=Disabling Security Tools">MpCmdRun.exe</Image>
      <Image condition="image" name="technique_id=T1083,technique_name=File and Directory Discovery">AccessChk.exe</Image>
      <Image condition="image" name="technique_id=T1007,technique_name=System Service Discovery">PsService.exe</Image>
      <Image condition="begin with" name="technique_id=T1036,technique_name=Masquerading">C:\Windows\Debug\</Image>
      <Image condition="image" name="technique_id=T1033,technique_name=System Owner/User Discovery">LogonSessions.exe</Image>
      <Image condition="image" name="technique_id=T1018,technique_name=Remote System Discovery">net.exe</Image>
      <Image condition="image">tree.com</Image>
      <Image condition="image" name="technique_id=T1105,technique_name=Remote File Copy">PsFile.exe</Image>
      <Image condition="image">schtasks.exe</Image>
      <Image condition="image" name="technique_id=T1057,technique_name=Process Discovery">qprocess.exe</Image>
      <Image condition="image" name="technique_id=T1057,technique_name=Process Discovery">rwinsta.exe</Image>
      <Image condition="image" name="technique_id=T1016,technique_name=System Network Configuration Discovery">route.exe</Image>
      <Image condition="image" name="technique_id=T1033,technique_name=System Owner/User Discovery">sysinfo.exe</Image>
      <Image condition="begin with" name="technique_id=T1036,technique_name=Masquerading">C:\Users\NetworkService\</Image>
      <Image condition="image" name="technique_id=T1016,technique_name=System Network Configuration Discovery">nslookup.exe</Image>
      <Image condition="image" name="technique_id=T1057,technique_name=Process Discovery">tasklist.exe</Image>
      <Image condition="image" name="technique_id=T1069,technique_name=Permission Groups Discovery">net1.exe</Image>
      <Image condition="image" name="technique_id=T1053,technique_name=Scheduled Task">taskeng.exe</Image>
      <Image condition="image" name="technique_id=T1035,technique_name=Service Execution">PsExec.exe</Image>
      <Image condition="image" name="technique_id=T1098,technique_name=Account Manipulation">PsPasswd.exe</Image>
      <Image condition="image" name="technique_id=T1003,technique_name=Credential Dumping">ProcDump.exe</Image>
      <Image condition="image" name="technique_id=T1138,technique_name=Application Shimming">sdbinst.exe</Image>
      <Image condition="image" name="technique_id=T1057,technique_name=Process Discovery">qwinsta.exe</Image>
      <Image condition="begin with" name="technique_id=T1036,technique_name=Masquerading">C:\Users\Default\</Image>
      <Image condition="image" name="technique_id=T1083,technique_name=File and Directory Discovery">AccessEnum.exe</Image>
      <Image condition="image" name="technique_id=T1218,technique_name=Signed Binary Proxy Execution">replace.exe</Image>
      <Image condition="image" name="technique_id=T1031,technique_name=Modify Existing Service">sc.exe</Image>
      <Image condition="begin with" name="technique_id=T1036,technique_name=Masquerading">C:\Windows\Help\</Image>
      <Image condition="image" name="technique_id=T1202,technique_name=Indirect Command Execution">pcalua.exe</Image>
      <Image condition="image" name="technique_id=T1086,technique_name=PowerShell">powershell.exe</Image>
      <Image condition="image" name="technique_id=T1005,technique_name=Data from Local System">PsLogList.exe</Image>
      <Image condition="image" name="technique_id=T1057,technique_name=Process Discovery">PsList.exe</Image>
      <Image condition="image" name="technique_id=T1134,technique_name=Access Token Manipulation">runas.exe</Image>
      <Image condition="image" name="technique_id=T1121,technique_name=Regsvcs/Regasm">regsvcs.exe</Image>
      <Image condition="image" name="technique_id=T1202,technique_name=Indirect Command Execution">cscript.exe</Image>
      <Image condition="image" name="technique_id=T1170,technique_name=Mshta">mshta.exe</Image>
      <Image condition="image" name="technique_id=T1202,technique_name=Indirect Command Execution">bash.exe</Image>
      <Image condition="image" name="technique_id=T1121,technique_name=Regsvcs/Regasm">regasm.exe</Image>
      <Image condition="begin with" name="technique_id=T1036,technique_name=Masquerading">C:\Intel\Logs\</Image>
      <Image condition="begin with" name="technique_id=T1036,technique_name=Masquerading">C:\Windows\repair\</Image>
      <Image condition="image" name="technique_id=T1218,technique_name=Signed Binary Proxy Execution">SyncAppvPublishingServer.exe</Image>
      <Image condition="image" name="technique_id=T1012,technique_name=Query Registry">ru.exe</Image>
      <Image condition="image" name="technique_id=T1057,technique_name=Process Discovery">PipeList.exe</Image>
      <Image condition="image" name="technique_id=T1028,technique_name=Windows Remote Management">winrm.cmd</Image>
      <Image condition="begin with" name="technique_id=T1036,technique_name=Masquerading">C:\PerfLogs\</Image>
      <Image condition="begin with" name="technique_id=T1036,technique_name=Masquerading">C:\$Recycle.bin\</Image>
      <Image condition="image" name="technique_id=T1127,technique_name=Trusted Developer Utilities">MSBuild.exe</Image>
      <Image condition="image" name="technique_id=T1158,technique_name=Hidden Files and DirectoriesHidden Files and Directories">attrib.exe</Image>
      <Image condition="image" name="technique_id=T1059,technique_name=Command-Line Interface">cmd.exe</Image>
      <Image condition="image" name="technique_id=T1089,technique_name=Disabling Security Tools">PsKill.exe</Image>
      <Image condition="image" name="technique_id=T1118,technique_name=InstallUtil">InstallUtil.exe</Image>
      <Image condition="image" name="technique_id=T1054,technique_name=Indicator Blocking">fltMC.exe</Image>
      <Image condition="image" name="technique_id=T1117,technique_name=Regsvr32">regsvr32.exe</Image>
      <Image condition="begin with" name="technique_id=T1036,technique_name=Masquerading">C:\Windows\security\</Image>
      <Image condition="image">odbcconf.exe</Image>
      <Image condition="image" name="technique_id=T1033,technique_name=System Owner/User Discovery">PsGetSID.exe</Image>
      <Image condition="image" name="technique_id=T1033,technique_name=System Owner/User Discovery">whoami.exe</Image>
      <Image condition="image" name="technique_id=T1070,technique_name=Indicator Removal on Host">wevtutil.exe</Image>
      <Image condition="image">taskkill.exe</Image>
      <Image condition="image">tracert.exe</Image>
      <Image condition="image" name="technique_id=T1028,technique_name=Windows Remote Management">wsmprovhost.exe</Image>
      <Image condition="image" name="technique_id=T1049,technique_name=System Network Connections Discovery">netstat.exe</Image>
      <Image condition="contains" name="technique_id=T1036,technique_name=Masquerading">\wwwroot\</Image>
      <CommandLine condition="contains" name="technique_id=T1196,technique_name=Control Panel Items">control.exe /name</CommandLine>
      <CommandLine condition="contains" name="technique_id=T1054,technique_name=Indicator Blocking">fltmc unload</CommandLine>
      <CommandLine condition="contains" name="technique_id=T1003,technique_name=Credential Dumping">-ma lsass.exe</CommandLine>
      <CommandLine condition="contains" name="technique_id=T1196,technique_name=Control Panel Items">rundll32.exe shell32.dll,Control_RunDLL</CommandLine>
      <CommandLine condition="contains" name="technique_id=T1063,technique_name=Security Software Discovery">misc::mflt</CommandLine>
      <CommandLine condition="contains" name="technique_id=T1027,technique_name=Obfuscated Files or Information">ˆ</CommandLine>
      <CommandLine condition="contains" name="technique_id=T1089,technique_name=Disabling Security Tools">DisableIOAVProtection</CommandLine>
      <CommandLine condition="contains" name="technique_id=T1089,technique_name=Disabling Security Tools">RemoveDefinitions</CommandLine>
      <CommandLine condition="contains" name="technique_id=T1118,technique_name=InstallUtil">/logfile= /LogToConsole=false /U</CommandLine>
      <CommandLine condition="contains" name="technique_id=T1089,technique_name=Disabling Security Tools">Add-MpPreference</CommandLine>
      <ParentImage condition="image" name="technique_id=T1059,technique_name=Command-Line Interface">cmd.exe</ParentImage>
      <ParentImage condition="image" name="technique_id=T1015,technique_name=Accessibility Features">utilman.exe</ParentImage>
      <ParentImage condition="image" name="technique_id=T1015,technique_name=Accessibility Features">DisplaySwitch.exe</ParentImage>
      <ParentImage condition="image" name="technique_id=T1015,technique_name=Accessibility Features">sethc.exe</ParentImage>
      <ParentImage condition="image" name="technique_id=T1202,technique_name=Indirect Command Execution">wscript.exe</ParentImage>
      <ParentImage condition="image" name="technique_id=T1202,technique_name=Indirect Command Execution">control.exe</ParentImage>
      <ParentImage condition="image" name="technique_id=T1202,technique_name=Indirect Command Execution">cscript.exe</ParentImage>
      <ParentImage condition="image" name="technique_id=T1088,technique_name=Bypass User Account Control">fodhelper.exe</ParentImage>
      <ParentImage condition="image" name="technique_id=T1088,technique_name=Bypass User Account Control">eventvwr.exe</ParentImage>
      <ParentImage condition="image" name="technique_id=T1015,technique_name=Accessibility Features">osk.exe</ParentImage>
      <ParentImage condition="image" name="technique_id=T1086,technique_name=PowerShell">powershell.exe</ParentImage>
      <ParentImage condition="image" name="technique_id=T1086,technique_name=PowerShell">powershell_ise.exe</ParentImage>
      <ParentImage condition="image" name="technique_id=T1047,technique_name=Windows Management Instrumentation">wmiprvse.exe</ParentImage>
      <ParentImage condition="image" name="technique_id=T1015,technique_name=Accessibility Features">Magnify.exe</ParentImage>
      <ParentImage condition="image" name="technique_id=T1170,technique_name=Mshta">mshta.exe</ParentImage>
      <ParentImage condition="image" name="technique_id=T1015,technique_name=Accessibility Features">AtBroker.exe</ParentImage>
      <ParentImage condition="image" name="technique_id=T1015,technique_name=Accessibility Features">Narrator.exe</ParentImage>
      <ParentImage condition="image" name="technique_id=T1202,technique_name=Indirect Command Execution">pcalua.exe</ParentImage>
      <ParentImage condition="image">excel.exe</ParentImage>
	    <ParentImage condition="image">winword.exe</ParentImage>
	    <ParentImage condition="image">powerpnt.exe</ParentImage>
	    <ParentImage condition="image">outlook.exe</ParentImage>
	    <ParentImage condition="image">msaccess.exe</ParentImage>
      <Image condition="image">icacls.exe</Image>
      <Image condition="image">forfiles.exe</Image>
      <Image condition="image">takeown.exe</Image>
      <Image condition="image">wusa.exe</Image>      
    </ProcessCreate>
</RuleGroup>
<RuleGroup name="" groupRelation="or">
    <ProcessCreate onmatch="exclude">
			<ParentImage condition="is">C:\Program Files (x86)\RES Software\Workspace Manager\pfwsmgr.exe</ParentImage>
			<ParentImage condition="is">C:\Program Files (x86)\RES Software\Workspace Manager\respesvc64.exe</ParentImage>
			<ParentImage condition="is">C:\Program Files (x86)\Ivanti\Workspace Control\pfwsmgr.exe</ParentImage>
			<ParentImage condition="is">C:\Program Files (x86)\RES Software\Workspace Manager\ResPesvc64.exe</ParentImage>
			<ParentImage condition="is">C:\Program Files\RES Software\Workspace Manager\respesvc.exe</ParentImage>
			<ParentImage condition="is">C:\Program Files\Ivanti\Workspace Control\ResPesvc.exe</ParentImage>    
      <Image condition="end with">C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe</Image>
      <Image condition="begin with">D:\Program Files\SplunkUniversalForwarder\bin\</Image>
      <Image>C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe</Image>
      <Image>C:\Windows\System32\conhost.exe</Image>
      <Image>C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmExtIns.exe</Image>
      <Image>C:\Windows\System32\audiodg.exe</Image>
      <Image>C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe</Image>
      <Image>C:\Program Files (x86)\Sophos\Remote Management System\ManagementAgentNT.exe</Image>
      <Image>C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe</Image>
      <Image condition="end with">C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe</Image>
      <Image>C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE</Image>
      <Image>C:\Program Files\ESET\ESET Nod32 Antivirus\ekrn.exe</Image>
      <Image condition="end with">C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AdobeGCClient.exe</Image>
      <Image>C:\Windows\SysWOW64\wermgr.exe</Image>
      <Image condition="begin with">C:\Program Files\Windows Defender\</Image>
      <Image condition="end with">C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\LogTransport2.exe</Image>
      <Image>C:\Program Files\Microsoft Security Client\MpCmdRun.exe</Image>
      <Image condition="end with">C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P7\adobe_licutil.exe</Image>
      <Image>C:\Windows\System32\wermgr.exe</Image>
      <Image>C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe</Image>
      <Image condition="begin with">D:\Program Files\Splunk\bin\</Image>
      <Image>C:\Program Files (x86)\Sophos\Sophos System Protection\ssp.exe</Image>
      <Image condition="end with">C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe</Image>
      <Image condition="begin with">C:\Program Files\Splunk\bin\</Image>
      <Image>C:\Windows\system32\sppsvc.exe</Image>
      <Image condition="begin with">C:\Program Files\SplunkUniversalForwarder\bin\</Image>
      <Image>C:\Program Files (x86)\Trend Micro\BM\TMBMSRV.exe</Image>
      <Image>C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe</Image>
      <Image>C:\Windows\System32\powercfg.exe</Image>
      <Image condition="begin with">C:\Program Files (x86)\Google\Update\</Image>
      <Image>C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe</Image>
      <Image condition="end with">C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe</Image>
      <Image>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe</Image>
      <Image condition="begin with">C:\Program Files\Realtek\</Image>
      <Image condition="begin with">C:\Windows\SoftwareDistribution\Download\Install\AM_</Image>
      <Image>C:\Program Files (x86)\Sophos\Remote Management System\RouterNT.exe</Image>
      <Image>C:\Windows\System32\wbem\WmiApSrv.exe</Image>
      <Image condition="end with">C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe</Image>
      <Image condition="end with">C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe</Image>
      <Image>C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe</Image>
      <Image>C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe</Image>
      <Image>C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe</Image>
      <Image>C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe</Image>
      <Image>C:\Windows\system32\MpSigStub.exe</Image>
      <Image condition="end with">C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P6\adobe_licutil.exe</Image>
      <Image>C:\Windows\System32\MusNotification.exe</Image>
      <Image condition="end with">C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe</Image>
      <Image condition="end with">C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe</Image>
      <Image condition="begin with">C:\Program Files\NVIDIA Corporation\</Image>
      <Image condition="end with">C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe</Image>
      <Image>C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmListen.exe</Image>
      <Image>C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmopExtIns32.exe</Image>
      <Image condition="end with">C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe</Image>
      <Image>C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE</Image>
      <Image>C:\Windows\System32\MusNotificationUx.exe</Image>
      <Image condition="end with">C:\Windows\System32\CompatTelRunner.exe</Image>
      <CommandLine>C:\Windows\system32\svchost.exe -k netsvcs -s SessionEnv</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s fhsvc</CommandLine>
      <CommandLine>C:\Windows\system32\SearchIndexer.exe /Embedding</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k netsvcs</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k networkServiceNetworkRestricted</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k networkService -s LanmanWorkstation</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k netsvcs -s SENS</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k netsvcs -s BITS</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k netsvcs -s CertPropSvc</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k networkService -p -s DoSvc</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k devicesflow -s DevicesFlowUserSvc</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k networkService -s NlaSvc</CommandLine>
      <CommandLine>C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wlidsvc</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k dcomlaunch -s PlugPlay</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s TimeBrokerSvc</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k netsvcs -s Themes</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k netsvcs -s BDESVC</CommandLine>
      <CommandLine condition="begin with">"C:\Program Files\Mozilla Firefox\plugin-container.exe" --channel</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k wsappx</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k rPCSS</CommandLine>
      <CommandLine>C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost</CommandLine>
      <CommandLine condition="begin with">"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k utcsvc</CommandLine>
      <CommandLine condition="begin with">C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe</CommandLine>
      <CommandLine condition="contains">AcroRd32.exe" /CR </CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s SensorService</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k localService -s bthserv</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s DeviceAssociationService</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k localService -s nsi</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s WPDBusEnum</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k unistackSvcGroup</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k secsvcs</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s WFDSConMgrSvc</CommandLine>
      <CommandLine>C:\WINDOWS\system32\svchost.exe -k appmodel -p -s tiledatamodelsvc</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k localService -s EventSystem</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k appmodel</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k netsvcs -s Winmgmt</CommandLine>
      <CommandLine>C:\WINDOWS\system32\svchost.exe -k wsappx -p -s AppXSvc</CommandLine>
      <CommandLine condition="begin with">C:\Windows\system32\DllHost.exe /Processid</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k networkService -s TermService</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k netsvcs -s ProfSvc</CommandLine>
      <CommandLine condition="begin with">"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s EventLog</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation -s SensrSvc</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k camera -s FrameServer</CommandLine>
      <CommandLine condition="contains">AcroRd32.exe" --channel=</CommandLine>
      <CommandLine condition="begin with">"C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s Dhcp</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k netsvcs -p -s ncaSvc</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k localService -s w32Time</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s WdiSystemHost</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k defragsvc</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s WPDBusEnum</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k werSvcGroup</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s NcbService</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k dcomlaunch -s LSM</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k wsappx -s ClipSVC</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k networkService</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k networkService -s Dnscache</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s UmRdpService</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k localServiceNoNetwork</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k netsvcs -s Gpsvc</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k appmodel -s StateRepository</CommandLine>
      <CommandLine>C:\WINDOWS\System32\svchost.exe -k wsappx -p -s ClipSVC</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k imgsvc</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k wbioSvcGroup</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s TabletInputService</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k swprv</CommandLine>
      <CommandLine>C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation</CommandLine>
      <IntegrityLevel>AppContainer</IntegrityLevel>
      <ParentImage>D:\Program Files\SplunkUniversalForwarder\bin\splunk.exe</ParentImage>
      <ParentImage>C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe</ParentImage>
      <ParentImage>C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe</ParentImage>
      <ParentImage condition="end with">C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\CCXProcess.exe</ParentImage>
      <ParentImage condition="end with">C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P7\adobe_licutil.exe</ParentImage>
      <ParentImage>C:\Windows\system32\SearchIndexer.exe</ParentImage>
      <ParentImage condition="end with">C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe</ParentImage>
      <ParentImage>D:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe</ParentImage>
      <ParentImage>D:\Program Files\Splunk\bin\splunkd.exe</ParentImage>
      <ParentImage condition="end with">C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe</ParentImage>
      <ParentImage>C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe</ParentImage>
      <ParentImage condition="end with">C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe</ParentImage>
      <ParentImage condition="end with">C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe</ParentImage>
      <ParentImage condition="end with">C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe</ParentImage>
      <ParentImage>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe</ParentImage>
      <ParentImage condition="end with">C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe</ParentImage>
      <ParentImage condition="end with">C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe</ParentImage>
      <ParentImage>C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe</ParentImage>
      <ParentImage>C:\Program Files\Splunk\bin\splunkd.exe</ParentImage>
      <ParentImage>C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe</ParentImage>
      <ParentImage>C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe</ParentImage>
      <ParentImage condition="end with">C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe</ParentImage>
      <ParentImage>C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe</ParentImage>
      <ParentImage condition="begin with">C:\Program Files (x86)\Google\Update\</ParentImage>
      <ParentCommandLine>C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted</ParentCommandLine>
      <ParentCommandLine condition="begin with">%%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows</ParentCommandLine>
      <ParentCommandLine condition="contains">C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe</ParentCommandLine>
      <ParentCommandLine>C:\Windows\system32\svchost.exe -k netsvcs</ParentCommandLine>
    </ProcessCreate>
</RuleGroup>    
<RuleGroup name="" groupRelation="or">    
    <FileCreateTime onmatch="include">
      <Image condition="begin with" name="technique_id=T1099,technique_name=Timestomp">C:\Users</Image>
      <Image condition="begin with" name="technique_id=T1099,technique_name=Timestomp">C:\Temp</Image>
      <Image condition="begin with" name="technique_id=T1099,technique_name=Timestomp">C:\Windows\Temp</Image>
      <Image condition="begin with" name="technique_id=T1099,technique_name=Timestomp">C:\Tmp</Image>
    </FileCreateTime>
</RuleGroup>    
<RuleGroup name="" groupRelation="or">    
    <FileCreateTime onmatch="exclude">
      <Image condition="contains">AppData\Local\Google\Chrome\Application\chrome.exe</Image>
      <Image condition="contains">setup</Image>
      <Image condition="image">OneDrive.exe</Image>
    </FileCreateTime>
</RuleGroup>    
<RuleGroup name="" groupRelation="or">    
    <NetworkConnect onmatch="include">
      <Image condition="image" name="technique_id=T1202,technique_name=Indirect Command Execution">wscript.exe</Image>
      <Image condition="image">java.exe</Image>
      <Image condition="begin with" name="technique_id=T1036,technique_name=Masquerading">C:\Windows\Fonts\</Image>
      <Image condition="image" name="technique_id=T1021,technique_name=Remote Services">vnc.exe</Image>
      <Image condition="image">dsquery.exe</Image>
      <Image condition="contains" name="technique_id=T1036,technique_name=Masquerading">\htdocs\</Image>
      <Image condition="image" name="technique_id=T1218,technique_name=Signed Binary Proxy Execution">notepad.exe</Image>
      <Image condition="image">tor.exe</Image>
      <Image condition="image" name="technique_id=T1218,technique_name=Signed Binary Proxy Execution">SyncAppvPublishingServer.exe</Image>
      <Image condition="image" name="technique_id=T1218,technique_name=Signed Binary Proxy Execution">certutil.exe</Image>
      <Image condition="begin with" name="technique_id=T1036,technique_name=Masquerading">C:\Windows\Media\</Image>
      <Image condition="image" name="technique_id=T1112,technique_name=Modify Registry">reg.exe</Image>
      <Image condition="image" name="technique_id=T1047,technique_name=Windows Management Instrumentation">wmic.exe</Image>
      <Image condition="begin with" name="technique_id=T1036,technique_name=Masquerading">C:\Users\Public\</Image>
      <Image condition="image" name="technique_id=T1016,technique_name=System Network Configuration Discovery">nbtstat.exe</Image>
      <Image condition="begin with" name="technique_id=T1036,technique_name=Masquerading">C:\ProgramData</Image>
      <Image condition="image">klist.exe</Image>
      <Image condition="begin with" name="technique_id=T1036,technique_name=Masquerading">C:\Windows\system32\config\systemprofile\</Image>
      <Image condition="image" name="technique_id=T1016,technique_name=System Network Configuration Discovery">ipconfig.exe</Image>
      <Image condition="image" name="technique_id=T1063,technique_name=Security Software Discovery">netsh.exe</Image>
      <Image condition="image">infDefaultInstall.exe</Image>
      <Image condition="image" name="technique_id=T1033,technique_name=System Owner/User Discovery">quser.exe</Image>
      <Image condition="image" name="technique_id=T1057,technique_name=Process Discovery">query.exe</Image>
      <Image condition="image" name="technique_id=T1218,technique_name=Signed Binary Proxy Execution">Mavinject.exe</Image>
      <Image condition="begin with" name="technique_id=T1036,technique_name=Masquerading">C:\Windows\addins\</Image>
      <Image condition="begin with" name="technique_id=T1036,technique_name=Masquerading">C:\Users\NetworkService\</Image>
      <Image condition="image" name="technique_id=T1197,technique_name=BITS Jobs">bitsadmin.exe</Image>
      <Image condition="image" name="technique_id=T1021,technique_name=Remote Services">omniinet.exe</Image>
      <Image condition="begin with" name="technique_id=T1036,technique_name=Masquerading">C:\Windows\Debug\</Image>
      <Image condition="begin with" name="technique_id=T1036,technique_name=Masquerading">C:\Temp</Image>
      <Image condition="image">javaws.exe</Image>
      <Image condition="image" name="technique_id=T1202,technique_name=Indirect Command Execution">bash.exe</Image>
      <Image condition="image" name="technique_id=T1018,technique_name=Remote System Discovery">net.exe</Image>
      <Image condition="image">javaw.exe</Image>
      <Image condition="image">schtasks.exe</Image>
      <Image condition="image" name="technique_id=T1057,technique_name=Process Discovery">qprocess.exe</Image>
      <Image condition="image" name="technique_id=T1057,technique_name=Process Discovery">rwinsta.exe</Image>
      <Image condition="image" name="technique_id=T1016,technique_name=System Network Configuration Discovery">nslookup.exe</Image>
      <Image condition="image" name="technique_id=T1031,technique_name=Modify Existing Service">mmc.exe</Image>
      <Image condition="image" name="technique_id=T1057,technique_name=Process Discovery">tasklist.exe</Image>
      <Image condition="image" name="technique_id=T1069,technique_name=Permission Groups Discovery">net1.exe</Image>
      <Image condition="image" name="technique_id=T1053,technique_name=Scheduled Task">taskeng.exe</Image>
      <Image condition="image" name="technique_id=T1202,technique_name=Indirect Command Execution">cscript.exe</Image>
      <Image condition="begin with" name="technique_id=T1036,technique_name=Masquerading">C:\Windows\Temp</Image>
      <Image condition="begin with" name="technique_id=T1036,technique_name=Masquerading">C:\PerfLogs\</Image>
      <Image condition="image" name="technique_id=T1057,technique_name=Process Discovery">qwinsta.exe</Image>
      <Image condition="image" name="technique_id=T1035,technique_name=Service Execution">psexesvc.exe</Image>
      <Image condition="begin with" name="technique_id=T1036,technique_name=Masquerading">C:\Users\Default\</Image>
      <Image condition="image" name="technique_id=T1053,technique_name=Scheduled Task">at.exe</Image>
      <Image condition="image" name="technique_id=T1218,technique_name=Signed Binary Proxy Execution">replace.exe</Image>
      <Image condition="image" name="technique_id=T1031,technique_name=Modify Existing Service">sc.exe</Image>
      <Image condition="begin with" name="technique_id=T1036,technique_name=Masquerading">C:\Windows\Help\</Image>
      <Image condition="image" name="technique_id=T1202,technique_name=Indirect Command Execution">pcalua.exe</Image>
      <Image condition="image" name="technique_id=T1021,technique_name=Remote Services">hpsmhd.exe</Image>
      <Image condition="image" name="technique_id=T1134,technique_name=Access Token Manipulation">runas.exe</Image>
      <Image condition="image" name="technique_id=T1035,technique_name=Service Execution">psexec.exe</Image>
      <Image condition="image" name="technique_id=T1085,technique_name=Rundll32">rundll32.exe</Image>
      <Image condition="image" name="technique_id=T1121,technique_name=Regsvcs/Regasm">regsvcs.exe</Image>
      <Image condition="image">driverquery.exe</Image>
      <Image condition="image" name="technique_id=T1170,technique_name=Mshta">mshta.exe</Image>
      <Image condition="image" name="technique_id=T1086,technique_name=PowerShell">powershell.exe</Image>
      <Image condition="image" name="technique_id=T1021,technique_name=Remote Services">vncservice.exe</Image>
      <Image condition="image" name="technique_id=T1218,technique_name=Signed Binary Proxy Execution">msbuild.exe</Image>
      <Image condition="begin with" name="technique_id=T1036,technique_name=Masquerading">C:\Intel\Logs\</Image>
      <Image condition="begin with" name="technique_id=T1036,technique_name=Masquerading">C:\Windows\repair\</Image>
      <Image condition="image" name="technique_id=T1021,technique_name=Remote Services">vncviewer.exe</Image>
      <Image condition="begin with" name="technique_id=T1036,technique_name=Masquerading">C:\$Recycle.bin\</Image>
      <Image condition="image" name="technique_id=T1218,technique_name=Signed Binary Proxy Execution">msiexec.exe</Image>
      <Image condition="image" name="technique_id=T1059,technique_name=Command-Line Interface">cmd.exe</Image>
      <Image condition="image" name="technique_id=T1035,technique_name=Service Execution">winexesvc.exe</Image>
      <Image condition="image" name="technique_id=T1117,technique_name=Regsvr32">regsvr32.exe</Image>
      <Image condition="begin with" name="technique_id=T1036,technique_name=Masquerading">C:\Windows\security\</Image>
      <Image condition="image" name="technique_id=T1070,technique_name=Indicator Removal on Host">wevtutil.exe</Image>
      <Image condition="image">taskkill.exe</Image>
      <Image condition="image">hh.exe</Image>
      <Image condition="begin with" name="technique_id=T1036,technique_name=Masquerading">C:\Users</Image>
      <Image condition="image" name="technique_id=T1049,technique_name=System Network Connections Discovery">netstat.exe</Image>
      <Image condition="contains" name="technique_id=T1036,technique_name=Masquerading">\wwwroot\</Image>
      <DestinationPort name="technique_id=T1043,technique_name=Commonly Used Port">1723</DestinationPort>
      <DestinationPort name="technique_id=T1043,technique_name=Commonly Used Port">8080</DestinationPort>
      <DestinationPort name="technique_id=T1021,technique_name=Remote Services">23</DestinationPort>
      <DestinationPort name="technique_id=T1043,technique_name=Commonly Used Port">9001</DestinationPort>
      <DestinationPort name="technique_id=T1021,technique_name=Remote Services">22</DestinationPort>
      <DestinationPort name="technique_id=T1028,technique_name=Windows Remote Management">5986</DestinationPort>
      <DestinationPort name="technique_id=T1021,technique_name=Remote Services">5900</DestinationPort>
      <DestinationPort name="technique_id=T1043,technique_name=Commonly Used Port">3128</DestinationPort>
      <DestinationPort name="technique_id=T1021,technique_name=Remote Services">3389</DestinationPort>
      <DestinationPort name="technique_id=T1043,technique_name=Commonly Used Port">9030</DestinationPort>
      <DestinationPort name="technique_id=T1043,technique_name=Commonly Used Port">25</DestinationPort>
      <DestinationPort name="technique_id=T1043,technique_name=Commonly Used Port">4500</DestinationPort>
      <DestinationPort name="technique_id=T1043,technique_name=Commonly Used Port">1080</DestinationPort>
      <DestinationPort name="technique_id=T1021,technique_name=Remote Services">5800</DestinationPort>
	  <DestinationHostname>api.ipify.org</DestinationHostname> 
	  <DestinationHostname>whatismyipaddress.com</DestinationHostname>
	  <DestinationHostname>edns.ip-api.com</DestinationHostname> 
	  <DestinationHostname>checkip.dyndns.org</DestinationHostname>
	  <DestinationHostname>icanhazip.com</DestinationHostname>
	  <DestinationHostname>ifconfig.me</DestinationHostname>
	  <DestinationHostname>ifconfig.co</DestinationHostname>
	  <DestinationHostname>ipaddress.com</DestinationHostname> 
	  <DestinationHostname>ipinfo.io</DestinationHostname>
	  <DestinationHostname>ident.me</DestinationHostname>
	  <DestinationHostname>api.ip.sb</DestinationHostname>
	  <DestinationHostname>www.myexternalip.com</DestinationHostname>
	  <DestinationHostname>ip.anysrc.net</DestinationHostname> 
	  <DestinationHostname>wtfismyip.com</DestinationHostname> 
	  <DestinationHostname>myexternalip.com</DestinationHostname>
	  <DestinationHostname>api.ip.sb</DestinationHostname>
	  <DestinationHostname>ipecho.net</DestinationHostname> 
	  <DestinationHostname>checkip.amazonaws.com</DestinationHostname>
	  <DestinationHostname>ip-api.com</DestinationHostname>
      <DestinationPort>445</DestinationPort> <!-- smb -->
	  <SourcePort>445</SourcePort> <!-- smb -->
	  <DestinationPort>139</DestinationPort> <!-- nbns -->
	  <DestinationPort>389</DestinationPort> <!-- ldap -->
	  <DestinationPort>636</DestinationPort> <!-- ldaps -->
	  <DestinationPort>3268</DestinationPort> <!-- msft-gc -->
	  <DestinationPort>3269</DestinationPort> <!-- msft-gc -->
    </NetworkConnect>
</RuleGroup>
<RuleGroup name="" groupRelation="or">    
    <NetworkConnect onmatch="exclude">
      <Image>C:\Program Files\ESET\ESET Nod32 Antivirus\ekrn.exe</Image>
      <Image condition="image">Spotify.exe</Image>
      <Image condition="image">OneDrive.exe</Image>
      <Image condition="image">OneDriveStandaloneUpdater.exe</Image>
      <Image>C:\Program Files (x86)\Sophos\Remote Management System\RouterNT.exe</Image>
      <Image>C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe</Image>
      <Image>C:\Program files (x86)\Trend Micro\OfficeScan Client\tmlisten.exe</Image>
      <Image>C:\Program Files (x86)\Trend Micro\BM\TMBMSRV.exe</Image>
      <Image>C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe</Image>
      <Image>C:\Program Files\Sophos\Sophos Network Threat Protection\bin\SntpService.exe</Image>
      <Image>C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe</Image>
      <Image condition="end with">AppData\Roaming\Dropbox\bin\Dropbox.exe</Image>
      <DestinationHostname condition="end with">microsoft.com.nsatc.net</DestinationHostname>
      <DestinationHostname condition="end with">microsoft.com.akadns.net</DestinationHostname>
      <DestinationHostname condition="end with">microsoft.com</DestinationHostname>
      <Image>C:\Windows\System32\dns.exe</Image><!-- noisy for dns -->
	    <Image>C:\Windows\System32\svchost.exe</Image><!-- noisy for dns and ldap -->
	    <Image>C:\Windows\System32\lsass.exe</Image><!-- noisy for ldap -->
	    <Image>C:\Windows\System32\dfsrs.exe</Image><!-- noisy for ldap -->
	    <Image>C:\Windows\System32\taskhost.exe</Image><!-- noisy for ldap -->
	    <Image>C:\Windows\System32\wbem\WmiPrvSE.exe</Image><!-- noisy for ldap -->
	    <Image>C:\Windows\System32\wbem\WmiApSrv.exe</Image><!-- noisy for ldap -->
	    <Image>C:\Windows\System32\taskhostw.exe</Image><!-- noisy for ldap -->
	    <Image>C:\Windows\CCM\CcmExec.exe</Image>
	    <Image>C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe</Image><!-- noisy for ldap -->
	    <Image>C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClient.exe</Image><!-- noisy for ldap -->
	    <Image>C:\Program Files (x86)\Google\Chrome\Application\chrome.exe</Image><!-- noisy for 5353 MDNS -->
	    <Image>C:\Windows\System32\dfssvc.exe</Image><!-- noisy for ldap -->
	    <Image>C:\Windows\System32\dsregcmd.exe</Image><!-- noisy for ldap -->     
    </NetworkConnect>
</RuleGroup>    
<RuleGroup name="" groupRelation="or">    
    <ProcessTerminate onmatch="include">
      <Image condition="begin with">C:\Users</Image>
      <Image condition="begin with">C:\Temp</Image>
      <Image condition="begin with">C:\Windows\Temp</Image>
    </ProcessTerminate>
</RuleGroup>    
<RuleGroup name="" groupRelation="or">    
    <DriverLoad onmatch="include" />
</RuleGroup>    
<RuleGroup name="" groupRelation="or">
    <DriverLoad onmatch="exclude">
      <Signature condition="begin with">Intel </Signature>
      <Signature condition="contains">microsoft</Signature>
      <Signature condition="contains">windows</Signature>
    </DriverLoad>
</RuleGroup>
<RuleGroup name="" groupRelation="or">
    <ImageLoad onmatch="include">
    <ImageLoaded condition="end with" name="Execution - Suspicious WMI module load">wmiutils.dll</ImageLoaded>
	  <ImageLoaded condition="end with" name="Execution - Suspicious Microsoft.XMLDOM module load">msxml3.dll</ImageLoaded>
	  <ImageLoaded condition="end with" name="Execution - Suspicious Schedule.Service Module Load">taskschd.dll</ImageLoaded>
	  <!-- known bad dll names -->
	  <ImageLoaded condition="end with">rdpwrap.dll</ImageLoaded> <!-- RDP Setting hijack - https://github.com/stascorp/rdpwrap -->
	  <ImageLoaded condition="end with" name="Possible UAC Bypass - DiskCleanup">logprovider.dll</ImageLoaded> <!-- Win10 UAC Bypass via DiskCleanup loading a rogue DISM DLL -->
	  <ImageLoaded condition="end with" name="Possible UAC Bypass - mcx2prov DLL">CRYPTBASE.dll</ImageLoaded> <!-- UAC Bypass via mcx2prov executable and rogue CRYPTBASE.dll-->
	  <!-- Invalid signatures -->
	  <SignatureStatus condition="is" name="dll with invalid signature detected">Invalid</SignatureStatus>
	  <!-- abnormal loaded module file extension -->
	  <ImageLoaded condition="end with">.png</ImageLoaded>
	  <ImageLoaded condition="end with">.jpg</ImageLoaded>
	  <ImageLoaded condition="end with">.dat</ImageLoaded>
	  <ImageLoaded condition="end with">.tmp</ImageLoaded>
	  <ImageLoaded condition="end with">.inf</ImageLoaded>
	  <ImageLoaded condition="end with">.ini</ImageLoaded>
	  <ImageLoaded condition="end with">.log</ImageLoaded>
	  <!-- Office Addins -->
	  <ImageLoaded condition="end with">.wll</ImageLoaded>
	  <ImageLoaded condition="end with">.xll</ImageLoaded>
	  <!-- Unmanaged PowerShell -->
	  <ImageLoaded condition="end with" name="Defense Evasion - Unmanaged PowerShell Detected">system.management.automation.ni.dll</ImageLoaded>
	  <ImageLoaded condition="end with" name="Defense Evasion - Unmanaged PowerShell Detected">system.management.automation.dll</ImageLoaded>
    	  <ImageLoaded condition="begin with">\\</ImageLoaded><!-- loaded from network file share -->
	  <ImageLoaded condition="contains">admin$</ImageLoaded><!-- loaded from network file share -->
	  <ImageLoaded condition="contains">c$</ImageLoaded><!-- loaded from network file share -->
	  <ImageLoaded condition="contains">\appdata\</ImageLoaded>
	  <ImageLoaded condition="contains">\temp\</ImageLoaded>
	  <ImageLoaded condition="begin with">c:\programdata\</ImageLoaded>
	  <ImageLoaded condition="begin with" >C:\Windows\Media\</ImageLoaded>
      <ImageLoaded condition="begin with" >C:\Windows\addins\</ImageLoaded>
	  <ImageLoaded condition="begin with" >C:\Windows\system32\config\systemprofile\</ImageLoaded>
	  <ImageLoaded condition="begin with" >C:\Windows\Debug\</ImageLoaded> 
	  <ImageLoaded condition="begin with" >C:\Windows\Temp</ImageLoaded>
      <ImageLoaded condition="begin with" >C:\PerfLogs\</ImageLoaded>
	  <ImageLoaded condition="begin with" >C:\Windows\Help\</ImageLoaded>
	  <ImageLoaded condition="begin with" >C:\Intel\Logs\</ImageLoaded>
	  <ImageLoaded condition="begin with">C:\Temp</ImageLoaded>
      <ImageLoaded condition="begin with" >C:\Windows\repair\</ImageLoaded>
      <ImageLoaded condition="begin with" >C:\Windows\security\</ImageLoaded>
      <ImageLoaded condition="begin with" >C:\Windows\Fonts\</ImageLoaded>
	  <ImageLoaded condition="begin with">file:</ImageLoaded>
	  <ImageLoaded condition="contains">$Recycle.bin\</ImageLoaded>
	  <ImageLoaded condition="contains">\Windows\IME\</ImageLoaded>	
    </ImageLoad>
</RuleGroup>
<RuleGroup name="" groupRelation="or">
    <ImageLoad onmatch="exclude">
	  <!-- <SignatureStatus>Valid</SignatureStatus> --> <!-- good for a better visibility on unsigned modules loading -->
	  <Image>C:\Program Files\Microsoft Policy Platform\policyHost.exe</Image>
	  <ImageLoaded>C:\Windows\System32\cryptbase.dll</ImageLoaded>
	  <ImageLoaded>C:\Windows\System32\amsi.dll</ImageLoaded>
	  <ImageLoaded>C:\Windows\System32\msi.dll</ImageLoaded>
	  <ImageLoaded>C:\Windows\System32\userenv.dll</ImageLoaded>
	  <ImageLoaded>C:\Windows\System32\winmm.dll</ImageLoaded>
	  <ImageLoaded condition="end with">.exe</ImageLoaded>
	  <Image>C:\Windows\System32\dllhost.exe</Image>
	  <Image condition="end with">powershell.exe</Image>
	  <Image>C:\Windows\System32\DeviceCensus.exe</Image>
	  <Image>C:\Windows\System32\systeminfo.exe</Image>
	  <Image>C:\Windows\System32\LockAppHost.exe</Image>
	  <Image>C:\Program Files\Google\Update\GoogleUpdate.exe</Image>
	  <Hashes condition="end with">AA02A4789AEBC104EA53E559F824A5B4</Hashes> <!-- IMPHASH of OneDriveStandaloneUpdater.exe -->
	  <Image condition="end with">powershell_ise.exe</Image>
	  <Hashes condition="end with">727B32239F3556C6C9E82ADE6087C4AC</Hashes><!-- Microsoft OneDrive Shell Extension -->
	  <!--<Image condition="begin with">C:\Program Files\Microsoft Office\root\</Image>-->
	  <Image>C:\Windows\System32\wbem\WmiPrvSE.exe</Image>
	  <Image>C:\Windows\System32\SrTasks.exe</Image>
	  <Image condition="end with">DismHost.exe</Image>
	  <Image condition="begin with">C:\Windows\Microsoft.NET\Framework\</Image>
	  <Image>C:\Windows\System32\wbem\WmiApSrv.exe</Image>
	  <Image>C:\Windows\SysWOW64\wbem\WmiPrvSE.exe</Image>
	  <Image>C:\Program Files\Microsoft Policy Platform\policyHost.exe</Image>
	  <Image>C:\Windows\System32\SearchProtocolHost.exe</Image>
	  <Image>C:\Windows\System32\SearchFilterHost.exe</Image>
	  <Image>C:\Windows\System32\backgroundTaskHost.exe</Image>
	  <Image>C:\Windows\servicing\TrustedInstaller.exe</Image>
	  <Image condition="begin with">C:\Windows\System32\taskhost</Image>
	  <Image>C:\Windows\System32\LogonUI.exe</Image>
	  <Image>C:\Windows\System32\wifitask.exe</Image>
	  <Image>C:\Program Files\Microsoft Data Protection Manager\DPM\bin\DPMRA.exe</Image>
	  <Image>C:\Windows\System32\VSSVC.exe</Image>
	  <Image>C:\Windows\System32\netsh.exe</Image>
	  <Image>C:\Users\sbousseaden\AppData\Local\Microsoft\Teams\current\Teams.exe</Image>
	  <Image>C:\Program Files (x86)\Google\Chrome\Application\chrome.exe</Image>
	  <Image>C:\Windows\System32\raserver.exe</Image>
	  <Image>C:\Windows\System32\RuntimeBroker.exe</Image>
	  <Image condition="begin with">C:\Windows\SystemApps\</Image>
	  <Image>C:\Windows\System32\SearchIndexer.exe</Image>
	  <Image>C:\Windows\explorer.exe</Image>
	  <Image>C:\Windows\System32\sppsvc.exe</Image><!-- noisy for taskschd.dll-->
	  <Image>C:\Program Files\Internet Explorer\iexplore.exe</Image>
	  <Image condition="begin with">C:\Windows\CCM\</Image>
	  <Image>C:\Program Files\Manufacturer\Endpoint Agent\edpa.exe</Image>
	  <!--<Image condition="begin with">C:\Program Files\Microsoft Office\</Image>-->
	  <Image>C:\Program Files\Microsoft Data Protection Manager\DPM\bin\DPMClientService.exe</Image>
	  <Image condition="begin with">C:\Program Files (x86)\Microsoft Visual Studio\</Image>
	  <Image>C:\Windows\System32\provtool.exe</Image>
	  <Image>C:\Program Files\CONEXANT\SA3\HP-NB-AIO\SmartAudio3.exe</Image>
	  <Image>C:\Windows\System32\mmc.exe</Image>
	  <Image>C:\Program Files\Synaptics\SynTP\SynTPEnh.exe</Image>
	  <Image>C:\Windows\System32\wlanext.exe</Image>
	  <Image condition="begin with">C:\Program Files\Microsoft SQL Server\</Image>
	  <Image>C:\Windows\System32\ibtsiva.exe</Image>
	  <Image>C:\Windows\System32\lsass.exe</Image>
	  <Image>C:\Windows\System32\dwm.exe</Image>
	  <Image>C:\Windows\System32\MicTray64.exe</Image>
	  <Image>C:\Program Files\Intel\WiFi\bin\EvtEng.exe</Image>
	  <Image>C:\Program Files\Intel\WiFi\bin\iWrap.exe</Image>
	  <Image>C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe</Image>
	  <Image condition="begin with">C:\Program Files\WindowsApps\</Image>
	  <Image>C:\Windows\System32\SystemSettingsBroker.exe</Image>
	  <Image>C:\Windows\System32\smartscreen.exe</Image>
	  <Image>C:\Windows\System32\services.exe</Image>
	  <Image>C:\Windows\System32\CompatTelRunner.exe</Image>
	  <Image condition="begin with">C:\Program Files\Microsoft Forefront Identity Manager\</Image>
	  <Image>C:\Windows\System32\sihost.exe</Image>
	  <Image>C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe</Image>
	  <Image>C:\Windows\System32\SettingSyncHost.exe</Image>
	  <Image>c:\windows\system32\schtasks.exe</Image>
	  <Image>c:\windows\syswow64\schtasks.exe</Image>
	  <Image>c:\windows\system32\svchost.exe</Image>
	  <Image>c:\windows\syswow64\svchost.exe</Image>
	  <Image>C:\Program Files (x86)\Kontiki\KHost.exe</Image>
	  <Image>C:\Windows\System32\tasklist.exe</Image>
	  <Image>C:\Program Files (x86)\Google\Update\GoogleUpdate.exe</Image>
	  <Image condition="end with">procexp64.exe</Image>
	  <Image condition="end with">procmon.exe</Image>
	  <Image condition="end with">procexp.exe</Image>
	  <Image condition="end with">AppData\Local\Microsoft\OneDrive\OneDrive.exe</Image>
	  <ImageLoaded condition="begin with">C:\ProgramData\Microsoft\Windows Defender\Platform\</ImageLoaded>
	  <Image condition="end with">AppData\Local\Microsoft\Teams\Update.exe</Image>
	  <Image>C:\Windows\System32\ClipRenew.exe</Image>
	  <ImageLoaded>C:\Windows\SysWOW64\msi.dll</ImageLoaded>
	  <ImageLoaded>C:\Windows\SysWOW64\cryptbase.dll</ImageLoaded>
	  <ImageLoaded>C:\Windows\System32\aclui.dll</ImageLoaded>
	  <ImageLoaded>C:\Windows\System32\syswow64.dll</ImageLoaded>
	  <ImageLoaded>C:\Windows\SysWOW64\userenv.dll</ImageLoaded>
	  <ImageLoaded>C:\Windows\SysWOW64\winmm.dll</ImageLoaded>
	  <ImageLoaded>C:\Windows\System32\winmm.dll</ImageLoaded>
	  <ImageLoaded>C:\Windows\System32\duser.dll</ImageLoaded>
	  <ImageLoaded>C:\Windows\Syswow64\duser.dll</ImageLoaded>
	  <ImageLoaded>C:\Program Files\Windows Defender\MpClient.dll</ImageLoaded>
	  <Signature>Opera Software AS</Signature>
	</ImageLoad>
</RuleGroup>
<RuleGroup name="" groupRelation="or">
    <CreateRemoteThread onmatch="include">
      <TargetImage name="technique_id=T1055,technique_name=Process Injection">C:\Windows\System32\sysmon.exe</TargetImage>
      <TargetImage name="technique_id=T1055,technique_name=Process Injection">C:\Windows\System32\rundll32.exe</TargetImage>
      <TargetImage name="technique_id=T1055,technique_name=Process Injection">C:\Windows\System32\svchost.exe</TargetImage>
      <StartFunction condition="contains" name="technique_id=T1055,technique_name=Process Injection">LoadLibrary</StartFunction>
    </CreateRemoteThread>
</RuleGroup>    
<RuleGroup name="" groupRelation="or">
    <CreateRemoteThread onmatch="exclude">
	  <SourceImage condition="begin with">C:\Program Files\HP Inc\</SourceImage>
	  <SourceImage condition="begin with">C:\Program Files (x86)\Trend Micro\</SourceImage>
      <SourceImage >C:\Windows\System32\wbem\WmiPrvSE.exe</SourceImage>
	  <SourceImage>C:\Windows\SysWOW64\wbem\WmiPrvSE.exe</SourceImage> 
      <SourceImage>C:\Windows\System32\svchost.exe</SourceImage>
      <SourceImage>C:\Windows\System32\services.exe</SourceImage>
      <SourceImage>C:\Windows\System32\audiodg.exe</SourceImage>
      <SourceImage>C:\Windows\System32\csrss.exe</SourceImage>
	  <SourceImage>C:\WINDOWS\Explorer.EXE</SourceImage>
	  <SourceImage>C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe</SourceImage>
      <SourceImage>C:\Windows\System32\winlogon.exe</SourceImage>
      <SourceImage>C:\Windows\System32\wininit.exe</SourceImage>
      <TargetImage condition="end with">Google\Chrome\Application\chrome.exe</TargetImage>
      <StartModule>C:\windows\system32\kernel32.dll</StartModule>
	  <SourceImage>C:\Program Files (x86)\Webroot\WRSA.exe</SourceImage>
	  <StartFunction>EtwpNotificationThread</StartFunction><!-- observed as FP from -->
	  <StartFunction>RtlpQueryProcessDebugInformationRemote</StartFunction>
    </CreateRemoteThread>
</RuleGroup>    
<RuleGroup name="" groupRelation="or">    
    <RawAccessRead onmatch="include" />
</RuleGroup>    
<RuleGroup name="" groupRelation="or">    
    <ProcessAccess onmatch="include">
      <TargetImage name="technique_id=T1003,technique_name=Credential Dumping">C:\Windows\system32\lsass.exe</TargetImage>
	<GrantedAccess name="Defense Evasion - Possible Process Suspended" condition="is">0x800</GrantedAccess><!-- minimum required OpenProcess access rights to suspend a target process -->
	<SourceImage condition="end with">jjs.exe</SourceImage>
	<TargetImage condition="end with">:\Windows\System32\winlogon.exe</TargetImage>
	<SourceImage condition="contains">powershell.exe</SourceImage>
	<TargetImage condition="end with">:\Windows\Syswow64\</TargetImage>
	<TargetImage condition="contains">verclsid.exe</TargetImage>
	<CallTrace condition="contains">VBE7.dll</CallTrace>
	<CallTrace condition="contains">CorperfmontExt.dll</CallTrace>
	<CallTrace condition="contains">UNKNOWN</CallTrace>
	<CallTrace condition="contains">System.Management.Automation.ni.dll</CallTrace><!-- not good if u see source image is not powershell.exe -->
	<SourceImage condition="begin with">c:\users\</SourceImage><!-- if too noisy, replace it with AppData and contains as condition -->
	<SourceImage condition="begin with">c:\programdata\</SourceImage>
	<SourceImage condition="begin with" >C:\Windows\Media\</SourceImage>
    <SourceImage condition="begin with" >C:\Windows\addins\</SourceImage>
	<SourceImage condition="begin with" >C:\Windows\system32\config\systemprofile\</SourceImage>
	<SourceImage condition="begin with" >C:\Windows\Debug\</SourceImage> 
	<SourceImage condition="begin with" >C:\Windows\Temp</SourceImage>
    <SourceImage condition="begin with" >C:\PerfLogs\</SourceImage>
	<SourceImage condition="begin with" >C:\Windows\Help\</SourceImage>
	<SourceImage condition="begin with" >C:\Intel\Logs\</SourceImage>
	<SourceImage condition="begin with">C:\Temp</SourceImage>
    <SourceImage condition="begin with" >C:\Windows\repair\</SourceImage>
	<SourceImage condition="begin with" >C:\ProgramData</SourceImage>
    <SourceImage condition="begin with" >C:\Windows\security\</SourceImage>
    <SourceImage condition="begin with" >C:\Windows\Fonts\</SourceImage>
	<SourceImage condition="begin with" >C:\$Recycle.bin\</SourceImage>
	<SourceImage condition="contains">\Windows\IME\</SourceImage>
	<SourceImage condition="contains">AppData\Local\Programs\Opera</SourceImage>      
    </ProcessAccess>
</RuleGroup>
<RuleGroup name="" groupRelation="or">    
    <ProcessAccess onmatch="exclude">
      <SourceImage>C:\Program Files\RES Software\Workspace Manager\cpushld.exe</SourceImage>
      <SourceImage>C:\Program Files (x86)\RES Software\Workspace Manager\cpushld.exe</SourceImage>
      <SourceImage condition="is">C:\Program Files (x86)\Razer Chroma SDK\bin\RzSDKService.exe</SourceImage>
      <SourceImage condition="is">C:\Program Files (x86)\Mobatek\MobaXterm\MobaXterm.exe</SourceImage>
      <SourceImage condition="is">C:\Program Files\WinZip\FAHWindow64.exe</SourceImage>
      <SourceImage condition="is">C:\IBM\ITM\TMAITM~1\kntcma.exe</SourceImage>
      <SourceImage>c:\Program Files\Couchbase\Server\bin\sigar_port.exe</SourceImage>
      <SourceImage condition="is">C:\WINDOWS\CCM\CcmExec.exe</SourceImage>
      <SourceImage>C:\Program Files (x86)\Common Files\ArcGIS\bin\ArcGISConnection.exe</SourceImage>
      <SourceImage>C:\Program Files (x86)\ArcGIS\Desktop10.5\bin\ArcMap.exe</SourceImage>
      <SourceImage>C:\Program Files\Windows Defender\MsMpEng.exe</SourceImage>
      <SourceImage>C:\Program Files\McAfee\Agent\x86\macompatsvc.exe</SourceImage>
      <SourceImage>C:\Program Files (x86)\VMware\VMWare Player\vmware-authd.exe</SourceImage>
      <SourceImage condition="end with">Microsoft.Identity.AadConnect.Health.AadSync.Host.exe</SourceImage>
      <SourceImage>C:\Windows\System32\lsm.exe</SourceImage>
      <SourceImage condition="end with">taskmgr.exe</SourceImage>
      <SourceImage condition="end with">vmtoolsd.exe</SourceImage>
      <SourceImage>C:\Windows\CarbonBlack\cb.exe</SourceImage>
      <SourceImage>C:\Program Files (x86)\Ivanti\Workspace Control\cpushld.exe</SourceImage>
      <SourceImage condition="end with">VBoxService.exe</SourceImage>
      <SourceImage condition="end with">LTSVC.exe</SourceImage>
      <SourceImage condition="end with">GoogleUpdate.exe</SourceImage>
      <SourceImage condition="end with">wmiprvse.exe</SourceImage>
      <SourceImage>C:\Program Files\McAfee\Endpoint Security\Endpoint Security Platform\mfeesp.exe</SourceImage>
      <SourceImage condition="begin with">C:\Program Files (x86)\Symantec\Symantec Endpoint Protection</SourceImage>
      <SourceImage>C:\Program Files\Ivanti\Workspace Control\cpushld.exe</SourceImage>
      <SourceImage condition="end with">\Citrix\System32\wfshell.exe</SourceImage>
      <SourceImage>C:\Program Files\Microsoft Security Client\MsMpEng.exe</SourceImage>
	  <SourceImage>C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe</SourceImage>
	  <SourceImage condition="begin with">C:\Windows\syswow64\</SourceImage>
	  <SourceImage condition="end with">\EMET_Service.exe</SourceImage>
	  <SourceImage condition="end with">\EMET_GUI.exe</SourceImage>
      <SourceImage condition="end with">\procexp64.exe</SourceImage>
	  <SourceImage condition="end with">\procmon64.exe</SourceImage>
	  <SourceImage condition="end with">\software_reporter_tool.exe</SourceImage>
	  <SourceImage condition="end with">NGenTask.exe</SourceImage>
	  <SourceImage condition="end with">Autoruns.exe</SourceImage>
	  <SourceImage condition="end with">Autorunsc.exe</SourceImage>
	  <SourceImage condition="contains">processhacker</SourceImage>
	  <SourceImage condition="end with">\Bin\FMS.exe</SourceImage> <!-- Exchange Process -->
	  <SourceImage condition="end with">:\Windows\System32\smss.exe</SourceImage>
	  <SourceImage condition="end with">\Google\Update\GoogleUpdate.exe</SourceImage>
	  <SourceImage condition="is">C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe</SourceImage>
	  <SourceImage condition="is">C:\Program Files (x86)\Webroot\WRSA.exe</SourceImage>
	  <SourceImage condition="is">C:\Program Files\Webroot\WRSA.exe</SourceImage>
	  <SourceImage condition="is">C:\Program Files\Windows Defender\MsMpEng.exe</SourceImage>
	  <TargetImage condition="is">C:\Windows\Sysmon.exe</TargetImage>
	  <TargetImage condition="is">C:\Windows\Sysmon64.exe</TargetImage>
	  <TargetImage condition="end with">csc.exe</TargetImage>
	  <!-- These binaries get or access processes running .NET -->
	  <SourceImage condition="end with">:\Windows\system32\sppsvc.exe</SourceImage>
	  <SourceImage condition="end with">:\Windows\system32\sdiagnhost.exe</SourceImage>
	  <!-- In testing a common false-positive is memory space that DLLS would be expected to mapped to. -->
	  <SourceImage condition="end with">Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe</SourceImage>
	  <SourceImage condition="end with">Common Files\Adobe\AdobeGCClient\AGSService.exe</SourceImage>
	  <SourceImage condition="begin with">C:\ProgramData\WebEx\webex\</SourceImage>
	  <SourceImage condition="end with">Dropbox\Update\DropboxUpdate.exe</SourceImage>
	  <SourceImage condition="end with">LTSvc\LTSVC.exe</SourceImage>
	  <SourceImage condition="end with">\Trusteer\Rapport\bin\RapportMgmtService.exe</SourceImage>
	  <SourceImage condition="end with">Adobe\AdobeGCClient\AGMService.exe</SourceImage>
	  <SourceImage condition="end with">NT-ware Shared\MomAdmSvc\MomAdmSvc.exe</SourceImage>
	  <SourceImage condition="end with">\Autodesk\Autodesk Desktop App\AdAppMgrSvc.exe</SourceImage>
	  <SourceImage>c:\windows\system32\wbem\wmiprvse.exe</SourceImage>
	  <SourceImage condition="is">C:\Windows\sysWOW64\wbem\wmiprvse.exe</SourceImage>
	  <SourceImage condition="end with">vmtoolsd.exe</SourceImage>
	  <SourceImage condition="end with">VBoxService.exe</SourceImage>
      <SourceImage condition="end with">LTSVC.exe</SourceImage>
      <SourceImage condition="end with">taskmgr.exe</SourceImage>
	  <SourceImage condition="end with">procexp64.exe</SourceImage>
	  <SourceImage condition="end with">procmon.exe</SourceImage>
	  <SourceImage condition="end with">procexp.exe</SourceImage> 
	  <SourceImage>C:\Windows\system32\csrss.exe</SourceImage> 
	  <SourceImage>C:\Windows\system32\wininit.exe</SourceImage> 
	  <SourceImage>C:\Windows\System32\lsm.exe</SourceImage>
	  <SourceImage>C:\Windows\system32\MRT.exe</SourceImage> 
	  <SourceImage condition="end with">\Citrix\System32\wfshell.exe</SourceImage> 
	  <SourceImage>C:\Program Files (x86)\Kontiki\KService.exe</SourceImage>
	  <SourceImage>C:\Windows\system32\dgagent\DSAGENT.exe</SourceImage>
	  <SourceImage>C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClient.exe</SourceImage>
	  <SourceImage condition="begin with">C:\ProgramData\Microsoft\Windows Defender\platform\</SourceImage>
	  <SourceImage>C:\Program Files\Trend Micro\Deep Security Agent\dsa.exe</SourceImage> 
	  <SourceImage condition="end with">AppData\Local\Microsoft\Teams\current\Teams.exe</SourceImage>
	  <SourceImage condition="end with">Microsoft.Identity.AadConnect.Health.AadSync.Host.exe</SourceImage>
	  <SourceImage>C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe</SourceImage>
	  <SourceImage condition="end with">Commvault\ContentStore\Base\cvd.exe</SourceImage>
	  <SourceImage condition="is">C:\Program Files (x86)\Webroot\WRSA.exe</SourceImage>
	  <SourceImage condition="is">C:\Program Files\Webroot\WRSA.exe</SourceImage>
	  <SourceImage condition="is">C:\Program Files\Windows Defender\MsMpEng.exe</SourceImage>
	  <TargetImage condition="is">C:\Program Files\Windows Defender\MsMpEng.exe</TargetImage>
	  <SourceImage>C:\WINDOWS\system32\NETSTAT.EXE</SourceImage>
	  <SourceImage>C:\WINDOWS\CCM\CcmExec.exe</SourceImage>
	  <SourceImage condition="begin with">C:\Program Files\HP Inc\</SourceImage>
	  <SourceImage condition="begin with">C:\Program Files (x86)\Trend Micro\</SourceImage>
	  <SourceImage condition="begin with">C:\Program Files (x86)\Symantec\Symantec Endpoint Protection</SourceImage> 
	  <SourceImage>C:\Windows\System32\msiexec.exe</SourceImage> <!-- temp -->
	  <SourceImage>C:\Program Files\Internet Explorer\iexplore.exe</SourceImage> <!-- temp -->
      <CallTrace condition="contains">windows defender</CallTrace> <!-- windefender -->
	  <CallTrace condition="contains">mpengine.dll</CallTrace> <!-- Windefender -->
	  <CallTrace condition="contains">UNKNOWN(00007F</CallTrace>
	  <CallTrace condition="contains">appresolver.dll</CallTrace>
	  <CallTrace condition="contains">sysmain.dll</CallTrace>
	  <GrantedAccess condition="is">0x40</GrantedAccess><!-- noisy -->
	  <GrantedAccess condition="end with">0x1000</GrantedAccess><!-- generic access rights -->
	  <GrantedAccess condition="end with">0x1400</GrantedAccess><!-- generic access rights -->
	  <GrantedAccess condition="is">0x3200</GrantedAccess><!-- generic access rights -->
	  <GrantedAccess condition="end with">0x101000</GrantedAccess><!-- generic access rights -->
	  <GrantedAccess condition="end with">0x101001</GrantedAccess> <!-- generic access rights -->
	  <GrantedAccess condition="end with">0x100000</GrantedAccess><!-- generic access rights -->
	  <GrantedAccess condition="end with">0x101400</GrantedAccess><!-- generic access rights -->
	  <GrantedAccess condition="end with">0x100040</GrantedAccess><!-- generic access rights -->
	  <GrantedAccess condition="end with">0x1000000</GrantedAccess><!-- generic access rights -->        
    </ProcessAccess>
</RuleGroup>
<RuleGroup name="" groupRelation="or">    
    <FileCreate onmatch="include">
      <Image condition="image">rundll32.exe</Image>
      <Image condition="begin with" name="technique_id=T1047,technique_name=Windows Management Instrumentation">C:\WINDOWS\system32\wbem\scrcons.exe</Image>
      <TargetFilename condition="contains" name="technique_id=T1047,technique_name=File System Permissions Weakness">\AppData\Temp\</TargetFilename>
      <TargetFilename condition="end with">.vb</TargetFilename>
      <TargetFilename condition="end with">.dotm</TargetFilename>
      <TargetFilename condition="end with">.asp</TargetFilename>
      <TargetFilename condition="end with">.aspx</TargetFilename>
      <TargetFilename condition="end with">.potm</TargetFilename>
      <TargetFilename condition="end with">.vbe</TargetFilename>
      <TargetFilename condition="end with" name="technique_id=T1086,technique_name=PowerShell">.ps2</TargetFilename>
      <TargetFilename condition="end with" name="technique_id=T1086,technique_name=PowerShell">.ps1</TargetFilename>
      <TargetFilename condition="begin with">C:\Windows\Tasks\</TargetFilename>
      <TargetFilename condition="end with">.iqy</TargetFilename>
      <TargetFilename condition="end with">.war</TargetFilename>
      <TargetFilename condition="end with">.pyc</TargetFilename>
      <TargetFilename condition="end with">.application</TargetFilename>
      <TargetFilename condition="end with">.xla</TargetFilename>
      <TargetFilename condition="begin with">C:\Users\Default</TargetFilename>
      <TargetFilename condition="end with">.docm</TargetFilename>
      <TargetFilename condition="end with">.jsp</TargetFilename>
      <TargetFilename condition="end with" name="technique_id=T1127,technique_name=Trusted Developer Utilities">.*proj</TargetFilename>
      <TargetFilename condition="end with">.slk</TargetFilename>
      <TargetFilename condition="end with">.pptm</TargetFilename>
      <TargetFilename condition="end with">.xlm</TargetFilename>
      <TargetFilename condition="begin with">C:\Windows\System32\Tasks</TargetFilename>
      <TargetFilename condition="end with">.vbs</TargetFilename>
      <TargetFilename condition="contains">\Content.Outlook\</TargetFilename>
      <TargetFilename condition="end with">.pyw</TargetFilename>
      <TargetFilename condition="contains">\Downloads\</TargetFilename>
      <TargetFilename condition="begin with">C:\Windows\System32\GroupPolicy\User\Scripts</TargetFilename>
      <TargetFilename condition="end with" name="technique_id=T1170,technique_name=Mshta">.hta</TargetFilename>
      <TargetFilename condition="end with">.sldm</TargetFilename>
      <TargetFilename condition="end with" name="technique_id=T1187,technique_name=Forced Authentication">.lnk</TargetFilename>
      <TargetFilename condition="end with">.php</TargetFilename>
      <TargetFilename condition="begin with" name="technique_id=T1047,technique_name=Windows Management Instrumentation">C:\Windows\System32\Wbem</TargetFilename>
      <TargetFilename condition="end with">.ppsm</TargetFilename>
      <TargetFilename condition="end with">.xlam</TargetFilename>
      <TargetFilename condition="end with" name="technique_id=T1187,technique_name=Forced Authentication">.scf</TargetFilename>
      <TargetFilename condition="begin with">C:\Windows\System32\GroupPolicy\Machine\Scripts</TargetFilename>
      <TargetFilename condition="end with">.cmd</TargetFilename>
      <TargetFilename condition="end with">.bat</TargetFilename>
      <TargetFilename condition="end with" name="technique_id=T1127,technique_name=Trusted Developer Utilities">.sln</TargetFilename>
      <TargetFilename condition="contains">\Startup</TargetFilename>
      <TargetFilename condition="begin with" name="technique_id=T1047,technique_name=File System Permissions Weakness">C:\PerfLogs\</TargetFilename>
      <TargetFilename condition="end with">.ace</TargetFilename>
      <TargetFilename condition="end with" name="technique_id=T1064,technique_name=Scripting">.chm</TargetFilename>
      <TargetFilename condition="end with">.rft</TargetFilename>
      <TargetFilename condition="begin with" name="technique_id=T1086,technique_name=PowerShell">C:\Windows\System32\WindowsPowerShell</TargetFilename>
      <TargetFilename condition="end with">.xlsm</TargetFilename>
      <TargetFilename condition="end with">.settingcontent-ms</TargetFilename>
      <TargetFilename condition="end with">.py</TargetFilename>
      <TargetFilename condition="contains">\Start Menu</TargetFilename>
      <TargetFilename condition="end with">.xltm</TargetFilename>
      <TargetFilename condition="begin with" name="technique_id=T1086,technique_name=PowerShell">C:\Windows\SysWOW64\WindowsPowerShell</TargetFilename>
      <TargetFilename condition="begin with" name="technique_id=T1047,technique_name=File System Permissions Weakness">C:\Users\Public\</TargetFilename>
      <TargetFilename condition="end with">.jspx</TargetFilename>
      <TargetFilename condition="begin with" name="technique_id=T1047,technique_name=Windows Management Instrumentation">C:\Windows\SysWOW64\Wbem</TargetFilename>
      <TargetFilename condition="contains" name="technique_id=T1138,technique_name=Application Shimming">C:\Windows\AppPatch\Custom</TargetFilename>
      <TargetFilename condition="begin with">C:\Windows\System32\Drivers</TargetFilename>
      <TargetFilename condition="begin with">C:\Windows\SysWOW64\Drivers</TargetFilename>
      <TargetFilename condition="begin with" name="technique_id=T1044,technique_name=File System Permissions Weakness">C:\Windows\Temp\</TargetFilename>
      <TargetFilename condition="end with">.sys</TargetFilename>
      <TargetFilename condition="end with">.appref-ms</TargetFilename>
      <TargetFilename condition="begin with" name="technique_id=T1047,technique_name=File System Permissions Weakness">C:\Temp\</TargetFilename>
      <TargetFilename condition="end with">.exe</TargetFilename>
    </FileCreate>
</RuleGroup>
<RuleGroup name="" groupRelation="or">    
    <FileCreate onmatch="exclude">
    		<Image condition="is">C:\Program Files (x86)\Ivanti\Workspace Control\pfwsmgr.exe</Image>
            <Image condition="is">C:\Program Files (x86)\RES Software\Workspace Manager\pfwsmgr.exe</Image>
			<Image condition="is">c:\Program Files\Microsoft Security Client\MsMpEng.exe</Image>      
			<Image condition="is">C:\WINDOWS\CCM\CcmExec.exe</Image>
            <Image condition="is">C:\WINDOWS\system32\svchost.exe</Image>
            <TargetFilename condition="begin with">C:\Windows\CCM</TargetFilename>            
      <Image>C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe</Image>
      <Image condition="begin with">C:\WINDOWS\winsxs\amd64_microsoft-windows</Image>
      <Image>C:\Program Files (x86)\Dell\CommandUpdate\InvColPC.exe</Image>
      <Image>C:\Windows\system32\igfxCUIService.exe</Image>
      <Image>C:\Windows\system32\CompatTelRunner.exe</Image>
      <Image>C:\Windows\System32\smss.exe</Image>
      <Image>C:\Windows\system32\wbem\WMIADAP.EXE</Image>
      <TargetFilename condition="begin with">C:\Windows\System32\wbem\Performance\</TargetFilename>
      <TargetFilename condition="begin with">C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask</TargetFilename>
      <TargetFilename condition="begin with">C:\Windows\System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\Server\ServerRoleUsageCollector</TargetFilename>
      <TargetFilename condition="end with">WRITABLE.TST</TargetFilename>
      <TargetFilename condition="begin with">C:\Windows\System32\DriverStore\Temp\</TargetFilename>
      <TargetFilename condition="begin with">C:\$WINDOWS.~BT\Sources\SafeOS\SafeOS.Mount\</TargetFilename>
      <TargetFilename condition="begin with">C:\Windows\System32\Tasks\Microsoft\Windows\PLA\FabricTraces</TargetFilename>
      <TargetFilename condition="contains">\AppData\Roaming\Microsoft\Windows\Recent\</TargetFilename>
      <TargetFilename condition="begin with">C:\Windows\System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\Server\ServerCeipAssistant</TargetFilename>
    </FileCreate>
</RuleGroup>
<RuleGroup name="" groupRelation="or">    
    <RegistryEvent onmatch="include">
      <Image>C:\Program Files\Microsoft Application Virtualization\Client\AppVClient.exe</Image>
      <TargetObject condition="contains" name="technique_id=T1089,technique_name=Disabling Security Tools">SYSTEM\CurrentControlSet\services\SysmonDrv</TargetObject>
      <TargetObject condition="end with" name="technique_id=T1035,technique_name=Service Execution">\PsService\EulaAccepted</TargetObject>
      <TargetObject>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default)</TargetObject>
      <TargetObject condition="begin with" name="technique_id=T1089,technique_name=Disabling Security Tools">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiVirus</TargetObject>
      <TargetObject condition="contains">\Software\Microsoft\VSTO\SolutionMetadata</TargetObject>
      <TargetObject condition="begin with" name="technique_id=T1198,technique_name=SIP and Trust Provider Hijacking">HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust</TargetObject>
      <TargetObject condition="end with">\ProxyServer</TargetObject>
      <TargetObject condition="end with">\ServiceDll</TargetObject>
      <TargetObject condition="contains" name="technique_id=T1060,technique_name=Registry Run Keys / Start Folder">\CurrentVersion\Run</TargetObject>
      <TargetObject condition="contains" name="technique_id=T1138,technique_name=Application Shimming">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB</TargetObject>
      <TargetObject condition="contains">\shell\open\ddeexec</TargetObject>
      <TargetObject condition="begin with" name="technique_id=T1089,technique_name=Disabling Security Tools">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable</TargetObject>
      <TargetObject condition="end with">\Start</TargetObject>
      <TargetObject condition="contains" name="technique_id=T1209,technique_name=Time Providers">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\W32Time\TimeProviders</TargetObject>
      <TargetObject condition="begin with" name="technique_id=T1013,technique_name=Forced Authentication">HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors</TargetObject>
      <TargetObject condition="contains">\ContextMenuHandlers</TargetObject>
      <TargetObject condition="end with" name="undefined">\PsSuspend\EulaAccepted</TargetObject>
      <TargetObject condition="contains" name="technique_id=T1128,technique_name=Netsh Helper DLL">SOFTWARE\Microsoft\Netsh</TargetObject>
      <TargetObject condition="begin with" name="technique_id=T1089,technique_name=Disabling Security Tools">HKLM\SOFTWARE\Microsoft\Security Center\DisableMonitoring</TargetObject>
      <TargetObject condition="begin with" name="technique_id=T1089,technique_name=Disabling Security Tools">HKLM\SOFTWARE\Microsoft\Security Center\AllAlertsDisabled</TargetObject>
      <TargetObject condition="contains" name="technique_id=T1088,technique_name=Bypass User Account Control">ms-settings\shell\open\command</TargetObject>
      <TargetObject condition="contains" name="technique_id=T1088,technique_name=Bypass User Account Control">Classes\exefile\shell\runas\command\isolatedCommand</TargetObject>
      <TargetObject condition="begin with" name="technique_id=T1088,technique_name=Bypass User Account Control">HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA</TargetObject>
      <TargetObject condition="begin with" name="technique_id=T1089,technique_name=Disabling Security Tools">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection</TargetObject>
      <TargetObject condition="contains" name="technique_id=T1130,technique_name=Install Root Certificate">\Microsoft\SystemCertificates\Root\Certificates</TargetObject>
      <TargetObject condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellServiceObjectDelayLoad</TargetObject>
      <TargetObject condition="contains">\Software\Microsoft\VSTO\Security\Inclusion</TargetObject>
      <TargetObject condition="begin with" name="technique_id=T1089,technique_name=Disabling Security Tools">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware</TargetObject>
      <TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Safeboot</TargetObject>
      <TargetObject condition="contains">\Internet Explorer\Toolbar</TargetObject>
      <TargetObject condition="begin with">HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32</TargetObject>
      <TargetObject condition="begin with" name="technique_id=T1089,technique_name=Disabling Security Tools">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\SpyNetReporting</TargetObject>
      <TargetObject condition="contains" name="technique_id=T1003,technique_name=Credential Dumping">\Control\SecurityProviders\WDigest</TargetObject>
      <TargetObject condition="end with" name="technique_id=T1035,technique_name=Service Execution">\PsLogList\EulaAccepted</TargetObject>
      <TargetObject condition="begin with" name="technique_id=T1004,technique_name=Winlogon Helper DLL">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify</TargetObject>
      <TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options</TargetObject>
      <TargetObject condition="contains" name="technique_id=T1089,technique_name=Disabling Security Tools">SYSTEM\CurrentControlSet\services\Sysmon</TargetObject>
      <TargetObject condition="begin with" name="technique_id=T1103,technique_name=Appinit DLLs">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls</TargetObject>
      <TargetObject condition="contains">\Classes\AllFilesystemObjects</TargetObject>
      <TargetObject condition="end with">\FriendlyName</TargetObject>
      <TargetObject condition="contains">\Browser Helper Objects</TargetObject>
      <TargetObject condition="end with" name="technique_id=T1089,technique_name=Disabling Security Tools">\PsKill\EulaAccepted</TargetObject>
      <TargetObject condition="contains" name="technique_id=T1047,technique_name=Windows Management Instrumentation">SYSTEM\CurrentControlSet\Control\CrashControl</TargetObject>
      <TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider</TargetObject>
      <TargetObject condition="end with">\ImagePath</TargetObject>
      <TargetObject condition="begin with" name="technique_id=T1060,technique_name=Registry Run Keys / Start Folder">HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute</TargetObject>
      <TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles</TargetObject>
      <TargetObject condition="begin with" name="technique_id=T1182,technique_name=AppCert DLLs">HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls</TargetObject>
      <TargetObject condition="end with" name="technique_id=T1033,technique_name=System Owner/User Discovery">\PsLoggedOn\EulaAccepted</TargetObject>
      <TargetObject name="technique_id=T1015,technique_name=Accessibility Features">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options</TargetObject>
      <TargetObject condition="contains" name="technique_id=T1101,technique_name=Security Support Provider">SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe</TargetObject>
      <TargetObject condition="begin with" name="technique_id=T1004,technique_name=Winlogon Helper DLL">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit</TargetObject>
      <TargetObject condition="contains">\shell\install\command</TargetObject>
      <TargetObject>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Setup\ServiceStartup</TargetObject>
      <TargetObject condition="begin with" name="technique_id=T1198,technique_name=SIP and Trust Provider Hijacking">HKLM\SOFTWARE\Microsoft\Cryptography\OID</TargetObject>
      <TargetObject condition="contains">\Classes\Directory</TargetObject>
      <TargetObject condition="contains" name="technique_id=T1088,technique_name=Bypass User Account Control">\mscfile\shell\open\command</TargetObject>
      <TargetObject condition="contains">{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}</TargetObject>
      <TargetObject condition="begin with" name="technique_id=T1088,technique_name=Bypass User Account Control">HKLM\SOFTWARE\Microsoft\Security Center\UacDisableNotify</TargetObject>
      <TargetObject condition="begin with" name="technique_id=T1088,technique_name=Bypass User Account Control">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System</TargetObject>
      <TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths</TargetObject>
      <TargetObject condition="end with" name="technique_id=T1057,technique_name=Process Discovery">\PsList\EulaAccepted</TargetObject>
      <TargetObject condition="contains" name="technique_id=T1060,technique_name=Registry Run Keys / Start Folder">Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup</TargetObject>
      <TargetObject condition="begin with" name="technique_id=T1004,technique_name=Winlogon Helper DLL">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell</TargetObject>
      <TargetObject condition="contains">\Microsoft\Office\Outlook\Addins</TargetObject>
      <TargetObject condition="contains">\Internet Explorer\Extensions</TargetObject>
      <TargetObject condition="contains" name="technique_id=T1037,technique_name=Logon Scripts">\Windows\System\Scripts</TargetObject>
      <TargetObject condition="begin with" name="technique_id=T1088,technique_name=Bypass User Account Control">HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy</TargetObject>
      <TargetObject condition="contains">\Classes\Folder</TargetObject>
      <TargetObject condition="contains">\shell\open\command</TargetObject>
      <TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Winlogon</TargetObject>
      <TargetObject name="technique_id=T1076,technique_name=Remote Desktop Protocol">HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services</TargetObject>
      <TargetObject condition="begin with" name="technique_id=T1089,technique_name=Disabling Security Tools">HKLM\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify</TargetObject>
      <TargetObject condition="end with" name="technique_id=T1105,technique_name=Remote File Copy">\PsFile\EulaAccepted</TargetObject>
      <TargetObject condition="end with" name="technique_id=T1057,technique_name=Process Discovery">\PsInfo\EulaAccepted</TargetObject>
      <TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order</TargetObject>
      <TargetObject condition="end with">\InprocServer32\(Default)</TargetObject>
      <TargetObject condition="contains" name="technique_id=T1098,technique_name=Account Manipulation">\services\Netlogon\Parameters\DisablePasswordChange</TargetObject>
      <TargetObject condition="contains">\Classes\Drive</TargetObject>
      <TargetObject condition="contains" name="technique_id=T1138,technique_name=Application Shimming">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom</TargetObject>
      <TargetObject condition="begin with" name="technique_id=T1089,technique_name=Disabling Security Tools">HKLM\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify</TargetObject>
      <TargetObject condition="end with" name="technique_id=T1033,technique_name=System Owner/User Discovery">\PsGetSID\EulaAccepted</TargetObject>
      <TargetObject condition="begin with" name="technique_id=T1089,technique_name=Disabling Security Tools">HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List</TargetObject>
      <TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions</TargetObject>
      <TargetObject condition="contains">\CurrentVersion\Shell</TargetObject>
      <TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Services\WinSock</TargetObject>
      <TargetObject condition="begin with" name="technique_id=T1198,technique_name=SIP and Trust Provider Hijacking">HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID</TargetObject>
      <TargetObject condition="end with" name="technique_id=T1035,technique_name=Service Execution">\PsExec\EulaAccepted</TargetObject>
      <TargetObject name="technique_id=T1103,technique_name=Appinit DLLs">REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DNS\Parameters\ServerLevelPluginDll</TargetObject>
      <TargetObject condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks</TargetObject>
      <TargetObject condition="begin with" name="technique_id=T1198,technique_name=SIP and Trust Provider Hijacking">HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust</TargetObject>
      <TargetObject condition="contains" name="technique_id=T1042,technique_name=Change Default File Association">\Explorer\FileExts</TargetObject>
      <TargetObject condition="begin with" name="technique_id=T1089,technique_name=Disabling Security Tools">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender</TargetObject>
      <TargetObject condition="begin with" name="technique_id=T1003,technique_name=Credential Dumping">HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders</TargetObject>
      <TargetObject condition="begin with" name="technique_id=T1089,technique_name=Disabling Security Tools">HKLM\SOFTWARE\Microsoft\Security Center\FirewallOverride</TargetObject>
      <TargetObject condition="begin with" name="technique_id=T1089,technique_name=Disabling Security Tools">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring</TargetObject>
      <TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT</TargetObject>
      <TargetObject condition="end with" name="technique_id=T1098,technique_name=Account Manipulation">\PsPasswd\EulaAccepted</TargetObject>
      <TargetObject condition="begin with" name="technique_id=T1183,technique_name=Image File Execution Options Injection">HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options</TargetObject>
      <TargetObject condition="begin with" name="technique_id=T1131,technique_name=Authentication Package">HKLM\SYSTEM\CurrentControlSet\Control\Lsa</TargetObject>
      <TargetObject condition="end with">\UrlUpdateInfo</TargetObject>
      <TargetObject condition="begin with" name="technique_id=T1130,technique_name=Install Root Certificate">HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates</TargetObject>
      <TargetObject condition="begin with" name="technique_id=T1103,technique_name=Appinit DLLs">HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls</TargetObject>
      <TargetObject condition="contains">\Group Policy\Scripts</TargetObject>
      <TargetObject condition="begin with" name="technique_id=T1060,technique_name=Registry Run Keys / Start Folder">HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram</TargetObject>
      <TargetObject condition="begin with" name="technique_id=T1088,technique_name=Bypass User Account Control">HKLM\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify</TargetObject>
      <TargetObject condition="begin with" name="technique_id=T1183,technique_name=Image File Execution Options Injection">HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options</TargetObject>
      <TargetObject condition="end with" name="undefined">\PsShutDown\EulaAccepted</TargetObject>
      <TargetObject condition="contains" name="technique_id=T1122,technique_name=Component Object Model Hijacking">Software\Classes\CLSID</TargetObject>
      <TargetObject condition="contains" name="technique_id=T1060,technique_name=Registry Run Keys / Start Folder">\Policies\Explorer\Run</TargetObject>
      <TargetObject condition="contains" name="technique_id=T1193,technique_name=Spearphishing Attachment">Security\Trusted Documents\TrustRecords</TargetObject>
      <TargetObject condition="contains" name="technique_id=T1193,technique_name=Spearphishing Attachment">Software\Microsoft\VBA\7.1\Common</TargetObject>
    </RegistryEvent>
</RuleGroup>    
<RuleGroup name="" groupRelation="or">
    <RegistryEvent onmatch="exclude">
      <Image condition="image">C:\WINDOWS\system32\backgroundTaskHost.exe</Image>
      <Image>C:\Program Files\McAfee\Agent\x86\macompatsvc.exe</Image>
      <Image>C:\Program Files\Windows Defender\MsMpEng.exe</Image>
      <Image condition="end with">Office\root\integration\integrator.exe</Image>
      <Image>C:\Program Files\McAfee\Agent\masvc.exe</Image>
      <Image>C:\Program Files (x86)\Webroot\WRSA.exe</Image>
      <Image>C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe</Image>
      <Image>C:\Program Files\Common Files\McAfee\AVSolution\mcshield.exe</Image>
      <Image>C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\aciseposture.exe</Image>
      <Image>C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe</Image>
      <Image>C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe</Image>
      <Image condition="begin with">C:\$WINDOWS.~BT\</Image>
      <Image>C:\Program Files\McAfee\Agent\x86\mfemactl.exe</Image>
      <Image>C:\Program Files\McAfee\Endpoint Security\Threat Prevention\mfeensppl.exe</Image>
      <Image>C:\Program Files\McAfee\Endpoint Security\Endpoint Security Platform\mfeesp.exe</Image>
      <Image condition="begin with">C:\Program Files\Common Files\McAfee\Engine\scanners</Image>
      <Image>C:\Program Files\Common Files\McAfee\Engine\AMCoreUpdater\amupdate.exe</Image>
      <Image>C:\Program Files\McAfee\Agent\x86\McScript_InUse.exe</Image>
      <Image>C:\Program Files (x86)\Ivanti\Workspace Control\pfwsmgr.exe</Image>
      <Image>C:\Program Files\RES Software\Workspace Manager\pfwsmgr.exe</Image>
      <Image>C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe</Image>
      <Image>C:\Program Files\McAfee\Endpoint Security\Adaptive Threat Protection\mfeatp.exe</Image>
      <Image>C:\Program Files\McAfee\Endpoint Encryption Agent\MfeEpeHost.exe</Image>
      <TargetObject condition="end with">\services\clr_optimization_v2.0.50727_64\Start</TargetObject>
      <TargetObject condition="end with">ShellBrowser</TargetObject>
      <TargetObject condition="end with">\services\BITS\Start</TargetObject>
      <TargetObject condition="end with">\services\clr_optimization_v4.0.30319_64\Start</TargetObject>
      <TargetObject condition="end with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit</TargetObject>
      <TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\</TargetObject>
      <TargetObject condition="end with">\services\clr_optimization_v4.0.30319_32\Start</TargetObject>
      <TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc\Start</TargetObject>
      <TargetObject condition="end with">\Lsa\OfflineJoin\CurrentValue</TargetObject>
      <TargetObject condition="end with">\CurrentVersion\Shell Extensions\Cached</TargetObject>
      <TargetObject condition="end with">\Components\TrustedInstaller\Events</TargetObject>
      <TargetObject condition="contains">\OpenWithProgids</TargetObject>
      <TargetObject>HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates</TargetObject>
      <TargetObject condition="end with">\Directory\shellex\DragDropHandlers</TargetObject>
      <TargetObject condition="end with">\services\TrustedInstaller\Start</TargetObject>
      <TargetObject condition="end with">\OpenWithList\MRUList</TargetObject>
      <TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Domains</TargetObject>
      <TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\</TargetObject>
      <TargetObject condition="end with">\Directory\shellex</TargetObject>
      <TargetObject condition="end with">\CurrentVersion\App Paths</TargetObject>
      <TargetObject condition="contains">_Classes\AppX</TargetObject>
      <TargetObject condition="end with">\CurrentVersion\Shell Extensions\Approved</TargetObject>
      <TargetObject condition="end with">\services\UsoSvc\Start</TargetObject>
      <TargetObject condition="end with">\UserChoice\Hash</TargetObject>
      <TargetObject condition="end with">\services\tunnel\Start</TargetObject>
      <TargetObject condition="end with">\Components\Wlansvc</TargetObject>
      <TargetObject condition="end with">\CurrentVersion\Image File Execution Options</TargetObject>
      <TargetObject condition="end with">\Components\Wlansvc\Events</TargetObject>
      <TargetObject condition="end with">\Components\TrustedInstaller</TargetObject>
      <TargetObject condition="end with">\CurrentVersion\Run</TargetObject>
      <TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit\AuditPolicy</TargetObject>
      <TargetObject condition="end with">\services\DeviceAssociationService\Start</TargetObject>
      <TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit\PerUserAuditing\System</TargetObject>
      <TargetObject condition="end with">\CurrentVersion\RunOnce</TargetObject>
      <TargetObject condition="end with">Internet Explorer\Toolbar\Locked</TargetObject>
      <TargetObject condition="end with">Toolbar\ShellBrowser\ITBar7Layout</TargetObject>
      <TargetObject condition="end with">\UserChoice</TargetObject>
      <TargetObject condition="end with">Toolbar\WebBrowser\ITBar7Height</TargetObject>
      <TargetObject condition="end with">}\PreviousPolicyAreas</TargetObject>
      <TargetObject condition="end with">\UserChoice\ProgId</TargetObject>
      <TargetObject condition="contains">\Control\WMI\Autologger\</TargetObject>
      <TargetObject condition="end with">\Drive\shellex\DragDropHandlers</TargetObject>
      <TargetObject condition="end with">\Drive\shellex</TargetObject>
      <TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit</TargetObject>
      <TargetObject condition="end with">\services\clr_optimization_v2.0.50727_32\Start</TargetObject>
      <TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache</TargetObject>
      <TargetObject condition="end with">} 0xFFFF</TargetObject>
      <TargetObject condition="end with">Toolbar\WebBrowser</TargetObject>
      <TargetObject condition="end with">\OpenWithList</TargetObject>
    </RegistryEvent>
</RuleGroup>
<RuleGroup name="" groupRelation="or">    
    <FileCreateStreamHash onmatch="include">
      <TargetFilename condition="contains">Content.Outlook</TargetFilename>
      <TargetFilename condition="end with">.lnk</TargetFilename>
      <TargetFilename condition="end with">Temp\debug.bin</TargetFilename>
      <TargetFilename condition="end with" name="technique_id=T1086,technique_name=PowerShell">.ps2</TargetFilename>
      <TargetFilename condition="end with">.vbs</TargetFilename>
      <TargetFilename condition="end with" name="technique_id=T1086,technique_name=PowerShell">.ps1</TargetFilename>
      <TargetFilename condition="end with">.bat</TargetFilename>
      <TargetFilename condition="contains">Downloads</TargetFilename>
      <TargetFilename condition="end with">.hta</TargetFilename>
      <TargetFilename condition="end with">.exe</TargetFilename>
      <TargetFilename condition="contains">Temp\7z</TargetFilename>
      <TargetFilename condition="end with">.vbe</TargetFilename>
      <TargetFilename condition="end with">.cmd</TargetFilename>
      <TargetFilename condition="end with">.reg</TargetFilename>
      <TargetFilename condition="end with">.vb</TargetFilename>
      <TargetFilename condition="end with" name="technique_id=T1127,technique_name=Trusted Developer Utilities">AppData\Local\Microsoft\CLR_v2.0\UsageLogs\</TargetFilename>
      <TargetFilename condition="end with" name="technique_id=T1127,technique_name=Trusted Developer Utilities">AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\</TargetFilename>
    </FileCreateStreamHash>
</RuleGroup>    
<RuleGroup name="" groupRelation="or">    
    <PipeEvent onmatch="exclude">
	  <EventType>ConnectPipe</EventType>
      <PipeName>\SQLLocal\RTCLOCAL</PipeName>
      <PipeName>\Trend Micro OSCE Command Handler Manager</PipeName>
      <PipeName>\spoolss</PipeName>
      <PipeName>\OfcServerNamePipe</PipeName>
      <PipeName>\SQLLocal\SQLEXPRESS</PipeName>
      <PipeName>\ntapvsrq</PipeName>
      <PipeName>\winreg</PipeName>
      <PipeName>\srvsvc</PipeName>
      <PipeName>\SQLLocal\COMMVAULT</PipeName>
      <PipeName>\Trend Micro Endpoint Encryption ToolBox Command Handler Manager</PipeName>
      <PipeName>\lsass</PipeName>
      <PipeName condition="contains">Anonymous Pipe</PipeName>
      <PipeName condition="begin with">\Vivisimo Velocity</PipeName>
      <PipeName>\Trend Micro OSCE Command Handler2 Manager</PipeName>
      <PipeName>\wkssvc</PipeName>
      <PipeName>\SQLLocal\MSSQLSERVER</PipeName>
      <PipeName>\SQLLocal\RTC</PipeName>
      <PipeName>\SQLLocal\INSTANCE01</PipeName>
      <PipeName condition="contains">\pgsignal_</PipeName>
      <PipeName>\SQLLocal\TMSM</PipeName>
      <Image>Program Files (x86)\Citrix\ICA Client\Receiver\Receiver.exe</Image>
      <Image condition="end with">Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\CMAgent\OfcCMAgent.exe</Image>
      <Image>Program Files (x86)\Citrix\ICA Client\SelfServicePlugin\SelfService.exe</Image>
      <Image>Program Files\Qlik\Sense\Engine\Engine.exe</Image>
      <Image condition="end with">Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\web\service\osceintegrationservice.exe</Image>
      <Image condition="end with">Program Files\Trend\SPROTECT\x64\tsc64.exe</Image>
      <Image condition="end with">Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\WSS\iCRCService.exe</Image>
      <Image condition="end with">Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\web\service\OfcLogReceiverSvc.exe</Image>
      <Image condition="end with">Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\WEB_OSCE\WEB\CGI\cgiOnClose.exe</Image>
      <Image>Program Files (x86)\Citrix\ICA Client\wfcrun32.exe</Image>
      <Image>Program Files (x86)\Microsoft SQL Server\110\DTS\binn\dtexec.exe</Image>
      <Image>Program Files (x86)\Citrix\ICA Client\concentr.exe</Image>
      <Image condition="end with">Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\LWCS\LWCSService.exe</Image>
      <Image condition="end with">Program Files\SplunkUniversalForwarder\bin\splunk.exe</Image>
      <Image condition="end with">PostgreSQL\9.6\bin\postgres.exe</Image>
      <Image condition="end with">Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\WEB_OSCE\WEB\CGI\cgiRqHotFix.exe</Image>
      <Image condition="end with">Program Files\SplunkUniversalForwarder\bin\splunkd.exe</Image>
      <Image condition="end with">Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\Web\Service\DbServer.exe</Image>
      <Image condition="end with">Program Files\Trend\SPROTECT\x64\tsc.exe</Image>
      <Image condition="end with">Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe</Image>
      <Image condition="end with">Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\web\service\verconn.exe</Image>
      <Image condition="end with">Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\web\service\ofcservice.exe</Image>
      <Image>c:\windows\system32\inetsrv\w3wp.exe</Image>
      	 <Image condition="begin with">c:\windows\system32\</Image>
	 <Image>C:\WINDOWS\Explorer.EXE</Image>
	 <Image condition="begin with">c:\windows\syswow64\</Image>
	 <Image condition="begin with">c:\program files\</Image>
	 <Image condition="begin with">c:\program files (x86)\</Image>
    </PipeEvent>
</RuleGroup>    
<RuleGroup name="WmiEvent" groupRelation="or">    
    <WmiEvent onmatch="include">
      <Operation name="technique_id=T1047,technique_name=Windows Management Instrumentation">Created</Operation>
    </WmiEvent>
</RuleGroup>    
<RuleGroup name="" groupRelation="or">
	<DnsQuery onmatch="exclude">
			<!--Network noise-->
			<QueryName condition="end with">.arpa.</QueryName> <!--Design decision to not log reverse DNS lookups. You will need to decide.-->
			<QueryName condition="end with">.arpa</QueryName> <!--Design decision to not log reverse DNS lookups. You will need to decide.-->
			<QueryName condition="end with">.msftncsi.com</QueryName> <!--Microsoft proxy detection | Microsoft default exclusion-->
			<QueryName condition="is">..localmachine</QueryName>
			<!--Microsoft-->
			<QueryName condition="end with">-pushp.svc.ms</QueryName> <!--Microsoft: Doesn't appear to host customer content or subdomains-->
			<QueryName condition="end with">.b-msedge.net</QueryName> <!--Microsoft: Doesn't appear to host customer content or subdomains-->
			<QueryName condition="end with">.bing.com</QueryName> <!-- Microsoft | Microsoft default exclusion -->
			<QueryName condition="end with">.hotmail.com</QueryName> <!--Microsoft | Microsoft default exclusion-->
			<QueryName condition="end with">.live.com</QueryName> <!--Microsoft | Microsoft default exclusion-->
			<QueryName condition="end with">.live.net</QueryName> <!--Microsoft | Microsoft default exclusion-->
			<QueryName condition="end with">.s-microsoft.com</QueryName> <!--Microsoft-->
			<QueryName condition="end with">.microsoft.com</QueryName> <!--Microsoft | Microsoft default exclusion-->
			<QueryName condition="end with">.microsoftonline.com</QueryName> <!--Microsoft | Microsoft default exclusion-->
			<QueryName condition="end with">.microsoftstore.com</QueryName> <!--Microsoft | Microsoft default exclusion-->
			<QueryName condition="end with">.ms-acdc.office.com</QueryName> <!--Microsoft: Doesn't appear to host customer content or subdomains-->
			<QueryName condition="end with">.msedge.net</QueryName> <!--Microsoft: Doesn't appear to host customer content or subdomains-->
			<QueryName condition="end with">.msn.com</QueryName> <!--Microsoft | Microsoft default exclusion-->
			<QueryName condition="end with">.msocdn.com</QueryName> <!--Microsoft-->
			<QueryName condition="end with">.skype.com</QueryName> <!--Microsoft | Microsoft default exclusion-->
			<QueryName condition="end with">.skype.net</QueryName> <!--Microsoft | Microsoft default exclusion-->
			<QueryName condition="end with">.windows.com</QueryName> <!--Microsoft-->
			<QueryName condition="end with">.windows.net.nsatc.net</QueryName> <!--Microsoft-->
			<QueryName condition="end with">.windowsupdate.com</QueryName> <!--Microsoft-->
			<QueryName condition="end with">.xboxlive.com</QueryName> <!--Microsoft-->
			<QueryName condition="is">login.windows.net</QueryName> <!--Microsoft-->
			<!--Microsoft:Office365/AzureAD-->
			<QueryName condition="end with">.activedirectory.windowsazure.com</QueryName> <!--Microsoft: AzureAD-->
			<QueryName condition="end with">.aria.microsoft.com</QueryName> <!--Microsoft: OneDrive/SharePoint-->
			<QueryName condition="end with">.msauth.net</QueryName>
			<QueryName condition="end with">.msftauth.net</QueryName>
			<QueryName condition="end with">.opinsights.azure.com</QueryName> <!--Microsoft: AzureAD/InTune client event monitoring-->
			<QueryName condition="is">management.azure.com</QueryName> <!--Microsoft: AzureAD/InTune-->
			<QueryName condition="is">outlook.office365.com</QueryName> <!--Microsoft: Protected by HSTS-->
			<QueryName condition="is">portal.azure.com</QueryName> <!--Microsoft: AzureAD/InTune-->
			<!--3rd-party applications-->
			<QueryName condition="end with">.mozaws.net</QueryName> <!--Mozilla-->
			<QueryName condition="end with">.mozilla.com</QueryName> <!--Mozilla-->
			<QueryName condition="end with">.mozilla.net</QueryName> <!--Mozilla-->
			<QueryName condition="end with">.mozilla.org</QueryName> <!--Mozilla-->
			<QueryName condition="end with">.spotify.com</QueryName> <!--Spotify-->
			<QueryName condition="end with">.spotify.map.fastly.net</QueryName> <!--Spotify-->
			<QueryName condition="is">clients1.google.com</QueryName> <!--Google-->
			<QueryName condition="is">clients2.google.com</QueryName> <!--Google-->
			<QueryName condition="is">clients3.google.com</QueryName> <!--Google-->
			<QueryName condition="is">clients4.google.com</QueryName> <!--Google-->
			<QueryName condition="is">clients5.google.com</QueryName> <!--Google-->
			<QueryName condition="is">clients6.google.com</QueryName> <!--Google-->
			<QueryName condition="is">safebrowsing.googleapis.com</QueryName> <!--Google-->
			<!--Goodlist CDN-->
			<QueryName condition="end with">.akadns.net</QueryName> <!--AkamaiCDN, extensively used by Microsoft | Microsoft default exclusion-->
			<QueryName condition="end with">.netflix.com</QueryName>
			<QueryName condition="end with">aspnetcdn.com</QueryName> <!--Microsoft [ https://docs.microsoft.com/en-us/aspnet/ajax/cdn/overview ]-->
			<QueryName condition="is">ajax.googleapis.com</QueryName>
			<QueryName condition="is">cdnjs.cloudflare.com</QueryName> <!--Cloudflare: Hosts popular javascript libraries-->
			<QueryName condition="is">fonts.googleapis.com</QueryName> <!--Google fonts-->
			<QueryName condition="end with">.typekit.net</QueryName> <!--Adobe fonts-->
			<QueryName condition="is">cdnjs.cloudflare.com</QueryName>
			<!--Personal-->
			<QueryName condition="end with">.steamcontent.com</QueryName> <!--If you seriously host malware C2 in game binaries in Steam, I give up-->
			<!--Web resources-->
			<QueryName condition="end with">.disqus.com</QueryName> <!--Microsoft default exclusion-->
			<QueryName condition="end with">.fontawesome.com</QueryName>
			<QueryName condition="is">disqus.com</QueryName> <!--Microsoft default exclusion-->
			<!--Ads-->
			<QueryName condition="end with">.2mdn.net</QueryName> <!--Ads: Google | Microsoft default exclusion-->
			<QueryName condition="end with">.adadvisor.net</QueryName> <!--Ads: Neustar [ https://better.fyi/trackers/adadvisor.net/ ] -->
			<QueryName condition="end with">.adap.tv</QueryName> <!--Ads:AOL | Microsoft default exclusion [ https://www.crunchbase.com/organization/adap-tv ] -->
			<QueryName condition="end with">.addthis.com</QueryName> <!--Ads:Oracle | Microsoft default exclusion [ https://en.wikipedia.org/wiki/AddThis ] -->
			<QueryName condition="end with">.adform.net</QueryName> <!--Ads-->
			<QueryName condition="end with">.adnxs.com</QueryName> <!--Ads: AppNexus | Microsoft default exclusion-->
			<QueryName condition="end with">.adroll.com</QueryName> <!--Ads-->
			<QueryName condition="end with">.adsafeprotected.com</QueryName> <!--Ads-->
			<QueryName condition="end with">.adsrvr.org</QueryName> <!--Ads-->
			<QueryName condition="end with">.advertising.com</QueryName> <!--Ads | Microsoft default exclusion-->
			<QueryName condition="end with">.amazon-adsystem.com</QueryName> <!--Ads-->
			<QueryName condition="end with">.amazon-adsystem.com</QueryName> <!--Ads-->
			<QueryName condition="end with">.analytics.yahoo.com</QueryName> <!--Ads:Yahoo-->
			<QueryName condition="end with">.aol.com</QueryName> <!--Ads | Microsoft default exclusion -->
			<QueryName condition="end with">.betrad.com</QueryName> <!--Ads | Microsoft default exclusion-->
			<QueryName condition="end with">.bidswitch.net</QueryName> <!--Ads-->
			<QueryName condition="end with">.casalemedia.com</QueryName> <!--Ads | Microsoft default exclusion-->
			<QueryName condition="end with">.chartbeat.net</QueryName> <!--Ads | Microsoft default exclusion [ https://better.fyi/trackers/chartbeat.com/ ]-->
			<QueryName condition="end with">.cnn.com</QueryName> <!-- Microsoft default exclusion-->
			<QueryName condition="end with">.convertro.com</QueryName> <!--Ads:Verizon-->
			<QueryName condition="end with">.criteo.com</QueryName> <!--Ads [ https://better.fyi/trackers/criteo.com/ ] -->
			<QueryName condition="end with">.criteo.net</QueryName> <!--Ads [ https://better.fyi/trackers/criteo.com/ ] -->
			<QueryName condition="end with">.crwdcntrl.net</QueryName> <!--Ads: Lotame [ https://better.fyi/trackers/crwdcntrl.net/ ] -->
			<QueryName condition="end with">.demdex.net</QueryName> <!--Ads | Microsoft default exclusion-->
			<QueryName condition="end with">.domdex.com</QueryName> 
			<QueryName condition="end with">.dotomi.com</QueryName> <!--Ads | Microsoft default exclusion-->
			<QueryName condition="end with">.doubleclick.net</QueryName> <!--Ads:Conversant | Microsoft default exclusion [ https://www.crunchbase.com/organization/dotomi ] -->
			<QueryName condition="end with">.doubleverify.com</QueryName> <!--Ads: Google-->
			<QueryName condition="end with">.emxdgt.com</QueryName> <!--Ads: EMX-->
			<QueryName condition="end with">.exelator.com</QueryName> <!--Ads:Nielson Marketing Cloud-->
			<QueryName condition="end with">.google-analytics.com</QueryName> <!--Ads:Google | Microsoft default exclusion-->
			<QueryName condition="end with">.googleadservices.com</QueryName> <!--Google-->
			<QueryName condition="end with">.googlesyndication.com</QueryName> <!--Ads:Google, sometimes called during malicious ads, but not directly responsible | Microsoft default exclusion [ https://www.hackread.com/wp-content/uploads/2018/06/Bitdefender-Whitepaper-Zacinlo.pdf ]-->
			<QueryName condition="end with">.googletagmanager.com</QueryName> <!--Google-->
			<QueryName condition="end with">.googlevideo.com</QueryName> <!--Google | Microsoft default exclusion-->
			<QueryName condition="end with">.gstatic.com</QueryName> <!--Google | Microsoft default exclusion-->
			<QueryName condition="end with">.gvt1.com</QueryName> <!--Google-->
			<QueryName condition="end with">.gvt2.com</QueryName> <!--Google-->
			<QueryName condition="end with">.ib-ibi.com</QueryName> <!--Ads: Offerpath [ https://better.fyi/trackers/ib-ibi.com/ ] -->
			<QueryName condition="end with">.jivox.com</QueryName> <!--Ads-->
			<QueryName condition="end with">.mathtag.com</QueryName> <!--Microsoft default exclusion-->
			<QueryName condition="end with">.moatads.com</QueryName> <!--Ads | Microsoft default exclusion-->
			<QueryName condition="end with">.moatpixel.com</QueryName> <!--Ads | Microsoft default exclusion-->
			<QueryName condition="end with">.mookie1.com</QueryName> <!--Ads-->
			<QueryName condition="end with">.myvisualiq.net</QueryName> <!--Ads-->
			<QueryName condition="end with">.netmng.com</QueryName> <!--Ads-->
			<QueryName condition="end with">.nexac.com</QueryName> <!--Ads | Microsoft default exclusion-->
			<QueryName condition="end with">.nexac.com</QueryName> <!--Ads | Microsoft default exclusion-->
			<QueryName condition="end with">.openx.net</QueryName> <!--Ads-->
			<QueryName condition="end with">.optimizely.com</QueryName> <!--Ads-->
			<QueryName condition="end with">.outbrain.com</QueryName> <!--Ads-->
			<QueryName condition="end with">.pardot.com</QueryName> <!--Ads-->
			<QueryName condition="end with">.phx.gbl</QueryName> <!--Ads | Microsoft default exclusion-->
			<QueryName condition="end with">.pinterest.com</QueryName> <!--Pinerest-->
			<QueryName condition="end with">.pubmatic.com</QueryName> <!--Ads | Microsoft default exclusion-->
			<QueryName condition="end with">.quantcount.com</QueryName>
			<QueryName condition="end with">.quantserve.com</QueryName>
			<QueryName condition="end with">.revsci.net</QueryName> <!--Ads:Omniture | Microsoft default exclusion-->
			<QueryName condition="end with">.rfihub.net</QueryName> <!--Ads | Microsoft default exclusion-->
			<QueryName condition="end with">.rlcdn.com</QueryName> <!--Ads: Rapleaf [ https://better.fyi/trackers/rlcdn.com/ ] -->
			<QueryName condition="end with">.rubiconproject.com</QueryName> <!--Ads: Rubicon Project | Microsoft default exclusion [ https://better.fyi/trackers/rubiconproject.com/ ] -->
			<QueryName condition="end with">.scdn.co</QueryName> <!--Spotify-->
			<QueryName condition="end with">.scorecardresearch.com</QueryName> <!--Ads: Comscore | Microsoft default exclusion-->
			<QueryName condition="end with">.serving-sys.com</QueryName> <!--Ads | Microsoft default exclusion-->
			<QueryName condition="end with">.sharethrough.com</QueryName> <!--Ads-->
			<QueryName condition="end with">.simpli.fi</QueryName>
			<QueryName condition="end with">.sitescout.com</QueryName> <!--Ads-->
			<QueryName condition="end with">.smartadserver.com</QueryName> <!--Ads-->
			<QueryName condition="end with">.snapads.com</QueryName> <!--Ads-->
			<QueryName condition="end with">.spotxchange.com</QueryName> <!--Ads-->
			<QueryName condition="end with">.1rx.io</QueryName> <!--Ads-->
			<QueryName condition="end with">.adrta.com</QueryName> <!--Ads-->
			<QueryName condition="end with">.taboola.com</QueryName> <!--Ads:Taboola-->
			<QueryName condition="end with">.taboola.map.fastly.net</QueryName> <!--Ads:Taboola-->
			<QueryName condition="end with">.tapad.com</QueryName>
			<QueryName condition="end with">.tidaltv.com</QueryName> <!--Ads: Videology [ https://better.fyi/trackers/tidaltv.com/ ] -->
			<QueryName condition="end with">.trafficmanager.net</QueryName> <!--Ads | Microsoft default exclusion-->
			<QueryName condition="end with">.tremorhub.com</QueryName> <!--Ads-->
			<QueryName condition="end with">.tribalfusion.com</QueryName> <!--Ads: Exponential [ https://better.fyi/trackers/tribalfusion.com/ ] -->
			<QueryName condition="end with">.turn.com</QueryName> <!--Ads | Microsoft default exclusion [ https://better.fyi/trackers/turn.com/ ] -->
			<QueryName condition="end with">.twimg.com</QueryName> <!--Ads | Microsoft default exclusion-->
			<QueryName condition="end with">.tynt.com</QueryName> <!--Ads-->
			<QueryName condition="end with">.w55c.net</QueryName> <!--Ads:dataxu-->
			<QueryName condition="end with">.ytimg.com</QueryName> <!--Google-->
			<QueryName condition="end with">.zorosrv.com</QueryName> <!--Ads:Taboola-->
			<QueryName condition="is">adservice.google.com</QueryName> <!--Google-->
			<QueryName condition="is">ampcid.google.com</QueryName> <!--Google-->
			<QueryName condition="is">clientservices.googleapis.com</QueryName> <!--Google-->
			<QueryName condition="is">d29x207vrinatv.cloudfront.net</QueryName> <!--Amazon-developed applications-->
			<QueryName condition="is">googleadapis.l.google.com</QueryName> <!--Google-->
			<QueryName condition="is">imasdk.googleapis.com</QueryName> <!--Google [ https://developers.google.com/interactive-media-ads/docs/sdks/html5/ ] -->
			<QueryName condition="is">l.google.com</QueryName> <!--Google-->
			<QueryName condition="is">ml314.com</QueryName> <!--Ads-->
			<QueryName condition="is">mtalk.google.com</QueryName> <!--Google-->
			<QueryName condition="is">update.googleapis.com</QueryName> <!--Google-->
			<QueryName condition="is">1rx.io</QueryName>
			<QueryName condition="is">www.googletagservices.com</QueryName>
			<!--SocialNet-->
			<QueryName condition="end with">.pscp.tv</QueryName> <!--Twitter:Periscope-->
			<!--OSCP/CRL Common-->
			<QueryName condition="end with">.digicert.com</QueryName>
			<QueryName condition="end with">.globalsign.com</QueryName>
			<QueryName condition="end with">.globalsign.net</QueryName>
			<QueryName condition="is">msocsp.com</QueryName> <!--Microsoft:OCSP-->
			<QueryName condition="is">ocsp.msocsp.com</QueryName> <!--Microsoft:OCSP-->
			<QueryName condition="end with">pki.goog</QueryName>
			<QueryName condition="is">ocsp.godaddy.com</QueryName>
			<QueryName condition="end with">amazontrust.com</QueryName>
			<QueryName condition="is">ocsp.sectigo.com</QueryName>
			<QueryName condition="is">pki-goog.l.google.com</QueryName>
			<QueryName condition="end with">.usertrust.com</QueryName>
			<QueryName condition="is">ocsp.comodoca.com</QueryName>
			<QueryName condition="is">ocsp.verisign.com</QueryName>
			<QueryName condition="is">ocsp.entrust.net</QueryName>
			<QueryName condition="end with">ocsp.identrust.com</QueryName>
			<QueryName condition="is">status.rapidssl.com</QueryName>
			<QueryName condition="is">status.thawte.com</QueryName>
			<QueryName condition="is">ocsp.int-x3.letsencrypt.org</QueryName>        
	</DnsQuery>
</RuleGroup>
  </EventFiltering>
  <HashAlgorithms>*</HashAlgorithms>
  <CheckRevocation />
</Sysmon>