diff --git a/clusters/sigma-rules.json b/clusters/sigma-rules.json
index 987e20b..17d0966 100644
--- a/clusters/sigma-rules.json
+++ b/clusters/sigma-rules.json
@@ -23,10 +23,10 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/",
           "https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d",
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md",
           "https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md",
+          "https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_currentversion.yml"
         ],
         "tags": [
@@ -59,8 +59,8 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1546.015/T1546.015.md",
           "https://www.youtube.com/watch?v=3gz1QmiMhss&t=1251s",
+          "https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1546.015/T1546.015.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_treatas_persistence.yml"
         ],
         "tags": [
@@ -149,10 +149,10 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/jamieantisocial/status/1304520651248668673",
           "https://www.sans.org/cyber-security-summit/archives",
-          "https://www.slideshare.net/JamieWilliams130/started-from-the-bottom-exploiting-data-sources-to-uncover-attck-behaviors",
           "https://learn.microsoft.com/en-us/dotnet/core/runtime-config/debugging-profiling",
+          "https://www.slideshare.net/JamieWilliams130/started-from-the-bottom-exploiting-data-sources-to-uncover-attck-behaviors",
+          "https://twitter.com/jamieantisocial/status/1304520651248668673",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_enabling_cor_profiler_env_variables.yml"
         ],
         "tags": [
@@ -189,8 +189,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d",
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md",
           "https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_system_scripts.yml"
         ],
         "tags": [
@@ -223,8 +223,8 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/outlook/troubleshoot/security/information-about-email-security-settings",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1137/T1137.md",
+          "https://learn.microsoft.com/en-us/outlook/troubleshoot/security/information-about-email-security-settings",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_office_outlook_security_settings.yml"
         ],
         "tags": [
@@ -258,10 +258,10 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/",
           "https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d",
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md",
           "https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md",
+          "https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_wow6432node.yml"
         ],
         "tags": [
@@ -395,8 +395,8 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://persistence-info.github.io/Data/aedebug.html",
           "https://learn.microsoft.com/en-us/windows/win32/debug/configuring-automatic-debugging",
+          "https://persistence-info.github.io/Data/aedebug.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_aedebug_persistence.yml"
         ],
         "tags": [
@@ -466,10 +466,10 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://www.trendmicro.com/en_us/research/19/i/purple-fox-fileless-malware-with-rookit-component-delivered-by-rig-exploit-kit-now-abuses-powershell.html",
           "https://any.run/report/3ecd4763ffc944fdc67a9027e459cd4f448b1a8d1b36147977afaf86bbf2a261/64b0ba45-e7ce-423b-9a1d-5b4ea59521e6",
-          "https://www.trendmicro.com/en_us/research/21/j/purplefox-adds-new-backdoor-that-uses-websockets.html",
           "https://devblogs.microsoft.com/scripting/determine-pending-reboot-statuspowershell-style-part-1/",
+          "https://www.trendmicro.com/en_us/research/21/j/purplefox-adds-new-backdoor-that-uses-websockets.html",
+          "https://www.trendmicro.com/en_us/research/19/i/purple-fox-fileless-malware-with-rookit-component-delivered-by-rig-exploit-kit-now-abuses-powershell.html",
           "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc960241(v=technet.10)?redirectedfrom=MSDN",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_susp_pendingfilerenameoperations.yml"
         ],
@@ -564,8 +564,8 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/",
           "https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1564.002/T1564.002.md",
+          "https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_special_accounts.yml"
         ],
         "tags": [
@@ -682,8 +682,8 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://social.technet.microsoft.com/wiki/contents/articles/32905.remote-desktop-services-enable-restricted-admin-mode.aspx",
           "https://github.com/redcanaryco/atomic-red-team/blob/a8e3cf63e97b973a25903d3df9fd55da6252e564/atomics/T1112/T1112.md",
+          "https://social.technet.microsoft.com/wiki/contents/articles/32905.remote-desktop-services-enable-restricted-admin-mode.aspx",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_lsa_disablerestrictedadmin.yml"
         ],
         "tags": [
@@ -751,8 +751,8 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/AaLl86/WindowsInternals/blob/070dc4f317726dfb6ffd2b7a7c121a33a8659b5e/Slides/Hypervisor-enforced%20Paging%20Translation%20-%20The%20end%20of%20non%20data-driven%20Kernel%20Exploits%20(Recon2024).pdf",
           "https://twitter.com/standa_t/status/1808868985678803222",
+          "https://github.com/AaLl86/WindowsInternals/blob/070dc4f317726dfb6ffd2b7a7c121a33a8659b5e/Slides/Hypervisor-enforced%20Paging%20Translation%20-%20The%20end%20of%20non%20data-driven%20Kernel%20Exploits%20(Recon2024).pdf",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_deviceguard_hypervisorenforcedpagingtranslation_disabled.yml"
         ],
         "tags": [
@@ -786,8 +786,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://threathunterplaybook.com/hunts/windows/190510-RegModWDigestDowngrade/notebook.html",
-          "https://support.microsoft.com/en-us/topic/microsoft-security-advisory-update-to-improve-credentials-protection-and-management-may-13-2014-93434251-04ac-b7f3-52aa-9f951c14b649",
           "https://github.com/redcanaryco/atomic-red-team/blob/73fcfa1d4863f6a4e17f90e54401de6e30a312bb/atomics/T1112/T1112.md#atomic-test-3---modify-registry-to-store-logon-credentials",
+          "https://support.microsoft.com/en-us/topic/microsoft-security-advisory-update-to-improve-credentials-protection-and-management-may-13-2014-93434251-04ac-b7f3-52aa-9f951c14b649",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_wdigest_enable_uselogoncredential.yml"
         ],
         "tags": [
@@ -820,9 +820,9 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx",
-          "https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx",
           "https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html",
+          "https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx",
+          "https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_dhcp_calloutdll.yml"
         ],
         "tags": [
@@ -899,8 +899,8 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/1.A.1_DFD6A782-9BDB-4550-AB6B-525E825B095E.md",
           "https://github.com/OTRF/detection-hackathon-apt29/issues/1",
+          "https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/1.A.1_DFD6A782-9BDB-4550-AB6B-525E825B095E.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_new_application_appcompat.yml"
         ],
         "tags": [
@@ -1032,8 +1032,8 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy",
           "https://learn.microsoft.com/en-us/troubleshoot/windows-client/setup-upgrade-and-drivers/network-provider-settings-removed-in-place-upgrade",
+          "https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_new_network_provider.yml"
         ],
         "tags": [
@@ -1101,8 +1101,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d",
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md",
           "https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_internet_explorer.yml"
         ],
         "tags": [
@@ -1202,10 +1202,10 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://blogs.blackberry.com/en/2023/06/romcom-resurfaces-targeting-ukraine",
-          "https://www.trendmicro.com/en_us/research/23/e/void-rabisu-s-use-of-romcom-backdoor-shows-a-growing-shift-in-th.html",
           "https://strontic.github.io/xcyclopedia/library/clsid_C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6.html",
           "https://www.virustotal.com/gui/file/6d3ab9e729bb03ae8ae3fcd824474c5052a165de6cb4c27334969a542c7b261d/detection",
+          "https://blogs.blackberry.com/en/2023/06/romcom-resurfaces-targeting-ukraine",
+          "https://www.trendmicro.com/en_us/research/23/e/void-rabisu-s-use-of-romcom-backdoor-shows-a-growing-shift-in-th.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_persistence_comhijack_psfactorybuffer.yml"
         ],
         "tags": [
@@ -1271,8 +1271,8 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/blackbyte-ransomware-pt-1-in-depth-analysis/",
           "https://redcanary.com/blog/blackbyte-ransomware/?utm_source=twitter&utm_medium=social",
+          "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/blackbyte-ransomware-pt-1-in-depth-analysis/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_blackbyte_ransomware.yml"
         ],
         "tags": [
@@ -1305,8 +1305,8 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://www.hexacorn.com/blog/2018/12/30/beyond-good-ol-run-key-part-98/",
           "https://persistence-info.github.io/Data/naturallanguage6.html",
+          "https://www.hexacorn.com/blog/2018/12/30/beyond-good-ol-run-key-part-98/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_persistence_natural_language.yml"
         ],
         "tags": [
@@ -1439,8 +1439,8 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://pentestlab.blog/2019/10/29/persistence-netsh-helper-dll/",
           "https://www.ired.team/offensive-security/persistence/t1128-netsh-helper-dll",
+          "https://pentestlab.blog/2019/10/29/persistence-netsh-helper-dll/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_netsh_helper_dll_potential_persistence.yml"
         ],
         "tags": [
@@ -1627,8 +1627,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://www.sans.org/blog/protecting-privileged-domain-accounts-lm-hashes-the-good-the-bad-and-the-ugly/",
-          "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a",
           "https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/prevent-windows-store-lm-hash-password",
+          "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_system_lsa_nolmhash.yml"
         ],
         "tags": [
@@ -1661,8 +1661,8 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://securelist.com/scarcruft-surveilling-north-korean-defectors-and-human-rights-activists/105074/",
           "https://twitter.com/inversecos/status/1494174785621819397",
+          "https://securelist.com/scarcruft-surveilling-north-korean-defectors-and-human-rights-activists/105074/",
           "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/zloader-with-a-new-infection-technique/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_office_vba_warnings_tamper.yml"
         ],
@@ -1737,9 +1737,9 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/windows/win32/api/shobjidl_core/nn-shobjidl_core-iexecutecommand",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md#atomic-test-7---bypass-uac-using-sdclt-delegateexecute",
           "https://devblogs.microsoft.com/oldnewthing/20100312-01/?p=14623",
+          "https://learn.microsoft.com/en-us/windows/win32/api/shobjidl_core/nn-shobjidl_core-iexecutecommand",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_bypass_uac_using_delegateexecute.yml"
         ],
         "tags": [
@@ -1773,8 +1773,8 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=53",
           "https://www.linkedin.com/pulse/outlook-backdoor-using-vba-samir-b-/",
+          "https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=53",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_office_outlook_enable_load_macro_provider_on_boot.yml"
         ],
         "tags": [
@@ -1891,8 +1891,8 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf",
           "https://admx.help/?Category=InternetExplorer&Policy=Microsoft.Policies.InternetExplorer::NoFirstRunCustomise",
+          "https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf",
           "https://unit42.paloaltonetworks.com/operation-ke3chang-resurfaces-with-new-tidepool-malware/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_internet_explorer_disable_first_run_customize.yml"
         ],
@@ -1940,8 +1940,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://persistence-info.github.io/Data/ifilters.html",
-          "https://github.com/gtworek/PSBits/blob/8d767892f3b17eefa4d0668f5d2df78e844f01d8/IFilter/Dll.cpp#L281-L308",
           "https://github.com/gtworek/PSBits/tree/master/IFilter",
+          "https://github.com/gtworek/PSBits/blob/8d767892f3b17eefa4d0668f5d2df78e844f01d8/IFilter/Dll.cpp#L281-L308",
           "https://twitter.com/0gtweet/status/1468548924600459267",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_persistence_ifilter.yml"
         ],
@@ -1966,9 +1966,9 @@
         "logsource.product": "windows",
         "refs": [
           "https://learn.microsoft.com/en-us/troubleshoot/developer/browsers/security-privacy/ie-security-zones-registry-entries",
-          "https://twitter.com/M_haggis/status/1699056847154725107",
-          "https://www.virustotal.com/gui/file/339ff720c74dc44265b917b6d3e3ba0411d61f3cd3c328e9a2bae81592c8a6e5/content",
           "https://twitter.com/JAMESWT_MHT/status/1699042827261391247",
+          "https://www.virustotal.com/gui/file/339ff720c74dc44265b917b6d3e3ba0411d61f3cd3c328e9a2bae81592c8a6e5/content",
+          "https://twitter.com/M_haggis/status/1699056847154725107",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_ie_security_zone_protocol_defaults_downgrade.yml"
         ],
         "tags": [
@@ -2057,9 +2057,9 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/nas_bench/status/1626648985824788480",
           "https://www.hexacorn.com/blog/2019/02/15/beyond-good-ol-run-key-part-103/",
           "https://admx.help/?Category=Windows_7_2008R2&Policy=Microsoft.Policies.InternetCommunicationManagement::EventViewer_DisableLinks",
+          "https://twitter.com/nas_bench/status/1626648985824788480",
           "https://github.com/redcanaryco/atomic-red-team/blob/f296668303c29d3f4c07e42bdd2b28d8dd6625f9/atomics/T1112/T1112.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_persistence_event_viewer_events_asp.yml"
         ],
@@ -2249,8 +2249,8 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/",
           "https://www.hybrid-analysis.com/sample/e122bc8bf291f15cab182a5d2d27b8db1e7019e4e96bb5cdbd1dfe7446f3f51f?environmentId=100",
+          "https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_uac_bypass_eventvwr.yml"
         ],
         "tags": [
@@ -2285,15 +2285,15 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/dotnet/runtime/blob/ee2355c801d892f2894b0f7b14a20e6cc50e0e54/docs/design/coreclr/jit/viewing-jit-dumps.md#setting-configuration-variables",
-          "https://github.com/dotnet/runtime/blob/7abe42dc1123722ed385218268bb9fe04556e3d3/src/coreclr/src/inc/clrconfig.h#L33-L39",
-          "https://blog.xpnsec.com/hiding-your-dotnet-complus-etwenabled/",
           "https://github.com/dotnet/runtime/blob/4f9ae42d861fcb4be2fcd5d3d55d5f227d30e723/docs/coding-guidelines/clr-jit-coding-conventions.md#1412-disabling-code",
           "https://social.msdn.microsoft.com/Forums/vstudio/en-US/0878832e-39d7-4eaf-8e16-a729c4c40975/what-can-i-use-e13c0d23ccbc4e12931bd9cc2eee27e4-for?forum=clr",
-          "https://i.blackhat.com/EU-21/Wednesday/EU-21-Teodorescu-Veni-No-Vidi-No-Vici-Attacks-On-ETW-Blind-EDRs.pdf",
-          "http://managed670.rssing.com/chan-5590147/all_p1.html",
-          "https://twitter.com/_xpn_/status/1268712093928378368",
           "https://github.com/dotnet/runtime/search?p=1&q=COMPlus_&unscoped_q=COMPlus_",
+          "https://blog.xpnsec.com/hiding-your-dotnet-complus-etwenabled/",
+          "https://twitter.com/_xpn_/status/1268712093928378368",
+          "https://github.com/dotnet/runtime/blob/ee2355c801d892f2894b0f7b14a20e6cc50e0e54/docs/design/coreclr/jit/viewing-jit-dumps.md#setting-configuration-variables",
+          "http://managed670.rssing.com/chan-5590147/all_p1.html",
+          "https://github.com/dotnet/runtime/blob/7abe42dc1123722ed385218268bb9fe04556e3d3/src/coreclr/src/inc/clrconfig.h#L33-L39",
+          "https://i.blackhat.com/EU-21/Wednesday/EU-21-Teodorescu-Veni-No-Vidi-No-Vici-Attacks-On-ETW-Blind-EDRs.pdf",
           "https://bunnyinside.com/?term=f71e8cb9c76a",
           "https://github.com/dotnet/runtime/blob/f62e93416a1799aecc6b0947adad55a0d9870732/src/coreclr/src/inc/clrconfigvalues.h#L35-L38",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_dot_net_etw_tamper.yml"
@@ -2336,8 +2336,8 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/4ae9580a1a8772db87a1b6cdb0d03e5af231e966/atomics/T1137.006/T1137.006.md",
           "https://labs.withsecure.com/publications/add-in-opportunities-for-office-persistence",
+          "https://github.com/redcanaryco/atomic-red-team/blob/4ae9580a1a8772db87a1b6cdb0d03e5af231e966/atomics/T1137.006/T1137.006.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_persistence_xll.yml"
         ],
         "tags": [
@@ -2393,8 +2393,8 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md#atomic-test-6---add-root-certificate-to-currentuser-certificate-store",
           "https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md#atomic-test-6---add-root-certificate-to-currentuser-certificate-store",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_install_root_or_ca_certificat.yml"
         ],
         "tags": [
@@ -2451,8 +2451,8 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://pentestlab.blog/2019/10/29/persistence-netsh-helper-dll/",
           "https://www.ired.team/offensive-security/persistence/t1128-netsh-helper-dll",
+          "https://pentestlab.blog/2019/10/29/persistence-netsh-helper-dll/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_netsh_help_dll_persistence_susp_location.yml"
         ],
         "tags": [
@@ -2552,8 +2552,8 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://youtu.be/zSihR3lTf7g",
           "https://posts.specterops.io/shhmon-silencing-sysmon-via-driver-unload-682b5be57650",
+          "https://youtu.be/zSihR3lTf7g",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_change_sysmon_driver_altitude.yml"
         ],
         "tags": [
@@ -2643,15 +2643,15 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-63---disable-remote-desktop-anti-alias-setting-through-registry",
+          "http://woshub.com/rds-shadow-how-to-connect-to-a-user-session-in-windows-server-2012-r2/",
+          "https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/",
+          "https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-64---disable-remote-desktop-security-settings-through-registry",
+          "https://blog.sekoia.io/darkgate-internals/",
           "https://threathunterplaybook.com/hunts/windows/190407-RegModEnableRDPConnections/notebook.html",
           "https://admx.help/HKLM/SOFTWARE/Policies/Microsoft/Windows%20NT/Terminal%20Services",
-          "https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-64---disable-remote-desktop-security-settings-through-registry",
-          "http://woshub.com/rds-shadow-how-to-connect-to-a-user-session-in-windows-server-2012-r2/",
-          "https://blog.sekoia.io/darkgate-internals/",
-          "https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/",
-          "http://etutorials.org/Microsoft+Products/microsoft+windows+server+2003+terminal+services/Chapter+6+Registry/Registry+Keys+for+Terminal+Services/",
           "https://web.archive.org/web/20200929062532/https://blog.menasec.net/2019/02/threat-hunting-rdp-hijacking-via.html",
+          "https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-63---disable-remote-desktop-anti-alias-setting-through-registry",
+          "http://etutorials.org/Microsoft+Products/microsoft+windows+server+2003+terminal+services/Chapter+6+Registry/Registry+Keys+for+Terminal+Services/",
           "https://twitter.com/SagieSec/status/1469001618863624194?t=HRf0eA0W1YYzkTSHb-Ky1A&s=03",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_terminal_server_tampering.yml"
         ],
@@ -2773,6 +2773,39 @@
       "uuid": "e88a6ddc-74f7-463b-9b26-f69fc0d2ce85",
       "value": "New TimeProviders Registered With Uncommon DLL Name"
     },
+    {
+      "description": "Detects activity that indicates a user disabling the ability for Antivirus mini filter to inspect a \"Dev Drive\".\n",
+      "meta": {
+        "author": "@kostastsale, Nasreddine Bencherchali (Nextron Systems)",
+        "creation_date": "2023-11-05",
+        "falsepositive": [
+          "Unlikely"
+        ],
+        "filename": "registry_set_devdrv_disallow_antivirus_filter.yml",
+        "level": "high",
+        "logsource.category": "registry_set",
+        "logsource.product": "windows",
+        "refs": [
+          "https://twitter.com/0gtweet/status/1720419490519752955",
+          "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_devdrv_disallow_antivirus_filter.yml"
+        ],
+        "tags": [
+          "attack.defense-evasion",
+          "attack.t1562.001"
+        ]
+      },
+      "related": [
+        {
+          "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "related-to"
+        }
+      ],
+      "uuid": "31e124fb-5dc4-42a0-83b3-44a69c77b271",
+      "value": "Antivirus Filter Driver Disallowed On Dev Drive - Registry"
+    },
     {
       "description": "Detects modification of autostart extensibility point (ASEP) in registry.",
       "meta": {
@@ -2788,8 +2821,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d",
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md",
           "https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_office.yml"
         ],
         "tags": [
@@ -2822,8 +2855,8 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/04e487c1828d76df3e834621f4f893ea756d5232/atomics/T1562.001/T1562.001.md#atomic-test-43---disable-hypervisor-enforced-code-integrity-hvci",
           "https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/",
+          "https://github.com/redcanaryco/atomic-red-team/blob/04e487c1828d76df3e834621f4f893ea756d5232/atomics/T1562.001/T1562.001.md#atomic-test-43---disable-hypervisor-enforced-code-integrity-hvci",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_deviceguard_hypervisorenforcedcodeintegrity_disabled.yml"
         ],
         "tags": [
@@ -2857,13 +2890,13 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://www.tenforums.com/tutorials/123792-turn-off-tamper-protection-microsoft-defender-antivirus.html",
           "https://gist.github.com/anadr/7465a9fde63d41341136949f14c21105",
-          "https://admx.help/?Category=Windows_7_2008R2&Policy=Microsoft.Policies.WindowsDefender::SpyNetReporting",
           "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker",
+          "https://www.tenforums.com/tutorials/123792-turn-off-tamper-protection-microsoft-defender-antivirus.html",
           "https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/",
-          "https://www.tenforums.com/tutorials/32236-enable-disable-microsoft-defender-pua-protection-windows-10-a.html",
+          "https://admx.help/?Category=Windows_7_2008R2&Policy=Microsoft.Policies.WindowsDefender::SpyNetReporting",
           "https://www.tenforums.com/tutorials/105533-enable-disable-windows-defender-exploit-protection-settings.html",
+          "https://www.tenforums.com/tutorials/32236-enable-disable-microsoft-defender-pua-protection-windows-10-a.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_windows_defender_tamper.yml"
         ],
         "tags": [
@@ -2897,8 +2930,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign",
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md#atomic-test-9---bypass-uac-using-silentcleanup-task",
           "https://www.reddit.com/r/hacking/comments/ajtrws/bypassing_highest_uac_level_windows_810/",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md#atomic-test-9---bypass-uac-using-silentcleanup-task",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_bypass_uac_using_silentcleanup_task.yml"
         ],
         "tags": [
@@ -2934,8 +2967,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d",
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md",
           "https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_classes.yml"
         ],
         "tags": [
@@ -2991,9 +3024,9 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
+          "https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/",
           "https://twitter.com/MichalKoczwara/status/1553634816016498688",
           "https://i.blackhat.com/EU-21/Wednesday/EU-21-Teodorescu-Veni-No-Vidi-No-Vici-Attacks-On-ETW-Blind-EDRs.pdf",
-          "https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_disable_autologger_sessions.yml"
         ],
         "tags": [
@@ -3016,9 +3049,9 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-1---modify-registry-of-current-user-profile---cmd",
           "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanSpy%3aMSIL%2fHakey.A",
           "https://unit42.paloaltonetworks.com/ransomware-families/",
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-1---modify-registry-of-current-user-profile---cmd",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_hidden_extention.yml"
         ],
         "tags": [
@@ -3051,8 +3084,8 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget",
           "https://github.com/microsoft/winget-cli/blob/02d2f93807c9851d73eaacb4d8811a76b64b7b01/src/AppInstallerCommonCore/Public/winget/AdminSettings.h#L13",
+          "https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_winget_admin_settings_tampering.yml"
         ],
         "tags": [
@@ -3078,8 +3111,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d",
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md",
           "https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_currentversion_nt.yml"
         ],
         "tags": [
@@ -3148,8 +3181,8 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.003/T1543.003.md#atomic-test-4---tinyturla-backdoor-service-w64time",
           "https://www.hexacorn.com/blog/2013/09/19/beyond-good-ol-run-key-part-4/",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.003/T1543.003.md#atomic-test-4---tinyturla-backdoor-service-w64time",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_servicedll_hijack.yml"
         ],
         "tags": [
@@ -3185,8 +3218,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d",
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md",
           "https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_winsock2.yml"
         ],
         "tags": [
@@ -3252,8 +3285,8 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://persistence-info.github.io/Data/diskcleanuphandler.html",
           "https://www.hexacorn.com/blog/2018/09/02/beyond-good-ol-run-key-part-86/",
+          "https://persistence-info.github.io/Data/diskcleanuphandler.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_disk_cleanup_handler_autorun_persistence.yml"
         ],
         "tags": [
@@ -3276,10 +3309,10 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://chromeenterprise.google/policies/?policy=DnsOverHttpsMode",
-          "https://github.com/elastic/detection-rules/issues/1371",
           "https://admx.help/HKLM/Software/Policies/Mozilla/Firefox/DNSOverHTTPS",
+          "https://github.com/elastic/detection-rules/issues/1371",
           "https://www.tenforums.com/tutorials/151318-how-enable-disable-dns-over-https-doh-microsoft-edge.html",
+          "https://chromeenterprise.google/policies/?policy=DnsOverHttpsMode",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_dns_over_https_enabled.yml"
         ],
         "tags": [
@@ -3445,8 +3478,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d",
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md",
           "https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_currentcontrolset.yml"
         ],
         "tags": [
@@ -3552,8 +3585,8 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://securelist.com/scarcruft-surveilling-north-korean-defectors-and-human-rights-activists/105074/",
           "https://twitter.com/inversecos/status/1494174785621819397",
+          "https://securelist.com/scarcruft-surveilling-north-korean-defectors-and-human-rights-activists/105074/",
           "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/zloader-with-a-new-infection-technique/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_office_access_vbom_tamper.yml"
         ],
@@ -3654,12 +3687,12 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://threathunterplaybook.com/hunts/windows/190407-RegModEnableRDPConnections/notebook.html",
-          "https://admx.help/HKLM/SOFTWARE/Policies/Microsoft/Windows%20NT/Terminal%20Services",
           "http://woshub.com/rds-shadow-how-to-connect-to-a-user-session-in-windows-server-2012-r2/",
           "https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/",
-          "http://etutorials.org/Microsoft+Products/microsoft+windows+server+2003+terminal+services/Chapter+6+Registry/Registry+Keys+for+Terminal+Services/",
+          "https://threathunterplaybook.com/hunts/windows/190407-RegModEnableRDPConnections/notebook.html",
+          "https://admx.help/HKLM/SOFTWARE/Policies/Microsoft/Windows%20NT/Terminal%20Services",
           "https://web.archive.org/web/20200929062532/https://blog.menasec.net/2019/02/threat-hunting-rdp-hijacking-via.html",
+          "http://etutorials.org/Microsoft+Products/microsoft+windows+server+2003+terminal+services/Chapter+6+Registry/Registry+Keys+for+Terminal+Services/",
           "https://twitter.com/SagieSec/status/1469001618863624194?t=HRf0eA0W1YYzkTSHb-Ky1A&s=03",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_terminal_server_suspicious.yml"
         ],
@@ -3728,8 +3761,8 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md#atomic-test-1---bypass-uac-using-event-viewer-cmd",
+          "https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_bypass_uac_using_eventviewer.yml"
         ],
         "tags": [
@@ -3840,6 +3873,30 @@
       "uuid": "9d15044a-7cfe-4d23-8085-6ebc11df7685",
       "value": "Potential Persistence Via Visual Studio Tools for Office"
     },
+    {
+      "description": "Detects changes to the \"HVCIDisallowedImages\" registry value to potentially add a driver to the list, in order to prevent it from loading.\n",
+      "meta": {
+        "author": "Nasreddine Bencherchali (Nextron Systems), Omar Khaled (@beacon_exe)",
+        "creation_date": "2023-12-05",
+        "falsepositive": [
+          "Legitimate usage of this key would also trigger this. Investigate the driver being added and make sure its intended"
+        ],
+        "filename": "registry_set_hvci_disallowed_images.yml",
+        "level": "high",
+        "logsource.category": "registry_set",
+        "logsource.product": "windows",
+        "refs": [
+          "https://x.com/yarden_shafir/status/1822667605175324787",
+          "https://github.com/yardenshafir/conference_talks/blob/3de1f5d7c02656c35117f067fbff0a219c304b09/OffensiveCon_2023_Your_Mitigations_are_My_Opportunities.pdf",
+          "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_hvci_disallowed_images.yml"
+        ],
+        "tags": [
+          "attack.defense-evasion"
+        ]
+      },
+      "uuid": "555155a2-03bf-4fe7-af74-d176b3fdbe16",
+      "value": "Driver Added To Disallowed Images In HVCI - Registry"
+    },
     {
       "description": "Detects changes to registry keys related to \"Trusted Location\" of Microsoft Office where the path is set to something uncommon. Attackers might add additional trusted locations to avoid macro security restrictions.",
       "meta": {
@@ -3954,10 +4011,10 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://www.huntress.com/blog/blackcat-ransomware-affiliate-ttps",
-          "https://www.sentinelone.com/labs/blackcat-ransomware-highly-configurable-rust-driven-raas-on-the-prowl-for-victims/",
           "https://www.intrinsec.com/alphv-ransomware-gang-analysis/?cn-reloaded=1",
+          "https://www.sentinelone.com/labs/blackcat-ransomware-highly-configurable-rust-driven-raas-on-the-prowl-for-victims/",
           "https://securityscorecard.com/research/deep-dive-into-alphv-blackcat-ransomware",
+          "https://www.huntress.com/blog/blackcat-ransomware-affiliate-ttps",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_optimize_file_sharing_network.yml"
         ],
         "tags": [
@@ -4015,8 +4072,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d",
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md",
           "https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_wow6432node_classes.yml"
         ],
         "tags": [
@@ -4082,8 +4139,8 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/gtworek/PSBits/tree/master/SIP",
           "https://specterops.io/assets/resources/SpecterOps_Subverting_Trust_in_Windows.pdf",
+          "https://github.com/gtworek/PSBits/tree/master/SIP",
           "https://persistence-info.github.io/Data/codesigning.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_sip_persistence.yml"
         ],
@@ -4118,8 +4175,8 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://persistence-info.github.io/Data/autodialdll.html",
           "https://www.hexacorn.com/blog/2015/01/13/beyond-good-ol-run-key-part-24/",
+          "https://persistence-info.github.io/Data/autodialdll.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_persistence_autodial_dll.yml"
         ],
         "tags": [
@@ -4712,8 +4769,8 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/7e11e9b79583545f208a6dc3fa062f2ed443d999/atomics/T1548.002/T1548.002.md",
           "https://securityintelligence.com/x-force/x-force-hive0129-targeting-financial-institutions-latam-banking-trojan/",
+          "https://github.com/redcanaryco/atomic-red-team/blob/7e11e9b79583545f208a6dc3fa062f2ed443d999/atomics/T1548.002/T1548.002.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_uac_disable_notification.yml"
         ],
         "tags": [
@@ -4780,8 +4837,8 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://admx.help/?Category=Office2016&Policy=office16.Office.Microsoft.Policies.Windows::L_MacroRuntimeScanScope",
           "https://www.microsoft.com/en-us/security/blog/2018/09/12/office-vba-amsi-parting-the-veil-on-malicious-macros/",
+          "https://admx.help/?Category=Office2016&Policy=office16.Office.Microsoft.Policies.Windows::L_MacroRuntimeScanScope",
           "https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/28cc6a2802d8176195ac19b3c8e9a749009a82a3/src/AMSIbypasses.vba",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_disable_macroruntimescanscope.yml"
         ],
@@ -4872,8 +4929,8 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://forensafe.com/blogs/typedpaths.html",
           "https://twitter.com/dez_/status/1560101453150257154",
+          "https://forensafe.com/blogs/typedpaths.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_persistence_typed_paths.yml"
         ],
         "tags": [
@@ -5063,8 +5120,8 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://www.hexacorn.com/blog/2018/08/31/beyond-good-ol-run-key-part-85/",
           "https://cocomelonc.github.io/malware/2022/11/02/malware-pers-18.html",
+          "https://www.hexacorn.com/blog/2018/08/31/beyond-good-ol-run-key-part-85/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_persistence_reflectdebugger.yml"
         ],
         "tags": [
@@ -5165,9 +5222,9 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://jstnk9.github.io/jstnk9/research/InstallScreenSaver-SCR-files",
-          "https://twitter.com/VakninHai/status/1517027824984547329",
           "https://twitter.com/pabraeken/status/998627081360695297",
+          "https://twitter.com/VakninHai/status/1517027824984547329",
+          "https://jstnk9.github.io/jstnk9/research/InstallScreenSaver-SCR-files",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_scr_file_executed_by_rundll32.yml"
         ],
         "tags": [
@@ -5241,8 +5298,8 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/",
           "https://twitter.com/malmoeb/status/1560536653709598721",
+          "https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_turn_on_dev_features.yml"
         ],
         "tags": [
@@ -5265,11 +5322,11 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://www.malwarebytes.com/blog/detections/pum-optional-nodispbackgroundpage",
-          "https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions",
-          "https://www.malwarebytes.com/blog/detections/pum-optional-nodispcpl",
-          "https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md",
+          "https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html",
+          "https://www.malwarebytes.com/blog/detections/pum-optional-nodispbackgroundpage",
+          "https://www.malwarebytes.com/blog/detections/pum-optional-nodispcpl",
+          "https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_disable_function_user.yml"
         ],
         "tags": [
@@ -5435,8 +5492,8 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/pillowmint-fin7s-monkey-thief/",
           "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html",
+          "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/pillowmint-fin7s-monkey-thief/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_persistence_shim_database_susp_application.yml"
         ],
         "tags": [
@@ -5504,8 +5561,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d",
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md",
           "https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_wow6432node_currentversion.yml"
         ],
         "tags": [
@@ -5573,10 +5630,10 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://persistence-info.github.io/Data/userinitmprlogonscript.html",
           "https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d",
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md",
           "https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md",
+          "https://persistence-info.github.io/Data/userinitmprlogonscript.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_common.yml"
         ],
         "tags": [
@@ -5611,8 +5668,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d",
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md",
           "https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_session_manager.yml"
         ],
         "tags": [
@@ -5686,9 +5743,9 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://adsecurity.org/?p=1785",
           "https://www.sentinelone.com/blog/detecting-dsrm-account-misconfigurations/",
           "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/dsrm-credentials",
+          "https://adsecurity.org/?p=1785",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_dsrm_tampering.yml"
         ],
         "tags": [
@@ -5723,8 +5780,8 @@
         "refs": [
           "https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md",
-          "https://admx.help/HKCU/software/policies/microsoft/office/16.0/excel/security/protectedview",
           "https://yoroi.company/research/cyber-criminal-espionage-operation-insists-on-italian-manufacturing/",
+          "https://admx.help/HKCU/software/policies/microsoft/office/16.0/excel/security/protectedview",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_office_disable_protected_view_features.yml"
         ],
         "tags": [
@@ -5924,6 +5981,39 @@
       "uuid": "28036918-04d3-423d-91c0-55ecf99fb892",
       "value": "NET NGenAssemblyUsageLog Registry Key Tamper"
     },
+    {
+      "description": "Detects changes to the registry value \"PythonFunctionWarnings\" that would prevent any warnings or alerts from showing when Python functions are about to be executed.\nThreat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.\n",
+      "meta": {
+        "author": "Nasreddine Bencherchali (Nextron Systems), @Kostastsale",
+        "creation_date": "2024-08-23",
+        "falsepositive": [
+          "Unknown"
+        ],
+        "filename": "registry_set_office_disable_python_security_warnings.yml",
+        "level": "high",
+        "logsource.category": "registry_set",
+        "logsource.product": "windows",
+        "refs": [
+          "https://support.microsoft.com/en-us/office/data-security-and-python-in-excel-33cc88a4-4a87-485e-9ff9-f35958278327",
+          "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_office_disable_python_security_warnings.yml"
+        ],
+        "tags": [
+          "attack.defense-evasion",
+          "attack.t1562.001"
+        ]
+      },
+      "related": [
+        {
+          "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "related-to"
+        }
+      ],
+      "uuid": "17e53739-a1fc-4a62-b1b9-87711c2d5e44",
+      "value": "Python Function Execution Security Warning Disabled In Excel - Registry"
+    },
     {
       "description": "Detects potential abuse of the provisioning registry key for indirect command execution through \"Provlaunch.exe\".",
       "meta": {
@@ -5937,8 +6027,8 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/",
           "https://twitter.com/0gtweet/status/1674399582162153472",
+          "https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_provisioning_command_abuse.yml"
         ],
         "tags": [
@@ -6005,8 +6095,8 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://www.hexacorn.com/blog/2019/09/20/beyond-good-ol-run-key-part-116/",
           "https://persistence-info.github.io/Data/wer_debugger.html",
+          "https://www.hexacorn.com/blog/2019/09/20/beyond-good-ol-run-key-part-116/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_hangs_debugger_persistence.yml"
         ],
         "tags": [
@@ -6104,8 +6194,8 @@
         "logsource.category": "registry_set",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-4---add-domain-to-trusted-sites-zone",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-5---javascript-in-registry",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-4---add-domain-to-trusted-sites-zone",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_persistence_ie.yml"
         ],
         "tags": [
@@ -6270,9 +6360,9 @@
         "logsource.category": "registry_delete",
         "logsource.product": "windows",
         "refs": [
+          "http://woshub.com/how-to-clear-rdp-connections-history/",
           "https://learn.microsoft.com/en-us/troubleshoot/windows-server/remote/remove-entries-from-remote-desktop-connection-computer",
           "https://www.trendmicro.com/en_us/research/23/a/vice-society-ransomware-group-targets-manufacturing-companies.html",
-          "http://woshub.com/how-to-clear-rdp-connections-history/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_delete/registry_delete_mstsc_history_cleared.yml"
         ],
         "tags": [
@@ -6313,10 +6403,10 @@
         "logsource.category": "registry_delete",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.C.1_22A46621-7A92-48C1-81BF-B3937EB4FDC3.md",
-          "https://learn.microsoft.com/en-us/windows/win32/api/shobjidl_core/nn-shobjidl_core-iexecutecommand",
           "https://github.com/OTRF/detection-hackathon-apt29/issues/7",
           "https://learn.microsoft.com/en-us/windows/win32/shell/launch",
+          "https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.C.1_22A46621-7A92-48C1-81BF-B3937EB4FDC3.md",
+          "https://learn.microsoft.com/en-us/windows/win32/api/shobjidl_core/nn-shobjidl_core-iexecutecommand",
           "https://learn.microsoft.com/en-us/windows/win32/shell/shell-and-managed-code",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_delete/registry_delete_removal_com_hijacking_registry_key.yml"
         ],
@@ -6350,8 +6440,8 @@
         "logsource.category": "registry_delete",
         "logsource.product": "windows",
         "refs": [
-          "https://seclists.org/fulldisclosure/2020/Mar/45",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md",
+          "https://seclists.org/fulldisclosure/2020/Mar/45",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_delete/registry_delete_removal_amsi_registry_key.yml"
         ],
         "tags": [
@@ -6495,9 +6585,9 @@
         "logsource.category": "registry_event",
         "logsource.product": "windows",
         "refs": [
-          "https://www.dfirnotes.net/portproxy_detection/",
-          "https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html",
           "https://adepts.of0x.cc/netsh-portproxy-code/",
+          "https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html",
+          "https://www.dfirnotes.net/portproxy_detection/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_event/registry_event_portproxy_registry_key.yml"
         ],
         "tags": [
@@ -6566,9 +6656,9 @@
         "logsource.category": "registry_event",
         "logsource.product": "windows",
         "refs": [
-          "https://outflank.nl/blog/2018/01/16/hunting-for-evil-detect-macros-being-executed/",
           "https://twitter.com/inversecos/status/1494174785621819397",
           "http://az4n6.blogspot.com/2016/02/more-on-trust-records-macros-and.html",
+          "https://outflank.nl/blog/2018/01/16/hunting-for-evil-detect-macros-being-executed/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_event/registry_event_office_trust_record_modification.yml"
         ],
         "tags": [
@@ -6601,11 +6691,11 @@
         "logsource.category": "registry_event",
         "logsource.product": "windows",
         "refs": [
+          "https://www.lexjansen.com/sesug/1993/SESUG93035.pdf",
+          "https://nvd.nist.gov/vuln/detail/cve-2021-34527",
           "https://github.com/gentilkiwi/mimikatz/commit/c21276072b3f2a47a21e215a46962a17d54b3760",
           "https://nvd.nist.gov/vuln/detail/cve-2021-1675",
           "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/4464eaf0-f34f-40d5-b970-736437a21913",
-          "https://www.lexjansen.com/sesug/1993/SESUG93035.pdf",
-          "https://nvd.nist.gov/vuln/detail/cve-2021-34527",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_event/registry_event_mimikatz_printernightmare.yml"
         ],
         "tags": [
@@ -6676,9 +6766,9 @@
         "logsource.product": "windows",
         "refs": [
           "https://github.com/hfiref0x/UACME",
-          "https://winscripting.blog/2017/05/12/first-entry-welcome-and-uac-bypass/",
-          "https://tria.ge/211119-gs7rtshcfr/behavioral2 [Lokibot sample from Nov 2021]",
           "https://github.com/RhinoSecurityLabs/Aggressor-Scripts/tree/master/UACBypass",
+          "https://tria.ge/211119-gs7rtshcfr/behavioral2 [Lokibot sample from Nov 2021]",
+          "https://winscripting.blog/2017/05/12/first-entry-welcome-and-uac-bypass/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_event/registry_event_shell_open_keys_manipulation.yml"
         ],
         "tags": [
@@ -6720,8 +6810,8 @@
         "logsource.category": "registry_event",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/pabraeken/status/990717080805789697",
           "https://lolbas-project.github.io/lolbas/Binaries/Runonce/",
+          "https://twitter.com/pabraeken/status/990717080805789697",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_event/registry_event_runonce_persistence.yml"
         ],
         "tags": [
@@ -7196,8 +7286,8 @@
         "logsource.category": "registry_event",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/data/module_source/persistence/Install-SSP.ps1#L157",
           "https://powersploit.readthedocs.io/en/latest/Persistence/Install-SSP/",
+          "https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/data/module_source/persistence/Install-SSP.ps1#L157",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_event/registry_event_ssp_added_lsa_config.yml"
         ],
         "tags": [
@@ -7475,8 +7565,8 @@
         "logsource.category": "registry_event",
         "logsource.product": "windows",
         "refs": [
-          "https://blog.xpnsec.com/exploring-mimikatz-part-1/",
           "https://twitter.com/SBousseaden/status/1183745981189427200",
+          "https://blog.xpnsec.com/exploring-mimikatz-part-1/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_event/registry_event_susp_lsass_dll_load.yml"
         ],
         "tags": [
@@ -7686,11 +7776,11 @@
         "logsource.category": "registry_add",
         "logsource.product": "windows",
         "refs": [
-          "https://www.fortinet.com/blog/threat-research/new-netwire-rat-variant-spread-by-phishing",
           "https://resources.infosecinstitute.com/topic/netwire-malware-what-it-is-how-it-works-and-how-to-prevent-it-malware-spotlight/",
-          "https://blogs.blackberry.com/en/2021/09/threat-thursday-netwire-rat-is-coming-down-the-line",
           "https://unit42.paloaltonetworks.com/guloader-installing-netwire-rat/",
+          "https://blogs.blackberry.com/en/2021/09/threat-thursday-netwire-rat-is-coming-down-the-line",
           "https://app.any.run/tasks/41ecdbde-4997-4301-a350-0270448b4c8f/",
+          "https://www.fortinet.com/blog/threat-research/new-netwire-rat-variant-spread-by-phishing",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_add/registry_add_malware_netwire.yml"
         ],
         "tags": [
@@ -7790,8 +7880,8 @@
         "logsource.category": "registry_add",
         "logsource.product": "windows",
         "refs": [
-          "https://persistence-info.github.io/Data/amsi.html",
           "https://github.com/gtworek/PSBits/blob/8d767892f3b17eefa4d0668f5d2df78e844f01d8/FakeAMSI/FakeAMSI.c",
+          "https://persistence-info.github.io/Data/amsi.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_add/registry_add_persistence_amsi_providers.yml"
         ],
         "tags": [
@@ -7814,8 +7904,8 @@
         "logsource.category": "registry_add",
         "logsource.product": "windows",
         "refs": [
-          "https://persistence-info.github.io/Data/diskcleanuphandler.html",
           "https://www.hexacorn.com/blog/2018/09/02/beyond-good-ol-run-key-part-86/",
+          "https://persistence-info.github.io/Data/diskcleanuphandler.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_add/registry_add_persistence_disk_cleanup_handler_entry.yml"
         ],
         "tags": [
@@ -8207,8 +8297,8 @@
         "logsource.category": "driver_load",
         "logsource.product": "windows",
         "refs": [
-          "https://rastamouse.me/ntlm-relaying-via-cobalt-strike/",
           "https://reqrypt.org/windivert-doc.html",
+          "https://rastamouse.me/ntlm-relaying-via-cobalt-strike/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/driver_load/driver_load_win_windivert.yml"
         ],
         "tags": [
@@ -8318,8 +8408,8 @@
         "logsource.category": "dns_query",
         "logsource.product": "windows",
         "refs": [
-          "https://www.sentinelone.com/labs/wip26-espionage-threat-actors-abuse-cloud-infrastructure-in-targeted-telco-attacks/",
           "https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/",
+          "https://www.sentinelone.com/labs/wip26-espionage-threat-actors-abuse-cloud-infrastructure-in-targeted-telco-attacks/",
           "https://symantec-enterprise-blogs.security.com/threat-intelligence/harvester-new-apt-attacks-asia",
           "https://intezer.com/blog/research/how-we-escaped-docker-in-azure-functions/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/dns_query/dns_query_win_domain_azurewebsites.yml"
@@ -8354,8 +8444,8 @@
         "logsource.category": "dns_query",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/notwhickey/status/1333900137232523264",
           "https://lolbas-project.github.io/lolbas/Binaries/AppInstaller/",
+          "https://twitter.com/notwhickey/status/1333900137232523264",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/dns_query/dns_query_win_appinstaller.yml"
         ],
         "tags": [
@@ -8388,8 +8478,8 @@
         "logsource.category": "dns_query",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/neonprimetime/status/1436376497980428318",
           "https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html",
+          "https://twitter.com/neonprimetime/status/1436376497980428318",
           "https://www.binarydefense.com/analysis-of-hancitor-when-boring-begets-beacon",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/dns_query/dns_query_win_susp_external_ip_lookup.yml"
         ],
@@ -8491,9 +8581,9 @@
         "logsource.category": "dns_query",
         "logsource.product": "windows",
         "refs": [
-          "https://blueteamops.medium.com/detecting-dev-tunnels-16f0994dc3e2",
-          "https://cydefops.com/devtunnels-unleashed",
           "https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security",
+          "https://cydefops.com/devtunnels-unleashed",
+          "https://blueteamops.medium.com/detecting-dev-tunnels-16f0994dc3e2",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/dns_query/dns_query_win_devtunnels_communication.yml"
         ],
         "tags": [
@@ -8691,9 +8781,9 @@
         "logsource.category": "dns_query",
         "logsource.product": "windows",
         "refs": [
+          "https://cydefops.com/vscode-data-exfiltration",
           "https://badoption.eu/blog/2023/01/31/code_c2.html",
           "https://ipfyx.fr/post/visual-studio-code-tunnel/",
-          "https://cydefops.com/vscode-data-exfiltration",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/dns_query/dns_query_win_vscode_tunnel_communication.yml"
         ],
         "tags": [
@@ -8727,8 +8817,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://malware.guide/browser-hijacker/remove-onelaunch-virus/",
-          "https://www.myantispyware.com/2020/12/14/how-to-uninstall-onelaunch-browser-removal-guide/",
           "https://www.malwarebytes.com/blog/detections/pup-optional-onelaunch-silentcf",
+          "https://www.myantispyware.com/2020/12/14/how-to-uninstall-onelaunch-browser-removal-guide/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/dns_query/dns_query_win_onelaunch_update_service.yml"
         ],
         "tags": [
@@ -8761,8 +8851,8 @@
         "logsource.category": "dns_query",
         "logsource.product": "windows",
         "refs": [
-          "https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/",
           "https://pentestlab.blog/2017/05/11/applocker-bypass-regsvr32/",
+          "https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/dns_query/dns_query_win_regsvr32_dns_query.yml"
         ],
         "tags": [
@@ -8804,11 +8894,11 @@
         "logsource.category": "dns_query",
         "logsource.product": "windows",
         "refs": [
-          "https://redcanary.com/blog/misbehaving-rats/",
-          "https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/hunting-for-omi-vulnerability-exploitation-with-azure-sentinel/ba-p/2764093",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-4---gotoassist-files-detected-test-on-windows",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-6---ammyy-admin-software-execution",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-3---logmein-files-detected-test-on-windows",
+          "https://redcanary.com/blog/misbehaving-rats/",
+          "https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/hunting-for-omi-vulnerability-exploitation-with-azure-sentinel/ba-p/2764093",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/dns_query/dns_query_win_remote_access_software_domains_non_browsers.yml"
         ],
         "tags": [
@@ -8841,18 +8931,18 @@
         "logsource.category": "pipe_created",
         "logsource.product": "windows",
         "refs": [
-          "https://www.us-cert.gov/ncas/alerts/TA17-117A",
           "https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/",
-          "https://thedfirreport.com/2020/06/21/snatch-ransomware/",
           "https://download.bitdefender.com/resources/files/News/CaseStudies/study/115/Bitdefender-Whitepaper-PAC-A4-en-EN1.pdf",
           "https://web.archive.org/web/20180725233601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf",
-          "https://github.com/RiccardoAncarani/LiquidSnake",
           "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html",
+          "https://www.us-cert.gov/ncas/alerts/TA17-117A",
+          "https://securelist.com/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/71275/",
           "https://us-cert.cisa.gov/ncas/analysis-reports/ar19-304a",
           "https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/",
-          "https://securelist.com/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/71275/",
-          "https://securelist.com/faq-the-projectsauron-apt/75533/",
           "https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity",
+          "https://github.com/RiccardoAncarani/LiquidSnake",
+          "https://thedfirreport.com/2020/06/21/snatch-ransomware/",
+          "https://securelist.com/faq-the-projectsauron-apt/75533/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/pipe_created/pipe_created_susp_malicious_namedpipes.yml"
         ],
         "tags": [
@@ -8887,8 +8977,8 @@
         "logsource.category": "pipe_created",
         "logsource.product": "windows",
         "refs": [
-          "https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752",
           "https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575",
+          "https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/pipe_created/pipe_created_hktl_cobaltstrike_susp_pipe_patterns.yml"
         ],
         "tags": [
@@ -8966,9 +9056,9 @@
         "logsource.category": "pipe_created",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/Azure/SimuLand",
-          "https://o365blog.com/post/adfs/",
           "https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/SecurityEvent/ADFSDBNamedPipeConnection.yaml",
+          "https://o365blog.com/post/adfs/",
+          "https://github.com/Azure/SimuLand",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/pipe_created/pipe_created_adfs_namedpipe_connection_uncommon_tool.yml"
         ],
         "tags": [
@@ -9001,8 +9091,8 @@
         "logsource.category": "pipe_created",
         "logsource.product": "windows",
         "refs": [
-          "https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752",
           "https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575",
+          "https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/pipe_created/pipe_created_hktl_cobaltstrike_re.yml"
         ],
         "tags": [
@@ -9113,8 +9203,8 @@
         "logsource.category": "pipe_created",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/hackvens/CoercedPotato",
           "https://blog.hackvens.fr/articles/CoercedPotato.html",
+          "https://github.com/hackvens/CoercedPotato",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/pipe_created/pipe_created_hktl_coercedpotato.yml"
         ],
         "tags": [
@@ -9148,8 +9238,8 @@
         "logsource.category": "pipe_created",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/SBousseaden/status/1429530155291193354?s=20",
           "https://github.com/zcgonvh/EfsPotato",
+          "https://twitter.com/SBousseaden/status/1429530155291193354?s=20",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/pipe_created/pipe_created_hktl_efspotato.yml"
         ],
         "tags": [
@@ -9249,9 +9339,9 @@
         "logsource.product": "windows",
         "refs": [
           "https://redcanary.com/threat-detection-report/threats/cobalt-strike/",
+          "https://twitter.com/d4rksystem/status/1357010969264873472",
           "https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/",
           "https://github.com/SigmaHQ/sigma/issues/253",
-          "https://twitter.com/d4rksystem/status/1357010969264873472",
           "https://labs.f-secure.com/blog/detecting-cobalt-strike-default-modules-via-named-pipe-analysis/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/pipe_created/pipe_created_hktl_cobaltstrike.yml"
         ],
@@ -9286,8 +9376,8 @@
         "logsource.category": "pipe_created",
         "logsource.product": "windows",
         "refs": [
-          "https://threathunterplaybook.com/hunts/windows/190410-LocalPwshExecution/notebook.html",
           "https://threathunterplaybook.com/hunts/windows/190610-PwshAlternateHosts/notebook.html",
+          "https://threathunterplaybook.com/hunts/windows/190410-LocalPwshExecution/notebook.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/pipe_created/pipe_created_powershell_alternate_host_pipe.yml"
         ],
         "tags": [
@@ -9320,8 +9410,8 @@
         "logsource.category": "pipe_created",
         "logsource.product": "windows",
         "refs": [
-          "https://www.jpcert.or.jp/english/pub/sr/ir_research.html",
           "https://jpcertcc.github.io/ToolAnalysisResultSheet",
+          "https://www.jpcert.or.jp/english/pub/sr/ir_research.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/pipe_created/pipe_created_sysinternals_psexec_default_pipe_susp_location.yml"
         ],
         "tags": [
@@ -9388,8 +9478,8 @@
         "logsource.category": "pipe_created",
         "logsource.product": "windows",
         "refs": [
-          "https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment",
           "https://image.slidesharecdn.com/zeronights2017kheirkhabarov-171118103000/75/hunting-for-credentials-dumping-in-windows-environment-57-2048.jpg?cb=1666035799",
+          "https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/pipe_created/pipe_created_hktl_generic_cred_dump_tools_pipes.yml"
         ],
         "tags": [
@@ -9446,8 +9536,8 @@
         "logsource.category": "pipe_created",
         "logsource.product": "windows",
         "refs": [
-          "https://threathunterplaybook.com/hunts/windows/190410-LocalPwshExecution/notebook.html",
           "https://threathunterplaybook.com/hunts/windows/190610-PwshAlternateHosts/notebook.html",
+          "https://threathunterplaybook.com/hunts/windows/190410-LocalPwshExecution/notebook.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/pipe_created/pipe_created_powershell_execution_pipe.yml"
         ],
         "tags": [
@@ -9594,8 +9684,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon",
           "https://medium.com/@olafhartong/sysmon-15-0-file-executable-detected-40fd64349f36",
+          "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/sysmon/sysmon_file_executable_detected.yml"
         ],
         "tags": [
@@ -9676,9 +9766,9 @@
         "logsource.category": "create_remote_thread",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/GhostPack/KeeThief",
           "https://github.com/denandz/KeeFarce",
           "https://www.cisa.gov/uscert/ncas/alerts/aa20-259a",
+          "https://github.com/GhostPack/KeeThief",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/create_remote_thread/create_remote_thread_win_keepass.yml"
         ],
         "tags": [
@@ -9787,8 +9877,8 @@
         "logsource.category": "create_remote_thread",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/SBousseaden/status/1090588499517079552",
           "https://github.com/mdsecactivebreach/CACTUSTORCH",
+          "https://twitter.com/SBousseaden/status/1090588499517079552",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/create_remote_thread/create_remote_thread_win_hktl_cactustorch.yml"
         ],
         "tags": [
@@ -9846,8 +9936,8 @@
         "logsource.category": "create_remote_thread",
         "logsource.product": "windows",
         "refs": [
-          "https://medium.com/@olafhartong/cobalt-strike-remote-threads-detection-206372d11d0f",
           "https://blog.cobaltstrike.com/2018/04/09/cobalt-strike-3-11-the-snake-that-eats-its-tail/",
+          "https://medium.com/@olafhartong/cobalt-strike-remote-threads-detection-206372d11d0f",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/create_remote_thread/create_remote_thread_win_hktl_cobaltstrike.yml"
         ],
         "tags": [
@@ -10681,8 +10771,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://www.microsoft.com/security/blog/2022/09/30/analyzing-attacks-using-the-exchange-vulnerabilities-cve-2022-41040-and-cve-2022-41082/",
-          "https://en.gteltsc.vn/blog/cap-nhat-nhe-ve-lo-hong-bao-mat-0day-microsoft-exchange-dang-duoc-su-dung-de-tan-cong-cac-to-chuc-tai-viet-nam-9685.html",
           "https://www.gteltsc.vn/blog/canh-bao-chien-dich-tan-cong-su-dung-lo-hong-zero-day-tren-microsoft-exchange-server-12714.html",
+          "https://en.gteltsc.vn/blog/cap-nhat-nhe-ve-lo-hong-bao-mat-0day-microsoft-exchange-dang-duoc-su-dung-de-tan-cong-cac-to-chuc-tai-viet-nam-9685.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_exchange_webshell_drop.yml"
         ],
         "tags": [
@@ -10715,9 +10805,9 @@
         "logsource.category": "file_event",
         "logsource.product": "windows",
         "refs": [
-          "https://en.wikipedia.org/wiki/IExpress",
-          "https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior",
           "https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html",
+          "https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior",
+          "https://en.wikipedia.org/wiki/IExpress",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_sed_file_creation.yml"
         ],
         "tags": [
@@ -10901,9 +10991,9 @@
         "refs": [
           "https://labs.f-secure.com/blog/prelude-to-ransomware-systembc",
           "https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html",
-          "https://assets.documentcloud.org/documents/20444693/fbi-pin-egregor-ransomware-bc-01062021.pdf",
           "https://thedfirreport.com/2021/01/18/all-that-for-a-coinminer",
           "https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/",
+          "https://assets.documentcloud.org/documents/20444693/fbi-pin-egregor-ransomware-bc-01062021.pdf",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_advanced_ip_scanner.yml"
         ],
         "tags": [
@@ -11051,8 +11141,8 @@
         "logsource.category": "file_event",
         "logsource.product": "windows",
         "refs": [
-          "https://posts.slayerlabs.com/living-off-the-land/#gathernetworkinfovbs",
           "https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government",
+          "https://posts.slayerlabs.com/living-off-the-land/#gathernetworkinfovbs",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_lolbin_gather_network_info_script_output.yml"
         ],
         "tags": [
@@ -11243,8 +11333,8 @@
         "logsource.category": "file_event",
         "logsource.product": "windows",
         "refs": [
-          "https://insight-jp.nttsecurity.com/post/102hojk/operation-restylink-apt-campaign-targeting-japanese-companies",
           "https://learn.microsoft.com/en-us/office/troubleshoot/excel/use-startup-folders",
+          "https://insight-jp.nttsecurity.com/post/102hojk/operation-restylink-apt-campaign-targeting-japanese-companies",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_office_startup_persistence.yml"
         ],
         "tags": [
@@ -11277,10 +11367,10 @@
         "logsource.category": "file_event",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/Yaxser/Backstab",
+          "https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/",
           "https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer",
           "https://www.elastic.co/security-labs/stopping-vulnerable-driver-attacks",
-          "https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/",
+          "https://github.com/Yaxser/Backstab",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_sysinternals_procexp_driver_susp_creation.yml"
         ],
         "tags": [
@@ -11414,8 +11504,8 @@
         "logsource.category": "file_event",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/OTRF/detection-hackathon-apt29/issues/12",
           "https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/5.B.1_611FCA99-97D0-4873-9E51-1C1BA2DBB40D.md",
+          "https://github.com/OTRF/detection-hackathon-apt29/issues/12",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_startup_folder_file_write.yml"
         ],
         "tags": [
@@ -11448,8 +11538,8 @@
         "logsource.category": "file_event",
         "logsource.product": "windows",
         "refs": [
-          "https://www.jpcert.or.jp/english/pub/sr/ir_research.html",
           "https://jpcertcc.github.io/ToolAnalysisResultSheet",
+          "https://www.jpcert.or.jp/english/pub/sr/ir_research.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_sysinternals_psexec_service.yml"
         ],
         "tags": [
@@ -11542,10 +11632,10 @@
         "logsource.category": "file_event",
         "logsource.product": "windows",
         "refs": [
-          "https://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html",
-          "https://github.com/olafhartong/sysmon-modular/blob/fa1ae53132403d262be2bbd7f17ceea7e15e8c78/11_file_create/include_dotnet.xml",
           "https://bohops.com/2021/03/16/investigating-net-clr-usage-log-tampering-techniques-for-edr-evasion/",
+          "https://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html",
           "https://web.archive.org/web/20221026202428/https://gist.github.com/code-scrap/d7f152ffcdb3e0b02f7f394f5187f008",
+          "https://github.com/olafhartong/sysmon-modular/blob/fa1ae53132403d262be2bbd7f17ceea7e15e8c78/11_file_create/include_dotnet.xml",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_net_cli_artefact.yml"
         ],
         "tags": [
@@ -11667,8 +11757,8 @@
         "logsource.category": "file_event",
         "logsource.product": "windows",
         "refs": [
-          "https://grzegorztworek.medium.com/using-uefi-to-inject-executable-files-into-bitlocker-protected-drives-8ff4ca59c94c",
           "https://persistence-info.github.io/Data/wpbbin.html",
+          "https://grzegorztworek.medium.com/using-uefi-to-inject-executable-files-into-bitlocker-protected-drives-8ff4ca59c94c",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_wpbbin_persistence.yml"
         ],
         "tags": [
@@ -11749,8 +11839,8 @@
         "logsource.category": "file_event",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/rbmaslen/status/1321859647091970051",
           "https://twitter.com/tifkin_/status/1321916444557365248",
+          "https://twitter.com/rbmaslen/status/1321859647091970051",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_pcre_net_temp_file.yml"
         ],
         "tags": [
@@ -12040,8 +12130,8 @@
         "logsource.category": "file_event",
         "logsource.product": "windows",
         "refs": [
-          "https://adsecurity.org/?p=2398",
           "https://stealthbits.com/blog/extracting-password-hashes-from-the-ntds-dit-file/",
+          "https://adsecurity.org/?p=2398",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_ntds_dit_uncommon_process.yml"
         ],
         "tags": [
@@ -12338,10 +12428,10 @@
         "logsource.category": "file_event",
         "logsource.product": "windows",
         "refs": [
-          "https://answers.microsoft.com/en-us/msoffice/forum/all/document-in-word-startup-folder-doesnt-open-when/44ab0932-2917-4150-8cdc-2f2cf39e86f3",
-          "https://en.wikipedia.org/wiki/List_of_Microsoft_Office_filename_extensions",
           "http://addbalance.com/word/startup.htm",
+          "https://answers.microsoft.com/en-us/msoffice/forum/all/document-in-word-startup-folder-doesnt-open-when/44ab0932-2917-4150-8cdc-2f2cf39e86f3",
           "https://app.any.run/tasks/d6fe6624-6ef8-485d-aa75-3d1bdda2a08c/",
+          "https://en.wikipedia.org/wiki/List_of_Microsoft_Office_filename_extensions",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_office_uncommon_file_startup.yml"
         ],
         "tags": [
@@ -12374,8 +12464,8 @@
         "logsource.category": "file_event",
         "logsource.product": "windows",
         "refs": [
-          "https://www.dsinternals.com/en/dpapi-backup-key-theft-auditing/",
           "https://github.com/MichaelGrafnetter/DSInternals/blob/39ee8a69bbdc1cfd12c9afdd7513b4788c4895d4/Src/DSInternals.Common/Data/DPAPI/DPAPIBackupKey.cs#L28-L32",
+          "https://www.dsinternals.com/en/dpapi-backup-key-theft-auditing/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_susp_dpapi_backup_and_cert_export_ioc.yml"
         ],
         "tags": [
@@ -12415,8 +12505,8 @@
         "logsource.category": "file_event",
         "logsource.product": "windows",
         "refs": [
-          "https://cobalt.io/blog/kerberoast-attack-techniques",
           "https://pentestlab.blog/2019/10/21/persistence-security-support-provider/",
+          "https://cobalt.io/blog/kerberoast-attack-techniques",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_hktl_mimikatz_files.yml"
         ],
         "tags": [
@@ -12473,26 +12563,26 @@
         "logsource.category": "file_event",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/DarkCoderSc/PowerRunAsSystem/",
-          "https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/",
-          "https://github.com/Kevin-Robertson/Powermad",
           "https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1",
-          "https://github.com/AlsidOfficial/WSUSpendu/",
           "https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1",
-          "https://github.com/besimorhino/powercat",
           "https://github.com/adrecon/ADRecon",
+          "https://github.com/DarkCoderSc/PowerRunAsSystem/",
+          "https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1",
+          "https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/",
+          "https://github.com/HarmJ0y/DAMP",
+          "https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries",
           "https://github.com/CsEnox/EventViewer-UACBypass",
           "https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1",
-          "https://github.com/samratashok/nishang",
-          "https://github.com/NetSPI/PowerUpSQL",
-          "https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1",
-          "https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries",
-          "https://github.com/nettitude/Invoke-PowerThIEf",
-          "https://github.com/S3cur3Th1sSh1t/WinPwn",
-          "https://github.com/HarmJ0y/DAMP",
-          "https://github.com/adrecon/AzureADRecon",
-          "https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/",
           "https://github.com/PowerShellMafia/PowerSploit",
+          "https://github.com/adrecon/AzureADRecon",
+          "https://github.com/NetSPI/PowerUpSQL",
+          "https://github.com/besimorhino/powercat",
+          "https://github.com/AlsidOfficial/WSUSpendu/",
+          "https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/",
+          "https://github.com/nettitude/Invoke-PowerThIEf",
+          "https://github.com/samratashok/nishang",
+          "https://github.com/Kevin-Robertson/Powermad",
+          "https://github.com/S3cur3Th1sSh1t/WinPwn",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_powershell_exploit_scripts.yml"
         ],
         "tags": [
@@ -12591,8 +12681,8 @@
         "logsource.category": "file_event",
         "logsource.product": "windows",
         "refs": [
-          "https://aboutdfir.com/the-key-to-identify-psexec/",
           "https://twitter.com/davisrichardg/status/1616518800584704028",
+          "https://aboutdfir.com/the-key-to-identify-psexec/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_sysinternals_psexec_service_key.yml"
         ],
         "tags": [
@@ -12646,11 +12736,11 @@
         "logsource.product": "windows",
         "refs": [
           "https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/windows/credential_access_lsass_memdump_file_created.toml",
+          "https://www.google.com/search?q=procdump+lsass",
+          "https://medium.com/@markmotig/some-ways-to-dump-lsass-exe-c4a75fdc49bf",
+          "https://www.whiteoaksecurity.com/blog/attacks-defenses-dumping-lsass-no-mimikatz/",
           "https://github.com/helpsystems/nanodump",
           "https://github.com/CCob/MirrorDump",
-          "https://www.google.com/search?q=procdump+lsass",
-          "https://www.whiteoaksecurity.com/blog/attacks-defenses-dumping-lsass-no-mimikatz/",
-          "https://medium.com/@markmotig/some-ways-to-dump-lsass-exe-c4a75fdc49bf",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_lsass_default_dump_file_names.yml"
         ],
         "tags": [
@@ -12751,10 +12841,10 @@
         "logsource.category": "file_event",
         "logsource.product": "windows",
         "refs": [
-          "https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/malicious-spam-campaign-uses-iso-image-files-to-deliver-lokibot-and-nanocore",
-          "https://insights.sei.cmu.edu/blog/the-dangers-of-vhd-and-vhdx-files/",
           "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/",
+          "https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/malicious-spam-campaign-uses-iso-image-files-to-deliver-lokibot-and-nanocore",
           "https://blog.emsisoft.com/en/32373/beware-new-wave-of-malware-spreads-via-iso-file-email-attachments/",
+          "https://insights.sei.cmu.edu/blog/the-dangers-of-vhd-and-vhdx-files/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_iso_file_recent.yml"
         ],
         "tags": [
@@ -13009,8 +13099,8 @@
         "logsource.category": "file_event",
         "logsource.product": "windows",
         "refs": [
-          "PT ESC rule and personal experience",
           "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/c95a0a1a2855dc0cd7f7327614545fe30482a636/Upload%20Insecure%20Files/README.md",
+          "PT ESC rule and personal experience",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_webshell_creation_detect.yml"
         ],
         "tags": [
@@ -13043,9 +13133,9 @@
         "logsource.category": "file_event",
         "logsource.product": "windows",
         "refs": [
+          "https://twitter.com/orange_8361/status/1518970259868626944?s=20&t=RFXqZjtA7tWM3HxqEH78Aw",
           "https://twitter.com/splinter_code/status/1519075134296006662?s=12&t=DLUXH86WtcmG_AZ5gY3C6g",
           "https://lolbas-project.github.io/lolbas/Binaries/Eventvwr/#execute",
-          "https://twitter.com/orange_8361/status/1518970259868626944?s=20&t=RFXqZjtA7tWM3HxqEH78Aw",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_uac_bypass_eventvwr.yml"
         ],
         "tags": [
@@ -13136,8 +13226,8 @@
         "logsource.category": "file_event",
         "logsource.product": "windows",
         "refs": [
-          "https://persistence-info.github.io/Data/powershellprofile.html",
           "https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/",
+          "https://persistence-info.github.io/Data/powershellprofile.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_susp_powershell_profile.yml"
         ],
         "tags": [
@@ -13173,8 +13263,8 @@
         "refs": [
           "https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=79",
           "https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=76",
-          "https://learn.microsoft.com/en-us/office/vba/outlook/concepts/outlook-forms/create-an-outlook-form",
           "https://www.slipstick.com/developer/custom-form/clean-outlooks-forms-cache/",
+          "https://learn.microsoft.com/en-us/office/vba/outlook/concepts/outlook-forms/create-an-outlook-form",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_office_outlook_newform.yml"
         ],
         "tags": [
@@ -13307,8 +13397,8 @@
         "logsource.category": "file_event",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/OTRF/detection-hackathon-apt29/issues/14",
           "https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/6.B.1_6392C9F1-D975-4F75-8A70-433DEDD7F622.md",
+          "https://github.com/OTRF/detection-hackathon-apt29/issues/14",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_susp_pfx_file_creation.yml"
         ],
         "tags": [
@@ -13538,10 +13628,10 @@
         "logsource.category": "file_event",
         "logsource.product": "windows",
         "refs": [
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.011/T1546.011.md#atomic-test-2---new-shim-database-files-created-in-the-default-shim-database-directory",
           "https://www.mandiant.com/resources/blog/fin7-shim-databases-persistence",
           "https://liberty-shell.com/sec/2020/02/25/shim-persistence/",
           "https://andreafortuna.org/2018/11/12/process-injection-and-persistence-using-application-shimming/",
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.011/T1546.011.md#atomic-test-2---new-shim-database-files-created-in-the-default-shim-database-directory",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_creation_new_shim_database.yml"
         ],
         "tags": [
@@ -13707,8 +13797,8 @@
         "logsource.category": "file_event",
         "logsource.product": "windows",
         "refs": [
-          "https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/",
           "https://github.com/Kevin-Robertson/Inveigh/blob/29d9e3c3a625b3033cdaf4683efaafadcecb9007/Inveigh/Support/Output.cs",
+          "https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/",
           "https://github.com/Kevin-Robertson/Inveigh/blob/29d9e3c3a625b3033cdaf4683efaafadcecb9007/Inveigh/Support/Control.cs",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_hktl_inveigh_artefacts.yml"
         ],
@@ -13775,8 +13865,8 @@
         "logsource.category": "file_event",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/last-byte/PersistenceSniper",
           "https://www.hexacorn.com/blog/2022/01/16/beyond-good-ol-run-key-part-135/",
+          "https://github.com/last-byte/PersistenceSniper",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_errorhandler_persistence.yml"
         ],
         "tags": [
@@ -13799,11 +13889,11 @@
         "logsource.category": "file_event",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/malwrhunterteam/status/1235135745611960321",
-          "https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations",
           "https://www.cybereason.com/blog/research/a-bazar-of-tricks-following-team9s-development-cycles",
-          "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/",
+          "https://twitter.com/malwrhunterteam/status/1235135745611960321",
           "https://twitter.com/luc4m/status/1073181154126254080",
+          "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/",
+          "https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_susp_lnk_double_extension.yml"
         ],
         "tags": [
@@ -13836,10 +13926,10 @@
         "logsource.category": "file_event",
         "logsource.product": "windows",
         "refs": [
+          "https://pentestlab.blog/tag/ntds-dit/",
           "https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Gather/Copy-VSS.ps1",
           "https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/",
           "https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration",
-          "https://pentestlab.blog/tag/ntds-dit/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_ntds_dit_uncommon_parent_process.yml"
         ],
         "tags": [
@@ -13981,8 +14071,8 @@
         "logsource.category": "file_event",
         "logsource.product": "windows",
         "refs": [
-          "https://asec.ahnlab.com/en/58878/",
           "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/honeypot-recon-mysql-malware-infection-via-user-defined-functions-udf/",
+          "https://asec.ahnlab.com/en/58878/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_mysqld_uncommon_file_creation.yml"
         ],
         "tags": [
@@ -14043,8 +14133,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=53",
-          "https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/",
           "https://www.linkedin.com/pulse/outlook-backdoor-using-vba-samir-b-/",
+          "https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_office_outlook_susp_macro_creation.yml"
         ],
         "tags": [
@@ -14221,9 +14311,9 @@
         "logsource.category": "file_event",
         "logsource.product": "windows",
         "refs": [
+          "https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image",
           "https://securityaffairs.co/wordpress/133680/malware/dll-sideloading-spread-qakbot.html",
           "https://twitter.com/Sam0x90/status/1552011547974696960",
-          "https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_iso_file_mount.yml"
         ],
         "tags": [
@@ -14280,8 +14370,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://www.microsoft.com/security/blog/2022/09/30/analyzing-attacks-using-the-exchange-vulnerabilities-cve-2022-41040-and-cve-2022-41082/",
-          "https://en.gteltsc.vn/blog/cap-nhat-nhe-ve-lo-hong-bao-mat-0day-microsoft-exchange-dang-duoc-su-dung-de-tan-cong-cac-to-chuc-tai-viet-nam-9685.html",
           "https://www.gteltsc.vn/blog/canh-bao-chien-dich-tan-cong-su-dung-lo-hong-zero-day-tren-microsoft-exchange-server-12714.html",
+          "https://en.gteltsc.vn/blog/cap-nhat-nhe-ve-lo-hong-bao-mat-0day-microsoft-exchange-dang-duoc-su-dung-de-tan-cong-cac-to-chuc-tai-viet-nam-9685.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_exchange_webshell_drop_suspicious.yml"
         ],
         "tags": [
@@ -14381,9 +14471,9 @@
         "logsource.category": "file_event",
         "logsource.product": "windows",
         "refs": [
+          "https://github.com/fox-it/LDAPFragger",
           "https://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes/",
           "https://medium.com/@ivecodoe/detecting-ldapfragger-a-newly-released-cobalt-strike-beacon-using-ldap-for-c2-communication-c274a7f00961",
-          "https://github.com/fox-it/LDAPFragger",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_adsi_cache_creation_by_uncommon_tool.yml"
         ],
         "tags": [
@@ -14476,11 +14566,11 @@
         "logsource.category": "file_event",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/pfiatde/status/1681977680688738305",
           "https://soroush.me/blog/2010/12/a-dotty-salty-directory-a-secret-place-in-ntfs-for-secret-files/",
-          "https://github.com/redcanaryco/atomic-red-team/blob/5c3b23002d2bbede3c07e7307165fc2a235a427d/atomics/T1564.004/T1564.004.md#atomic-test-5---create-hidden-directory-via-index_allocation",
           "https://sec-consult.com/blog/detail/pentesters-windows-ntfs-tricks-collection/",
           "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/c54dec26-1551-4d3a-a0ea-4fa40f848eb3",
+          "https://twitter.com/pfiatde/status/1681977680688738305",
+          "https://github.com/redcanaryco/atomic-red-team/blob/5c3b23002d2bbede3c07e7307165fc2a235a427d/atomics/T1564.004/T1564.004.md#atomic-test-5---create-hidden-directory-via-index_allocation",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_susp_hidden_dir_index_allocation.yml"
         ],
         "tags": [
@@ -14513,8 +14603,8 @@
         "logsource.category": "file_event",
         "logsource.product": "windows",
         "refs": [
-          "https://www.joesandbox.com/analysis/465533/0/html",
           "https://blog.malwarebytes.com/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/",
+          "https://www.joesandbox.com/analysis/465533/0/html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_susp_get_variable.yml"
         ],
         "tags": [
@@ -14597,11 +14687,11 @@
         "logsource.category": "file_event",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/malwrhunterteam/status/1235135745611960321",
-          "https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations",
           "https://www.cybereason.com/blog/research/a-bazar-of-tricks-following-team9s-development-cycles",
-          "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/",
+          "https://twitter.com/malwrhunterteam/status/1235135745611960321",
           "https://twitter.com/luc4m/status/1073181154126254080",
+          "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/",
+          "https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_susp_double_extension.yml"
         ],
         "tags": [
@@ -14634,8 +14724,8 @@
         "logsource.category": "file_event",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-5d46dd4ac6866b4337ec126be8cee0e115467b3e8703794ba6f6df6432c806bc",
           "https://posts.specterops.io/automating-dll-hijack-discovery-81c4295904b0",
+          "https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-5d46dd4ac6866b4337ec126be8cee0e115467b3e8703794ba6f6df6432c806bc",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_initial_access_dll_search_order_hijacking.yml"
         ],
         "tags": [
@@ -14694,12 +14784,12 @@
         "logsource.category": "file_event",
         "logsource.product": "windows",
         "refs": [
-          "https://labs.withsecure.com/publications/detecting-onenote-abuse",
-          "https://www.bleepingcomputer.com/news/security/hackers-now-use-microsoft-onenote-attachments-to-spread-malware/",
+          "https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/",
           "https://twitter.com/MaD_c4t/status/1623414582382567424",
           "https://www.trustedsec.com/blog/new-attacks-old-tricks-how-onenote-malware-is-evolving/",
           "https://app.any.run/tasks/17f2d378-6d11-4d6f-8340-954b04f35e83/",
-          "https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/",
+          "https://www.bleepingcomputer.com/news/security/hackers-now-use-microsoft-onenote-attachments-to-spread-malware/",
+          "https://labs.withsecure.com/publications/detecting-onenote-abuse",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_office_onenote_susp_dropped_files.yml"
         ],
         "tags": [
@@ -15047,12 +15137,12 @@
         "logsource.category": "file_event",
         "logsource.product": "windows",
         "refs": [
-          "https://clement.notin.org/blog/2020/09/12/CVE-2020-7315-McAfee-Agent-DLL-injection/",
           "https://github.com/blackarrowsec/redteam-research/tree/26e6fc0c0d30d364758fa11c2922064a9a7fd309/LPE%20via%20StorSvc",
-          "https://decoded.avast.io/martinchlumecky/png-steganography/",
           "https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992",
-          "https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/",
+          "https://decoded.avast.io/martinchlumecky/png-steganography/",
+          "https://clement.notin.org/blog/2020/09/12/CVE-2020-7315-McAfee-Agent-DLL-injection/",
           "https://github.com/Wh04m1001/SysmonEoP",
+          "https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_create_non_existent_dlls.yml"
         ],
         "tags": [
@@ -15095,8 +15185,8 @@
         "logsource.category": "file_event",
         "logsource.product": "windows",
         "refs": [
-          "Internal Research",
           "https://labs.withsecure.com/publications/fin7-target-veeam-servers",
+          "Internal Research",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_perflogs_susp_files.yml"
         ],
         "tags": [
@@ -15162,9 +15252,9 @@
         "logsource.category": "file_event",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/data/post/powershell/NTDSgrab.ps1",
-          "https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/modules/post/windows/gather/ntds_grabber.rb",
           "https://github.com/SecureAuthCorp/impacket/blob/7d2991d78836b376452ca58b3d14daa61b67cb40/impacket/examples/secretsdump.py#L2405",
+          "https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/modules/post/windows/gather/ntds_grabber.rb",
+          "https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/data/post/powershell/NTDSgrab.ps1",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_ntds_exfil_tools.yml"
         ],
         "tags": [
@@ -15197,11 +15287,11 @@
         "logsource.category": "file_event",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/HuskyHacks/ShadowSteal",
           "https://github.com/search?q=CVE-2021-36934",
-          "https://github.com/FireFart/hivenightmare",
-          "https://www.google.com/search?q=%22reg.exe+save%22+sam",
+          "https://github.com/HuskyHacks/ShadowSteal",
           "https://github.com/cube0x0/CVE-2021-36934",
+          "https://www.google.com/search?q=%22reg.exe+save%22+sam",
+          "https://github.com/FireFart/hivenightmare",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_sam_dump.yml"
         ],
         "tags": [
@@ -15302,8 +15392,8 @@
         "logsource.category": "file_access",
         "logsource.product": "windows",
         "refs": [
-          "https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/",
           "https://hunter2.gitbook.io/darthsidious/privilege-escalation/mimikatz",
+          "https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_access/file_access_win_susp_credential_manager_access.yml"
         ],
         "tags": [
@@ -15405,8 +15495,8 @@
         "logsource.category": "file_access",
         "logsource.product": "windows",
         "refs": [
-          "https://www.vectra.ai/blog/undermining-microsoft-teams-security-by-mining-tokens",
           "https://www.bleepingcomputer.com/news/security/microsoft-teams-stores-auth-tokens-as-cleartext-in-windows-linux-macs/",
+          "https://www.vectra.ai/blog/undermining-microsoft-teams-security-by-mining-tokens",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_access/file_access_win_teams_sensitive_files.yml"
         ],
         "tags": [
@@ -15439,8 +15529,8 @@
         "logsource.category": "file_access",
         "logsource.product": "windows",
         "refs": [
-          "https://tools.thehacker.recipes/mimikatz/modules/dpapi/credhist",
           "https://www.passcape.com/windows_password_recovery_dpapi_credhist",
+          "https://tools.thehacker.recipes/mimikatz/modules/dpapi/credhist",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_access/file_access_win_susp_credhist.yml"
         ],
         "tags": [
@@ -15673,8 +15763,8 @@
         "logsource.category": "file_delete",
         "logsource.product": "windows",
         "refs": [
-          "Internal Research",
           "https://securityliterate.com/how-malware-abuses-the-zone-identifier-to-circumvent-detection-and-analysis/",
+          "Internal Research",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_delete/file_delete_win_zone_identifier_ads_uncommon.yml"
         ],
         "tags": [
@@ -15878,8 +15968,8 @@
         "logsource.category": "file_delete",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/4.B.4_83D62033-105A-4A02-8B75-DAB52D8D51EC.md",
           "https://github.com/OTRF/detection-hackathon-apt29/issues/9",
+          "https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/4.B.4_83D62033-105A-4A02-8B75-DAB52D8D51EC.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_delete/file_delete_win_sysinternals_sdelete_file_deletion.yml"
         ],
         "tags": [
@@ -15945,9 +16035,9 @@
         "logsource.category": "file_executable_detected",
         "logsource.product": "windows",
         "refs": [
-          "https://en.wikipedia.org/wiki/IExpress",
-          "https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior",
           "https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html",
+          "https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior",
+          "https://en.wikipedia.org/wiki/IExpress",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_executable_detected/file_executable_detected_win_susp_embeded_sed_file.yml"
         ],
         "tags": [
@@ -16105,9 +16195,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2022-ps",
           "https://www.virustotal.com/gui/file/d609799091731d83d75ec5d1f030571af20c45efeeb94840b67ea09a3283ab65/behavior/C2AE",
           "https://www.virustotal.com/gui/search/content%253A%2522Set-MpPreference%2520-Disable%2522/files",
-          "https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2022-ps",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_defender_disable_feature.yml"
         ],
         "tags": [
@@ -16392,9 +16482,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://redcanary.com/threat-detection-report/threats/qbot/",
           "https://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compromise/",
           "https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/",
-          "https://redcanary.com/threat-detection-report/threats/qbot/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_esentutl_webcache.yml"
         ],
         "tags": [
@@ -16428,8 +16518,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://twitter.com/splinter_code/status/1483815103279603714",
-          "https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3",
           "https://www.elastic.co/security-labs/operation-bleeding-bear",
+          "https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3",
           "https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pua_advancedrun.yml"
         ],
@@ -16468,6 +16558,32 @@
       "uuid": "d2b749ee-4225-417e-b20e-a8d2193cbb84",
       "value": "PUA - AdvancedRun Execution"
     },
+    {
+      "description": "Detects the execution \"AccCheckConsole\" a command-line tool for verifying the accessibility implementation of an application's UI.\nOne of the tests that this checker can run are called \"verification routine\", which tests for things like Consistency, Navigation, etc.\nThe tool allows a user to provide a DLL that can contain a custom \"verification routine\". An attacker can build such DLLs and pass it via the CLI, which would then be loaded in the context of the \"AccCheckConsole\" utility.\n",
+      "meta": {
+        "author": "Florian Roth (Nextron Systems)",
+        "creation_date": "2022-01-06",
+        "falsepositive": [
+          "Legitimate use of the UI Accessibility Checker"
+        ],
+        "filename": "proc_creation_win_acccheckconsole_execution.yml",
+        "level": "medium",
+        "logsource.category": "process_creation",
+        "logsource.product": "windows",
+        "refs": [
+          "https://lolbas-project.github.io/lolbas/OtherMSBinaries/AccCheckConsole/",
+          "https://twitter.com/bohops/status/1477717351017680899?s=12",
+          "https://gist.github.com/bohops/2444129419c8acf837aedda5f0e7f340",
+          "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_acccheckconsole_execution.yml"
+        ],
+        "tags": [
+          "attack.execution",
+          "detection.threat-hunting"
+        ]
+      },
+      "uuid": "0f6da907-5854-4be6-859a-e9958747b0aa",
+      "value": "Potential DLL Injection Via AccCheckConsole"
+    },
     {
       "description": "Detects findstring commands that include the keyword lsass, which indicates recon actviity for the LSASS process PID",
       "meta": {
@@ -16548,8 +16664,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://twitter.com/_JohnHammond/status/1531672601067675648",
-          "https://twitter.com/nao_sec/status/1530196847679401984",
           "https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/",
+          "https://twitter.com/nao_sec/status/1530196847679401984",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_msdt_arbitrary_command_execution.yml"
         ],
         "tags": [
@@ -16615,9 +16731,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html",
-          "https://blog.harmj0y.net/redteaming/from-kekeo-to-rubeus",
           "https://github.com/GhostPack/Rubeus",
+          "https://blog.harmj0y.net/redteaming/from-kekeo-to-rubeus",
+          "https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_rubeus.yml"
         ],
         "tags": [
@@ -16667,12 +16783,12 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://nwgat.ninja/getting-system-information-with-wmic-on-windows/",
-          "https://github.com/redcanaryco/atomic-red-team/blob/a2ccd19c37d0278b4ffa8583add3cf52060a5418/atomics/T1082/T1082.md#atomic-test-25---system-information-discovery-with-wmic",
-          "https://blog.cyble.com/2023/01/18/aurora-a-stealer-using-shapeshifting-tactics/",
           "https://www.virustotal.com/gui/file/d6f6bc10ae0e634ed4301d584f61418cee18e5d58ad9af72f8aa552dc4aaeca3/behavior",
-          "https://app.any.run/tasks/a6aa0057-82ec-451f-8f99-55650ca537da/",
+          "https://nwgat.ninja/getting-system-information-with-wmic-on-windows/",
           "https://blog.sekoia.io/aurora-a-rising-stealer-flying-under-the-radar",
+          "https://app.any.run/tasks/a6aa0057-82ec-451f-8f99-55650ca537da/",
+          "https://blog.cyble.com/2023/01/18/aurora-a-stealer-using-shapeshifting-tactics/",
+          "https://github.com/redcanaryco/atomic-red-team/blob/a2ccd19c37d0278b4ffa8583add3cf52060a5418/atomics/T1082/T1082.md#atomic-test-25---system-information-discovery-with-wmic",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wmic_recon_system_info_uncommon.yml"
         ],
         "tags": [
@@ -16705,13 +16821,13 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://medium.com/@cyberjyot/lolbin-execution-via-diskshadow-f6ff681a27a4",
-          "https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/",
-          "https://www.lifars.com/wp-content/uploads/2022/01/GriefRansomware_Whitepaper-2.pdf",
           "https://research.checkpoint.com/2022/evilplayout-attack-against-irans-state-broadcaster/",
-          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow",
           "https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration",
+          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow",
           "https://www.zscaler.com/blogs/security-research/technical-analysis-crytox-ransomware",
+          "https://medium.com/@cyberjyot/lolbin-execution-via-diskshadow-f6ff681a27a4",
+          "https://www.lifars.com/wp-content/uploads/2022/01/GriefRansomware_Whitepaper-2.pdf",
+          "https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_diskshadow_script_mode_susp_ext.yml"
         ],
         "tags": [
@@ -16744,9 +16860,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "http://www.korznikov.com/2017/03/0-day-or-feature-privilege-escalation.html",
           "https://www.hackingarticles.in/rdp-session-hijacking-with-tscon/",
           "https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6",
-          "http://www.korznikov.com/2017/03/0-day-or-feature-privilege-escalation.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_tscon_rdp_redirect.yml"
         ],
         "tags": [
@@ -16788,8 +16904,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html",
           "https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/",
+          "http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_redirect_local_admin_share.yml"
         ],
         "tags": [
@@ -16823,9 +16939,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://ss64.com/bash/rar.html",
           "https://labs.sentinelone.com/the-anatomy-of-an-apt-attack-and-cobaltstrike-beacons-encoded-configuration/",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md",
-          "https://ss64.com/bash/rar.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_rar_compression_with_password.yml"
         ],
         "tags": [
@@ -16858,8 +16974,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.virustotal.com/gui/file/af1c82237b6e5a3a7cdbad82cc498d298c67845d92971bada450023d1335e267/content",
           "https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse?tabs=powershell",
+          "https://www.virustotal.com/gui/file/af1c82237b6e5a3a7cdbad82cc498d298c67845d92971bada450023d1335e267/content",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_add_windows_capability.yml"
         ],
         "tags": [
@@ -17117,10 +17233,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://en.wikipedia.org/wiki/IExpress",
-          "https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior",
           "https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html",
           "https://decoded.avast.io/janvojtesek/raspberry-robins-roshtyak-a-little-lesson-in-trickery/",
+          "https://en.wikipedia.org/wiki/IExpress",
+          "https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_iexpress_susp_execution.yml"
         ],
         "tags": [
@@ -17186,9 +17302,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chm-badness-delivers-a-banking-trojan/",
           "https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-27939090904026cc396b0b629c8e4314acd6f5dac40a676edbc87f4567b47eb7",
           "https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/",
-          "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chm-badness-delivers-a-banking-trojan/",
           "https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hh_html_help_susp_child_process.yml"
         ],
@@ -17305,8 +17421,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf",
-          "http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html",
           "https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/",
+          "http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_computer_discovery_get_adcomputer.yml"
         ],
         "tags": [
@@ -17376,8 +17492,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://strontic.github.io/xcyclopedia/library/DeviceEnroller.exe-24BEF0D6B0ECED36BB41831759FDE18D.html",
           "https://mobile.twitter.com/0gtweet/status/1564131230941122561",
+          "https://strontic.github.io/xcyclopedia/library/DeviceEnroller.exe-24BEF0D6B0ECED36BB41831759FDE18D.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_deviceenroller_dll_sideloading.yml"
         ],
         "tags": [
@@ -17445,8 +17561,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.pingcastle.com/documentation/scanner/",
           "https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/",
+          "https://www.pingcastle.com/documentation/scanner/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_renamed_pingcastle.yml"
         ],
         "tags": [
@@ -17488,8 +17604,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "Turla has used fsutil fsinfo drives to list connected drives.",
           "https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/discovery_peripheral_device.toml",
+          "Turla has used fsutil fsinfo drives to list connected drives.",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_fsutil_drive_enumeration.yml"
         ],
         "tags": [
@@ -17522,8 +17638,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/BloodHoundAD/SharpHound",
           "https://github.com/BloodHoundAD/BloodHound",
+          "https://github.com/BloodHoundAD/SharpHound",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_bloodhound_sharphound.yml"
         ],
         "tags": [
@@ -17647,8 +17763,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md",
           "https://lolbas-project.github.io/lolbas/Binaries/Psr/",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md",
           "https://web.archive.org/web/20200229201156/https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1493861893.pdf",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_psr_capture_screenshots.yml"
         ],
@@ -17871,13 +17987,13 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://github.com/zcgonvh/NTDSDumpEx",
+          "https://github.com/rapid7/metasploit-framework/blob/d297adcebb5c1df6fe30b12ca79b161deb71571c/data/post/powershell/NTDSgrab.ps1",
+          "https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration",
+          "https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Gather/Copy-VSS.ps1",
           "https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1",
           "https://pentestlab.blog/tag/ntds-dit/",
-          "https://github.com/zcgonvh/NTDSDumpEx",
-          "https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Gather/Copy-VSS.ps1",
           "https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/",
-          "https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration",
-          "https://github.com/rapid7/metasploit-framework/blob/d297adcebb5c1df6fe30b12ca79b161deb71571c/data/post/powershell/NTDSgrab.ps1",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_ntds.yml"
         ],
         "tags": [
@@ -17943,8 +18059,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/sysinternals/downloads/sdelete",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md",
+          "https://learn.microsoft.com/en-us/sysinternals/downloads/sdelete",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_renamed_sysinternals_sdelete.yml"
         ],
         "tags": [
@@ -18055,8 +18171,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://dtm.uk/wuauclt/",
           "https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/",
+          "https://dtm.uk/wuauclt/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wuauclt_dll_loading.yml"
         ],
         "tags": [
@@ -18388,9 +18504,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.dfirnotes.net/portproxy_detection/",
-          "https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html",
           "https://adepts.of0x.cc/netsh-portproxy-code/",
+          "https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html",
+          "https://www.dfirnotes.net/portproxy_detection/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_netsh_port_forwarding.yml"
         ],
         "tags": [
@@ -18499,10 +18615,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/EmpireProject/Empire/blob/c2ba61ca8d2031dad0cfc1d5770ba723e8b710db/lib/common/helpers.py#L165",
           "https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/lib/modules/powershell/persistence/powerbreach/resolver.py#L178",
           "https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/privesc/Invoke-EventVwrBypass.ps1#L64",
           "https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/lib/modules/powershell/persistence/powerbreach/deaduser.py#L191",
+          "https://github.com/EmpireProject/Empire/blob/c2ba61ca8d2031dad0cfc1d5770ba723e8b710db/lib/common/helpers.py#L165",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_empire_powershell_launch.yml"
         ],
         "tags": [
@@ -18612,10 +18728,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://web.archive.org/web/20220224045756/https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf",
           "https://unit42.paloaltonetworks.com/unit-42-title-gamaredon-group-toolset-evolution",
-          "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine",
           "https://uvnc.com/docs/uvnc-viewer/52-ultravnc-viewer-commandline-parameters.html",
+          "https://web.archive.org/web/20220224045756/https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf",
+          "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_ultravnc_susp_execution.yml"
         ],
         "tags": [
@@ -18682,9 +18798,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://blog.reconinfosec.com/emergence-of-akira-ransomware-group",
-          "https://developers.cloudflare.com/cloudflare-one/connections/connect-apps",
           "https://github.com/cloudflare/cloudflared",
+          "https://developers.cloudflare.com/cloudflare-one/connections/connect-apps",
+          "https://blog.reconinfosec.com/emergence-of-akira-ransomware-group",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_cloudflared_tunnel_run.yml"
         ],
         "tags": [
@@ -19115,8 +19231,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.trellix.com/en-us/about/newsroom/stories/research/beyond-file-search-a-novel-method.html",
           "https://micahbabinski.medium.com/search-ms-webdav-and-chill-99c5b23ac462",
+          "https://www.trellix.com/en-us/about/newsroom/stories/research/beyond-file-search-a-novel-method.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_webdav_lnk_execution.yml"
         ],
         "tags": [
@@ -19157,8 +19273,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1220/T1220.md",
+          "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_msxsl_execution.yml"
         ],
         "tags": [
@@ -19191,9 +19307,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/",
-          "https://thedfirreport.com/2022/09/26/bumblebee-round-two/",
           "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime",
+          "https://thedfirreport.com/2022/09/26/bumblebee-round-two/",
+          "https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wab_execution_from_non_default_location.yml"
         ],
         "tags": [
@@ -19217,8 +19333,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/johnlatwc/status/1408062131321270282?s=12",
           "https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf",
+          "https://twitter.com/johnlatwc/status/1408062131321270282?s=12",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wmic_eventconsumer_creation.yml"
         ],
         "tags": [
@@ -19251,10 +19367,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/vysecurity/status/885545634958385153",
           "https://web.archive.org/web/20190213114956/http://www.windowsinspired.com/understanding-the-command-line-string-and-arguments-received-by-a-windows-program/",
-          "https://twitter.com/Hexacorn/status/885553465417756673",
+          "https://twitter.com/vysecurity/status/885545634958385153",
           "https://twitter.com/Hexacorn/status/885570278637678592",
+          "https://twitter.com/Hexacorn/status/885553465417756673",
           "https://www.mandiant.com/resources/blog/obfuscation-wild-targeted-attackers-lead-way-evasion-techniques",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_cli_obfuscation_escape_char.yml"
         ],
@@ -19308,6 +19424,29 @@
       "uuid": "9801abb8-e297-4dbf-9fbd-57dde0e830ad",
       "value": "File Download And Execution Via IEExec.EXE"
     },
+    {
+      "description": "Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.",
+      "meta": {
+        "author": "@Kostastsale, @TheDFIRReport",
+        "creation_date": "2022-12-05",
+        "falsepositive": [
+          "Unknown"
+        ],
+        "filename": "proc_creation_win_susp_emoji_usage_in_cli_1.yml",
+        "level": "high",
+        "logsource.category": "process_creation",
+        "logsource.product": "windows",
+        "refs": [
+          "Internal Research",
+          "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_emoji_usage_in_cli_1.yml"
+        ],
+        "tags": [
+          "attack.defense-evasion"
+        ]
+      },
+      "uuid": "4a30ac0c-b9d6-4e01-b71a-5f851bbf4259",
+      "value": "Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 1"
+    },
     {
       "description": "A General detection for sdclt spawning new processes. This could be an indicator of sdclt being used for bypass UAC techniques.",
       "meta": {
@@ -19321,8 +19460,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.B.2_C36B49B5-DF58-4A34-9FE9-56189B9DEFEA.md",
           "https://github.com/OTRF/detection-hackathon-apt29/issues/6",
+          "https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.B.2_C36B49B5-DF58-4A34-9FE9-56189B9DEFEA.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_sdclt_child_process.yml"
         ],
         "tags": [
@@ -19343,7 +19482,7 @@
       "value": "Sdclt Child Processes"
     },
     {
-      "description": "Detects usage of the \"wusa.exe\" (Windows Update Standalone Installer) utility to extract cab using the \"/extract\" argument from suspicious paths",
+      "description": "Detects the execution of the \"wusa.exe\" (Windows Update Standalone Installer) utility to extract \".cab\" files using the \"/extract\" argument from potentially suspicious paths.\n",
       "meta": {
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "creation_date": "2022-08-05",
@@ -19364,7 +19503,7 @@
         ]
       },
       "uuid": "c74c0390-3e20-41fd-a69a-128f0275a5ea",
-      "value": "Wusa.EXE Extracting Cab Files From Suspicious Paths"
+      "value": "Cab File Extraction Via Wusa.EXE From Potentially Suspicious Paths"
     },
     {
       "description": "Detects execution of \"rundll32.exe\" with a parent process of Explorer.exe. This has been observed by variants of Raspberry Robin, as first reported by Red Canary.",
@@ -19553,9 +19692,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://blog.viettelcybersecurity.com/saml-show-stopper/",
-          "https://github.com/horizon3ai/CVE-2022-47966/blob/3a51c6b72ebbd87392babd955a8fbeaee2090b35/CVE-2022-47966.py",
           "https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/",
+          "https://github.com/horizon3ai/CVE-2022-47966/blob/3a51c6b72ebbd87392babd955a8fbeaee2090b35/CVE-2022-47966.py",
+          "https://blog.viettelcybersecurity.com/saml-show-stopper/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_java_manageengine_susp_child_process.yml"
         ],
         "tags": [
@@ -19647,8 +19786,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/erase",
           "https://www.joesandbox.com/analysis/509330/0/html#1044F3BDBE3BB6F734E357235F4D5898582D",
+          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/erase",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_cmd_del_greedy_deletion.yml"
         ],
         "tags": [
@@ -19668,6 +19807,49 @@
       "uuid": "204b17ae-4007-471b-917b-b917b315c5db",
       "value": "Greedy File Deletion Using Del"
     },
+    {
+      "description": "Detects the execution of a specific OneLiner to download and execute powershell modules in memory.",
+      "meta": {
+        "author": "@Kostastsale, @TheDFIRReport",
+        "creation_date": "2022-05-09",
+        "falsepositive": [
+          "Unknown"
+        ],
+        "filename": "proc_creation_win_powershell_download_cradle_obfuscated.yml",
+        "level": "high",
+        "logsource.category": "process_creation",
+        "logsource.product": "windows",
+        "refs": [
+          "https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/",
+          "https://gist.github.com/mgeeky/3b11169ab77a7de354f4111aa2f0df38",
+          "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_download_cradle_obfuscated.yml"
+        ],
+        "tags": [
+          "attack.defense-evasion",
+          "attack.execution",
+          "attack.t1059.001",
+          "attack.t1562.001"
+        ]
+      },
+      "related": [
+        {
+          "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "related-to"
+        },
+        {
+          "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "related-to"
+        }
+      ],
+      "uuid": "44e24481-6202-4c62-9127-5a0ae8e3fe3d",
+      "value": "Obfuscated PowerShell OneLiner Execution"
+    },
     {
       "description": "Detects PowerShell command line patterns in combincation with encoded commands that often appear in malware infection chains",
       "meta": {
@@ -19735,6 +19917,39 @@
       "uuid": "39ed3c80-e6a1-431b-9df3-911ac53d08a7",
       "value": "UAC Bypass Using NTFS Reparse Point - Process"
     },
+    {
+      "description": "Detects the initial execution of \"cmd.exe\" which spawns \"explorer.exe\" with the appropriate command line arguments for opening the \"My Computer\" folder.\n",
+      "meta": {
+        "author": "@Kostastsale",
+        "creation_date": "2022-12-22",
+        "falsepositive": [
+          "Unknown"
+        ],
+        "filename": "proc_creation_win_explorer_folder_shortcut_via_shell_binary.yml",
+        "level": "high",
+        "logsource.category": "process_creation",
+        "logsource.product": "windows",
+        "refs": [
+          "https://ss64.com/nt/shell.html",
+          "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_explorer_folder_shortcut_via_shell_binary.yml"
+        ],
+        "tags": [
+          "attack.discovery",
+          "attack.t1135"
+        ]
+      },
+      "related": [
+        {
+          "dest-uuid": "3489cfc5-640f-4bb3-a103-9137b97de79f",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "related-to"
+        }
+      ],
+      "uuid": "c3d76afc-93df-461e-8e67-9b2bad3f2ac4",
+      "value": "File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell"
+    },
     {
       "description": "Detects process creation with a renamed BrowserCore.exe (used to extract Azure tokens)",
       "meta": {
@@ -19822,8 +20037,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://grzegorztworek.medium.com/using-uefi-to-inject-executable-files-into-bitlocker-protected-drives-8ff4ca59c94c",
           "https://persistence-info.github.io/Data/wpbbin.html",
+          "https://grzegorztworek.medium.com/using-uefi-to-inject-executable-files-into-bitlocker-protected-drives-8ff4ca59c94c",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wpbbin_potential_persistence.yml"
         ],
         "tags": [
@@ -19931,8 +20146,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://pentestlab.blog/tag/svchost/",
           "https://www.n00py.io/2021/05/dumping-plaintext-rdp-credentials-from-svchost-exe/",
+          "https://pentestlab.blog/tag/svchost/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_sc_query_interesting_services.yml"
         ],
         "tags": [
@@ -20020,6 +20235,39 @@
       "uuid": "a95b9b42-1308-4735-a1af-abb1c5e6f5ac",
       "value": "Suspicious Service DACL Modification Via Set-Service Cmdlet"
     },
+    {
+      "description": "Detects changes to the registry value \"PythonFunctionWarnings\" that would prevent any warnings or alerts from showing when Python functions are about to be executed.\nThreat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.\n",
+      "meta": {
+        "author": "@Kostastsale",
+        "creation_date": "2023-08-22",
+        "falsepositive": [
+          "Unknown"
+        ],
+        "filename": "proc_creation_win_registry_office_disable_python_security_warnings.yml",
+        "level": "high",
+        "logsource.category": "process_creation",
+        "logsource.product": "windows",
+        "refs": [
+          "https://support.microsoft.com/en-us/office/data-security-and-python-in-excel-33cc88a4-4a87-485e-9ff9-f35958278327",
+          "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_registry_office_disable_python_security_warnings.yml"
+        ],
+        "tags": [
+          "attack.defense-evasion",
+          "attack.t1562.001"
+        ]
+      },
+      "related": [
+        {
+          "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "related-to"
+        }
+      ],
+      "uuid": "023c654f-8f16-44d9-bb2b-00ff36a62af9",
+      "value": "Python Function Execution Security Warning Disabled In Excel"
+    },
     {
       "description": "Detects the use of NPS, a port forwarding and intranet penetration proxy server",
       "meta": {
@@ -20066,8 +20314,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://lolbas-project.github.io/lolbas/Binaries/Bash/",
           "https://linux.die.net/man/1/bash",
+          "https://lolbas-project.github.io/lolbas/Binaries/Bash/",
           "Internal Research",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_bash_file_execution.yml"
         ],
@@ -20169,9 +20417,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/",
-          "https://www.elevenforum.com/t/video-guide-how-to-completely-disable-microsoft-defender-antivirus.14608/page-2",
           "https://github.com/swagkarna/Defeat-Defender-V1.2.0",
+          "https://www.elevenforum.com/t/video-guide-how-to-completely-disable-microsoft-defender-antivirus.14608/page-2",
+          "https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_reg_windows_defender_tamper.yml"
         ],
         "tags": [
@@ -20329,9 +20577,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://lolbas-project.github.io/lolbas/OtherMSBinaries/FsiAnyCpu/",
           "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Fsi/",
           "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac",
+          "https://lolbas-project.github.io/lolbas/OtherMSBinaries/FsiAnyCpu/",
           "https://bohops.com/2020/11/02/exploring-the-wdac-microsoft-recommended-block-rules-part-ii-wfc-fsi/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_fsi_fsharp_code_execution.yml"
         ],
@@ -20529,9 +20777,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://medium.com/tenable-techblog/uac-bypass-by-mocking-trusted-directories-24a96675f6e",
           "https://github.com/netero1010/TrustedPath-UACBypass-BOF",
           "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+          "https://medium.com/tenable-techblog/uac-bypass-by-mocking-trusted-directories-24a96675f6e",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_uac_bypass_trustedpath.yml"
         ],
         "tags": [
@@ -20640,9 +20888,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://thedfirreport.com/2023/03/06/2022-year-in-review/",
           "https://www.yeahhub.com/list-installed-programs-version-path-windows/",
           "https://learn.microsoft.com/en-us/answers/questions/253555/software-list-inventory-wmic-product",
-          "https://thedfirreport.com/2023/03/06/2022-year-in-review/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wmic_recon_product.yml"
         ],
         "tags": [
@@ -20675,11 +20923,11 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://lolbas-project.github.io/lolbas/Binaries/Certutil/",
-          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil",
-          "https://twitter.com/egre55/status/1087685529016193025",
           "https://forensicitguy.github.io/agenttesla-vba-certutil-download/",
           "https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/",
+          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil",
+          "https://twitter.com/egre55/status/1087685529016193025",
+          "https://lolbas-project.github.io/lolbas/Binaries/Certutil/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_certutil_download.yml"
         ],
         "tags": [
@@ -20746,10 +20994,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://lolbas-project.github.io/lolbas/Binaries/Wbadmin/",
           "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-backup",
-          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery",
           "https://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Wbadmin.yml",
+          "https://lolbas-project.github.io/lolbas/Binaries/Wbadmin/",
+          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wbadmin_dump_sensitive_files.yml"
         ],
         "tags": [
@@ -20851,9 +21099,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.elastic.co/guide/en/security/current/microsoft-iis-service-account-password-dumped.html",
-          "https://www.netspi.com/blog/technical/network-penetration-testing/decrypting-iis-passwords-to-break-out-of-the-dmz-part-2/",
           "https://twitter.com/0gtweet/status/1588815661085917186?cxt=HHwWhIDUyaDbzYwsAAAA",
+          "https://www.netspi.com/blog/technical/network-penetration-testing/decrypting-iis-passwords-to-break-out-of-the-dmz-part-2/",
+          "https://www.elastic.co/guide/en/security/current/microsoft-iis-service-account-password-dumped.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_iis_appcmd_service_account_password_dumped.yml"
         ],
         "tags": [
@@ -21069,9 +21317,9 @@
         "logsource.product": "windows",
         "refs": [
           "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/espionage-asia-governments",
-          "https://thedfirreport.com/2022/09/26/bumblebee-round-two/",
-          "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708",
           "https://www.microsoft.com/en-us/security/blog/2022/10/25/dev-0832-vice-society-opportunistic-ransomware-campaigns-impacting-us-education-sector/",
+          "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708",
+          "https://thedfirreport.com/2022/09/26/bumblebee-round-two/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_weak_or_abused_passwords.yml"
         ],
         "tags": [
@@ -21095,8 +21343,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.trendmicro.com/en_us/research/22/j/lv-ransomware-exploits-proxyshell-in-attack.html",
           "https://gist.github.com/jivoi/c354eaaf3019352ce32522f916c03d70",
+          "https://www.trendmicro.com/en_us/research/22/j/lv-ransomware-exploits-proxyshell-in-attack.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_susp_download_patterns.yml"
         ],
         "tags": [
@@ -21218,8 +21466,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/VirtualAlllocEx/Payload-Download-Cradles/blob/88e8eca34464a547c90d9140d70e9866dcbc6a12/Download-Cradles.cmd",
           "https://labs.withsecure.com/publications/fin7-target-veeam-servers",
+          "https://github.com/VirtualAlllocEx/Payload-Download-Cradles/blob/88e8eca34464a547c90d9140d70e9866dcbc6a12/Download-Cradles.cmd",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_download_iex.yml"
         ],
         "tags": [
@@ -21286,8 +21534,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/nas_bench/status/1550836225652686848",
           "https://persistence-info.github.io/Data/windowsterminalprofile.html",
+          "https://twitter.com/nas_bench/status/1550836225652686848",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_windows_terminal_susp_children.yml"
         ],
         "tags": [
@@ -21345,8 +21593,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/an0n_r0/status/1474698356635193346?s=12",
           "https://twitter.com/mrd0x/status/1475085452784844803?s=12",
+          "https://twitter.com/an0n_r0/status/1474698356635193346?s=12",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_download_office_domain.yml"
         ],
         "tags": [
@@ -21479,8 +21727,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/dsnezhkov/TruffleSnout/blob/master/TruffleSnout/Docs/USAGE.md",
           "https://github.com/dsnezhkov/TruffleSnout",
+          "https://github.com/dsnezhkov/TruffleSnout/blob/master/TruffleSnout/Docs/USAGE.md",
           "https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1482/T1482.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_trufflesnout.yml"
         ],
@@ -21548,10 +21796,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://www.trendmicro.com/en_us/research/24/b/threat-actor-groups-including-black-basta-are-exploiting-recent-.html",
+          "https://docs.connectwise.com/ConnectWise_Control_Documentation/Get_started/Host_client/View_menu/Backstage_mode",
           "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708",
           "https://www.mandiant.com/resources/telegram-malware-iranian-espionage",
-          "https://docs.connectwise.com/ConnectWise_Control_Documentation/Get_started/Host_client/View_menu/Backstage_mode",
-          "https://www.trendmicro.com/en_us/research/24/b/threat-actor-groups-including-black-basta-are-exploiting-recent-.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_remote_execution_susp.yml"
         ],
         "tags": [
@@ -21584,8 +21832,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-acl?view=powershell-5.1",
           "https://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c99747976447dc884cb1a39/atomics/T1505.005/T1505.005.md",
+          "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-acl?view=powershell-5.1",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_set_acl_susp_location.yml"
         ],
         "tags": [
@@ -21821,6 +22069,43 @@
       "uuid": "cd219ff3-fa99-45d4-8380-a7d15116c6dc",
       "value": "New User Created Via Net.EXE"
     },
+    {
+      "description": "Detect usage of the \"ssh.exe\" binary as a proxy to launch other programs.",
+      "meta": {
+        "author": "frack113, Nasreddine Bencherchali",
+        "creation_date": "2022-12-29",
+        "falsepositive": [
+          "Legitimate usage for administration purposes"
+        ],
+        "filename": "proc_creation_win_ssh_proxy_execution.yml",
+        "level": "medium",
+        "logsource.category": "process_creation",
+        "logsource.product": "windows",
+        "refs": [
+          "https://man.openbsd.org/ssh_config#ProxyCommand",
+          "https://github.com/LOLBAS-Project/LOLBAS/pull/211/files",
+          "https://lolbas-project.github.io/lolbas/Binaries/Ssh/",
+          "https://gtfobins.github.io/gtfobins/ssh/",
+          "https://man.openbsd.org/ssh_config#LocalCommand",
+          "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_ssh_proxy_execution.yml"
+        ],
+        "tags": [
+          "attack.defense-evasion",
+          "attack.t1218"
+        ]
+      },
+      "related": [
+        {
+          "dest-uuid": "457c7820-d331-465a-915e-42f85500ccc4",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "related-to"
+        }
+      ],
+      "uuid": "7d6d30b8-5b91-4b90-a891-46cccaf29598",
+      "value": "Program Executed Using Proxy/Local Command Via SSH.EXE"
+    },
     {
       "description": "Detects usage of bitsadmin downloading a file to uncommon target folder",
       "meta": {
@@ -21834,9 +22119,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin",
           "https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/",
           "https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/",
-          "https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin",
           "https://isc.sans.edu/diary/22264",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_bitsadmin_download_uncommon_targetfolder.yml"
         ],
@@ -21881,8 +22166,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/",
-          "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/",
           "https://www.intrinsec.com/apt27-analysis/",
+          "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_snapins_hafnium.yml"
         ],
         "tags": [
@@ -21978,40 +22263,6 @@
       "uuid": "e96253b8-6b3b-4f90-9e59-3b24b99cf9b4",
       "value": "HackTool - KrbRelay Execution"
     },
-    {
-      "description": "Detects execution of of Dxcap.exe",
-      "meta": {
-        "author": "Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems)",
-        "creation_date": "2019-10-26",
-        "falsepositive": [
-          "Legitimate execution of dxcap.exe by legitimate user"
-        ],
-        "filename": "proc_creation_win_lolbin_susp_dxcap.yml",
-        "level": "medium",
-        "logsource.category": "process_creation",
-        "logsource.product": "windows",
-        "refs": [
-          "https://twitter.com/harr0ey/status/992008180904419328",
-          "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Dxcap/",
-          "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_susp_dxcap.yml"
-        ],
-        "tags": [
-          "attack.defense-evasion",
-          "attack.t1218"
-        ]
-      },
-      "related": [
-        {
-          "dest-uuid": "457c7820-d331-465a-915e-42f85500ccc4",
-          "tags": [
-            "estimative-language:likelihood-probability=\"almost-certain\""
-          ],
-          "type": "related-to"
-        }
-      ],
-      "uuid": "60f16a96-db70-42eb-8f76-16763e333590",
-      "value": "Application Whitelisting Bypass via Dxcap.exe"
-    },
     {
       "description": "Detects the pattern of UAC Bypass using pkgmgr.exe and dism.exe (UACMe 23)",
       "meta": {
@@ -22146,7 +22397,7 @@
     {
       "description": "Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities",
       "meta": {
-        "author": "frack113, Nasreddine Bencherchali (Nextron Systems)",
+        "author": "frack113, Nasreddine Bencherchali (Nextron Systems), X__Junior",
         "creation_date": "2021-12-26",
         "falsepositive": [
           "Unknown"
@@ -22156,9 +22407,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/MichalKoczwara/status/1553634816016498688",
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-8---windows---disable-the-sr-scheduled-task",
           "https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-8---windows---disable-the-sr-scheduled-task",
+          "https://twitter.com/MichalKoczwara/status/1553634816016498688",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_schtasks_disable.yml"
         ],
         "tags": [
@@ -22259,8 +22510,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/elastic/detection-rules/blob/dd224fb3f81d0b4bf8593c5f02a029d647ba2b2d/rules/windows/credential_access_relay_ntlm_auth_via_http_spoolss.toml",
           "https://twitter.com/med0x2e/status/1520402518685200384",
+          "https://github.com/elastic/detection-rules/blob/dd224fb3f81d0b4bf8593c5f02a029d647ba2b2d/rules/windows/credential_access_relay_ntlm_auth_via_http_spoolss.toml",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_rundll32_ntlmrelay.yml"
         ],
         "tags": [
@@ -22471,8 +22722,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/LOLBAS-Project/LOLBAS/blob/8283d8d91552213ded165fd36deb6cb9534cb443/yml/OtherMSBinaries/Sqltoolsps.yml",
           "https://twitter.com/pabraeken/status/993298228840992768",
+          "https://github.com/LOLBAS-Project/LOLBAS/blob/8283d8d91552213ded165fd36deb6cb9534cb443/yml/OtherMSBinaries/Sqltoolsps.yml",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_mssql_sqltoolsps_susp_execution.yml"
         ],
         "tags": [
@@ -22514,10 +22765,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://web.archive.org/web/20180725233601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf",
           "https://redcanary.com/blog/msix-installers/",
-          "https://www.cybereason.com/blog/research/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms",
           "https://businessinsights.bitdefender.com/deep-dive-into-a-backdoordiplomacy-attack-a-study-of-an-attackers-toolkit",
+          "https://www.cybereason.com/blog/research/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms",
+          "https://web.archive.org/web/20180725233601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_csvde_export.yml"
         ],
         "tags": [
@@ -22551,8 +22802,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/",
           "https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/",
+          "https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/",
           "https://www.trellix.com/en-sg/about/newsroom/stories/threat-labs/lockergoga-ransomware-family-used-in-targeted-attacks.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_net_user_default_accounts_manipulation.yml"
         ],
@@ -22586,8 +22837,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.uptycs.com/blog/kuraystealer-a-bandit-using-discord-webhooks",
           "https://jonconwayuk.wordpress.com/2014/01/31/wmic-csproduct-using-wmi-to-identify-make-and-model-of-hardware/",
+          "https://www.uptycs.com/blog/kuraystealer-a-bandit-using-discord-webhooks",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wmic_recon_csproduct.yml"
         ],
         "tags": [
@@ -22687,8 +22938,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv",
           "https://labs.withsecure.com/publications/fin7-target-veeam-servers",
+          "https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_curl_custom_user_agent.yml"
         ],
         "tags": [
@@ -22734,10 +22985,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.virustotal.com/gui/file/4abe1395a09fda06d897a9c4eb247278c1b6cddda5d126ce5b3f4f499e3b8fa2/behavior",
-          "https://www.virustotal.com/gui/file/34de4c8beded481a4084a1fd77855c3e977e8ac643e5c5842d0f15f7f9b9086f/behavior",
-          "https://www.virustotal.com/gui/file/427616528b7dbc4a6057ac89eb174a3a90f7abcf3f34e5a359b7a910d82f7a72/behavior",
           "https://www.virustotal.com/gui/file/35c22725a92d5cb1016b09421c0a6cdbfd860fd4778b3313669b057d4a131cb7/behavior",
+          "https://www.virustotal.com/gui/file/34de4c8beded481a4084a1fd77855c3e977e8ac643e5c5842d0f15f7f9b9086f/behavior",
+          "https://www.virustotal.com/gui/file/4abe1395a09fda06d897a9c4eb247278c1b6cddda5d126ce5b3f4f499e3b8fa2/behavior",
+          "https://www.virustotal.com/gui/file/427616528b7dbc4a6057ac89eb174a3a90f7abcf3f34e5a359b7a910d82f7a72/behavior",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_certutil_encode_susp_extensions.yml"
         ],
         "tags": [
@@ -22944,9 +23195,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://mikefrobbins.com/2017/06/15/simple-obfuscation-with-powershell-using-base64-encoding/",
           "https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.001/T1059.001.md#atomic-test-20---powershell-invoke-known-malicious-cmdlets",
+          "https://mikefrobbins.com/2017/06/15/simple-obfuscation-with-powershell-using-base64-encoding/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_encode.yml"
         ],
         "tags": [
@@ -23013,13 +23264,13 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://lolbas-project.github.io/lolbas/Binaries/Msedge/",
-          "https://lolbas-project.github.io/lolbas/Binaries/msedgewebview2/",
-          "https://medium.com/@MalFuzzer/one-electron-to-rule-them-all-dc2e9b263daf",
           "https://positive.security/blog/ms-officecmd-rce",
-          "https://taggart-tech.com/quasar-electron/",
+          "https://medium.com/@MalFuzzer/one-electron-to-rule-them-all-dc2e9b263daf",
+          "https://lolbas-project.github.io/lolbas/Binaries/Msedge/",
           "https://lolbas-project.github.io/lolbas/Binaries/Teams/",
           "https://github.com/mttaggart/quasar",
+          "https://taggart-tech.com/quasar-electron/",
+          "https://lolbas-project.github.io/lolbas/Binaries/msedgewebview2/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_electron_app_children.yml"
         ],
         "tags": [
@@ -23143,8 +23394,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://redcanary.com/blog/threat-detection/process-masquerading/",
           "https://tria.ge/240731-jh4crsycnb/behavioral2",
+          "https://redcanary.com/blog/threat-detection/process-masquerading/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_svchost_masqueraded_execution.yml"
         ],
         "tags": [
@@ -23177,8 +23428,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-gb/windows-server/administration/windows-commands/ksetup",
           "https://twitter.com/Oddvarmoe/status/1641712700605513729",
+          "https://learn.microsoft.com/en-gb/windows-server/administration/windows-commands/ksetup",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_ksetup_password_change_computer.yml"
         ],
         "tags": [
@@ -23189,9 +23440,9 @@
       "value": "Computer Password Change Via Ksetup.EXE"
     },
     {
-      "description": "Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause or delete critical or important Windows services such as AV, Backup, etc. As seen being used in some ransomware scripts",
+      "description": "Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause, disable or delete critical or important Windows services such as AV, Backup, etc. As seen being used in some ransomware scripts",
       "meta": {
-        "author": "Nasreddine Bencherchali (Nextron Systems), frack113",
+        "author": "Nasreddine Bencherchali (Nextron Systems), frack113 , X__Junior",
         "creation_date": "2022-09-01",
         "falsepositive": [
           "Administrators or tools shutting down the services due to upgrade or removal purposes. If you experience some false positive, please consider adding filters to the parent process launching this command and not removing the entry"
@@ -23201,8 +23452,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md",
           "https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md",
           "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus/Genshin%20Impact%20Figure%2010.jpg",
           "https://www.virustotal.com/gui/file/38283b775552da8981452941ea74191aa0d203edd3f61fb2dee7b0aea3514955",
           "https://www.trellix.com/en-sg/about/newsroom/stories/threat-labs/lockergoga-ransomware-family-used-in-targeted-attacks.html",
@@ -23225,6 +23476,45 @@
       "uuid": "ce72ef99-22f1-43d4-8695-419dcb5d9330",
       "value": "Suspicious Windows Service Tampering"
     },
+    {
+      "description": "Detects the execution of the BCP utility in order to export data from the database.\nAttackers were seen saving their malware to a database column or table and then later extracting it via \"bcp.exe\" into a file.\n",
+      "meta": {
+        "author": "Omar Khaled (@beacon_exe), MahirAli Khan (in/mahiralikhan), Nasreddine Bencherchali (Nextron Systems)",
+        "creation_date": "2024-08-20",
+        "falsepositive": [
+          "Legitimate data export operations."
+        ],
+        "filename": "proc_creation_win_bcp_export_data.yml",
+        "level": "medium",
+        "logsource.category": "process_creation",
+        "logsource.product": "windows",
+        "refs": [
+          "https://asec.ahnlab.com/en/78944/",
+          "https://docs.microsoft.com/en-us/sql/tools/bcp-utility",
+          "https://asec.ahnlab.com/en/61000/",
+          "https://news.sophos.com/en-us/2024/08/07/sophos-mdr-hunt-tracks-mimic-ransomware-campaign-against-organizations-in-india/",
+          "https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/",
+          "https://www.huntress.com/blog/attacking-mssql-servers-pt-ii",
+          "https://www.huntress.com/blog/attacking-mssql-servers",
+          "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_bcp_export_data.yml"
+        ],
+        "tags": [
+          "attack.execution",
+          "attack.t1048"
+        ]
+      },
+      "related": [
+        {
+          "dest-uuid": "a19e86f8-1c0a-4fea-8407-23b73d615776",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "related-to"
+        }
+      ],
+      "uuid": "c615d676-f655-46b9-b913-78729021e5d7",
+      "value": "Data Export From MSSQL Table Via BCP.EXE"
+    },
     {
       "description": "Detects suspicious Windows Error Reporting manager (wermgr.exe) child process",
       "meta": {
@@ -23238,9 +23528,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.echotrail.io/insights/search/wermgr.exe",
           "https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html",
           "https://github.com/binderlabs/DirCreate2System",
+          "https://www.echotrail.io/insights/search/wermgr.exe",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wermgr_susp_child_process.yml"
         ],
         "tags": [
@@ -23283,9 +23573,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/defender-endpoint/configure-process-opened-file-exclusions-microsoft-defender-antivirus",
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md",
           "https://twitter.com/AdamTheAnalyst/status/1483497517119590403",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md",
+          "https://learn.microsoft.com/en-us/defender-endpoint/configure-process-opened-file-exclusions-microsoft-defender-antivirus",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_defender_exclusion.yml"
         ],
         "tags": [
@@ -23656,8 +23946,8 @@
         "refs": [
           "https://tria.ge/240521-ynezpagf56/behavioral1",
           "https://bazaar.abuse.ch/sample/8c75f8e94486f5bbf461505823f5779f328c5b37f1387c18791e0c21f3fdd576/",
-          "https://any.run/report/6eea2773c1b4b5c6fb7c142933e220c96f9a4ec89055bf0cf54accdcde7df535/a407f006-ee45-420d-b576-f259094df091",
           "https://bazaar.abuse.ch/sample/64e6605496919cd76554915cbed88e56fdec10dec6523918a631754664b8c8d3/",
+          "https://any.run/report/6eea2773c1b4b5c6fb7c142933e220c96f9a4ec89055bf0cf54accdcde7df535/a407f006-ee45-420d-b576-f259094df091",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_bitlockertogo_execution.yml"
         ],
         "tags": [
@@ -23725,11 +24015,11 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/cglyer/status/1355171195654709249",
           "https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/",
-          "https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions",
-          "https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/",
           "https://www.trendmicro.com/en_us/research/23/a/vice-society-ransomware-group-targets-manufacturing-companies.html",
+          "https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/",
+          "https://twitter.com/cglyer/status/1355171195654709249",
+          "https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wmic_uninstall_security_products.yml"
         ],
         "tags": [
@@ -23762,8 +24052,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://blueteamops.medium.com/secedit-and-i-know-it-595056dee53d",
           "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/secedit",
+          "https://blueteamops.medium.com/secedit-and-i-know-it-595056dee53d",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_secedit_execution.yml"
         ],
         "tags": [
@@ -23904,9 +24194,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "http://www.hexacorn.com/blog/2019/03/30/sqirrel-packages-manager-as-a-lolbin-a-k-a-many-electron-apps-are-lolbins-by-default/",
-          "http://www.hexacorn.com/blog/2018/08/16/squirrel-as-a-lolbin/",
           "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Squirrel/",
+          "http://www.hexacorn.com/blog/2018/08/16/squirrel-as-a-lolbin/",
+          "http://www.hexacorn.com/blog/2019/03/30/sqirrel-packages-manager-as-a-lolbin-a-k-a-many-electron-apps-are-lolbins-by-default/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_squirrel_download.yml"
         ],
         "tags": [
@@ -23941,8 +24231,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/",
-          "https://web.archive.org/web/20191023232753/https://twitter.com/Hexacorn/status/1187143326673330176",
           "https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/",
+          "https://web.archive.org/web/20191023232753/https://twitter.com/Hexacorn/status/1187143326673330176",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_odbcconf_driver_install_susp.yml"
         ],
         "tags": [
@@ -24044,8 +24334,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1216/T1216.md",
           "https://lolbas-project.github.io/lolbas/Binaries/Syncappvpublishingserver/",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1216/T1216.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_syncappvpublishingserver_vbs_execute_psh.yml"
         ],
         "tags": [
@@ -24153,8 +24443,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://the.earth.li/~sgtatham/putty/0.58/htmldoc/Chapter7.html",
           "https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/",
+          "https://the.earth.li/~sgtatham/putty/0.58/htmldoc/Chapter7.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_renamed_plink.yml"
         ],
         "tags": [
@@ -24221,8 +24511,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/windows-server/administration/server-core/server-core-sconfig#powershell-is-the-default-shell-on-server-core",
           "https://cocomelonc.github.io/persistence/2022/12/09/malware-pers-20.html",
+          "https://learn.microsoft.com/en-us/windows-server/administration/server-core/server-core-sconfig#powershell-is-the-default-shell-on-server-core",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_userinit_uncommon_child_processes.yml"
         ],
         "tags": [
@@ -24255,13 +24545,13 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/vletoux/pingcastle",
+          "https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/",
           "https://github.com/802-1x/Compliance/blob/2e53df8b6e89686a0b91116b3f42c8f717dca820/Ping%20Castle/Get-PingCastle-HTMLComplianceReport.ps1#L8",
-          "https://github.com/projectHULK/AD_Recon/blob/dde2daba9b3393a9388cbebda87068972cc0bd3b/SecurityAssessment.ps1#L2699",
           "https://github.com/fengjixuchui/Start-ADEnum/blob/e237a739db98b6104427d833004836507da36a58/Functions/Start-ADEnum.ps1#L450",
           "https://github.com/lkys37en/Start-ADEnum/blob/5b42c54215fe5f57fc59abc52c20487d15764005/Functions/Start-ADEnum.ps1#L680",
+          "https://github.com/projectHULK/AD_Recon/blob/dde2daba9b3393a9388cbebda87068972cc0bd3b/SecurityAssessment.ps1#L2699",
           "https://github.com/EvotecIT/TheDashboard/blob/481a9ce8f82f2fd55fe65220ee6486bae6df0c9d/Examples/RunReports/PingCastle.ps1",
-          "https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/",
+          "https://github.com/vletoux/pingcastle",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pua_pingcastle_script_parent.yml"
         ],
         "tags": [
@@ -24329,11 +24619,11 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/dcomexec.py",
           "https://www.elastic.co/guide/en/security/current/suspicious-cmd-execution-via-wmi.html",
           "https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/wmiexec.py",
-          "https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/smbexec.py",
           "https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/atexec.py",
-          "https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/dcomexec.py",
+          "https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/smbexec.py",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_impacket_lateral_movement.yml"
         ],
         "tags": [
@@ -24410,11 +24700,11 @@
         "logsource.product": "windows",
         "refs": [
           "https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/windows/credential_access_lsass_memdump_file_created.toml",
+          "https://medium.com/@markmotig/some-ways-to-dump-lsass-exe-c4a75fdc49bf",
+          "https://www.whiteoaksecurity.com/blog/attacks-defenses-dumping-lsass-no-mimikatz/",
+          "https://github.com/Hackndo/lsassy",
           "https://github.com/helpsystems/nanodump",
           "https://github.com/CCob/MirrorDump",
-          "https://www.whiteoaksecurity.com/blog/attacks-defenses-dumping-lsass-no-mimikatz/",
-          "https://medium.com/@markmotig/some-ways-to-dump-lsass-exe-c4a75fdc49bf",
-          "https://github.com/Hackndo/lsassy",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_lsass_dmp_cli_keywords.yml"
         ],
         "tags": [
@@ -24447,8 +24737,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://lolbas-project.github.io/lolbas/Binaries/Print/",
           "https://twitter.com/Oddvarmoe/status/985518877076541440",
+          "https://lolbas-project.github.io/lolbas/Binaries/Print/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_print_remote_file_copy.yml"
         ],
         "tags": [
@@ -24624,8 +24914,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://researchcenter.paloaltonetworks.com/2018/01/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/",
           "https://www.microsoft.com/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/",
+          "https://researchcenter.paloaltonetworks.com/2018/01/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_iis_appcmd_susp_module_install.yml"
         ],
         "tags": [
@@ -24691,8 +24981,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.youtube.com/watch?v=DsJ9ByX84o4&t=6s",
           "https://brica.de/alerts/alert/public/1247926/agent-tesla-keylogger-delivered-inside-a-power-iso-daa-archive/",
+          "https://www.youtube.com/watch?v=DsJ9ByX84o4&t=6s",
           "https://app.any.run/tasks/7eaba74e-c1ea-400f-9c17-5e30eee89906/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_whoami_all_execution.yml"
         ],
@@ -24769,9 +25059,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://pentestlab.blog/2018/07/04/dumping-domain-password-hashes/",
           "https://twitter.com/vxunderground/status/1423336151860002816?s=20",
           "https://www.virustotal.com/gui/file/03e9b8c2e86d6db450e5eceec057d7e369ee2389b9daecaf06331a95410aa5f8/detection",
-          "https://pentestlab.blog/2018/07/04/dumping-domain-password-hashes/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_sensitive_file_access_shadowcopy.yml"
         ],
         "tags": [
@@ -24837,10 +25127,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://techcommunity.microsoft.com/t5/microsoft-365-blog/new-security-hardening-policies-for-trusted-documents/ba-p/3023465",
           "https://twitter.com/Max_Mal_/status/1633863678909874176",
-          "Internal Research",
+          "https://techcommunity.microsoft.com/t5/microsoft-365-blog/new-security-hardening-policies-for-trusted-documents/ba-p/3023465",
           "https://twitter.com/_JohnHammond/status/1588155401752788994",
+          "Internal Research",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_office_exec_from_trusted_locations.yml"
         ],
         "tags": [
@@ -24906,8 +25196,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/",
           "https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/",
+          "https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_appx_execution.yml"
         ],
         "tags": [
@@ -24930,8 +25220,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027/T1027.md#atomic-test-6---dlp-evasion-via-sensitive-data-in-vba-macro-over-http",
           "https://www.wietzebeukema.nl/blog/windows-command-line-obfuscation",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027/T1027.md#atomic-test-6---dlp-evasion-via-sensitive-data-in-vba-macro-over-http",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_cli_obfuscation_unicode.yml"
         ],
         "tags": [
@@ -25030,9 +25320,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://www.bleepingcomputer.com/news/security/gootkit-malware-bypasses-windows-defender-by-setting-path-exclusions/",
           "https://github.com/redcanaryco/atomic-red-team/blob/5c1e6f1b4fafd01c8d1ece85f510160fc1275fbf/atomics/T1562.001/T1562.001.md",
           "https://www.bleepingcomputer.com/news/security/iobit-forums-hacked-to-spread-ransomware-to-its-members/",
-          "https://www.bleepingcomputer.com/news/security/gootkit-malware-bypasses-windows-defender-by-setting-path-exclusions/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wmic_namespace_defender.yml"
         ],
         "tags": [
@@ -25065,9 +25355,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://app.any.run/tasks/210244b9-0b6b-4a2c-83a3-04bd3175d017/",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md#atomic-test-1---disable-microsoft-defender-firewall",
           "https://www.winhelponline.com/blog/enable-and-disable-windows-firewall-quickly-using-command-line/",
+          "https://app.any.run/tasks/210244b9-0b6b-4a2c-83a3-04bd3175d017/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_netsh_fw_disable.yml"
         ],
         "tags": [
@@ -25135,9 +25425,9 @@
         "logsource.product": "windows",
         "refs": [
           "https://embracethered.com/blog/posts/2020/chrome-spy-remote-control/",
-          "https://github.com/defaultnamehere/cookie_crimes/",
           "https://embracethered.com/blog/posts/2020/cookie-crimes-on-mirosoft-edge/",
           "https://mango.pdf.zone/stealing-chrome-cookies-without-a-password",
+          "https://github.com/defaultnamehere/cookie_crimes/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_debugging.yml"
         ],
         "tags": [
@@ -25223,40 +25513,6 @@
       "uuid": "b2815d0d-7481-4bf0-9b6c-a4c48a94b349",
       "value": "PowerShell Get-Process LSASS"
     },
-    {
-      "description": "Detects the execution of sigverif binary as a parent process which could indicate it being used as a LOLBIN to proxy execution",
-      "meta": {
-        "author": "Nasreddine Bencherchali (Nextron Systems)",
-        "creation_date": "2022-08-19",
-        "falsepositive": [
-          "Unknown"
-        ],
-        "filename": "proc_creation_win_lolbin_sigverif.yml",
-        "level": "medium",
-        "logsource.category": "process_creation",
-        "logsource.product": "windows",
-        "refs": [
-          "https://www.hexacorn.com/blog/2018/04/27/i-shot-the-sigverif-exe-the-gui-based-lolbin/",
-          "https://twitter.com/0gtweet/status/1457676633809330184",
-          "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_sigverif.yml"
-        ],
-        "tags": [
-          "attack.defense-evasion",
-          "attack.t1216"
-        ]
-      },
-      "related": [
-        {
-          "dest-uuid": "f6fe9070-7a65-49ea-ae72-76292f42cebe",
-          "tags": [
-            "estimative-language:likelihood-probability=\"almost-certain\""
-          ],
-          "type": "related-to"
-        }
-      ],
-      "uuid": "7d4aaec2-08ed-4430-8b96-28420e030e04",
-      "value": "Suspicious Sigverif Execution"
-    },
     {
       "description": "Detects the execution of regini.exe which can be used to modify registry keys, the changes are imported from one or more text files.",
       "meta": {
@@ -25270,8 +25526,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/regini",
           "https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f",
+          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/regini",
           "https://lolbas-project.github.io/lolbas/Binaries/Regini/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_regini_execution.yml"
         ],
@@ -25305,8 +25561,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/",
           "https://twitter.com/0gtweet/status/1674399582162153472",
+          "https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_provlaunch_susp_child_process.yml"
         ],
         "tags": [
@@ -25373,9 +25629,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://labs.withsecure.com/publications/fin7-target-veeam-servers",
           "https://github.com/pr0xylife/IcedID/blob/8dd1e218460db4f750d955b4c65b2f918a1db906/icedID_09.28.2023.txt",
           "https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv",
-          "https://labs.withsecure.com/publications/fin7-target-veeam-servers",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_curl_download_direct_ip_exec.yml"
         ],
         "tags": [
@@ -25385,6 +25641,39 @@
       "uuid": "9cc85849-3b02-4cb5-b371-3a1ff54f2218",
       "value": "File Download From IP URL Via Curl.EXE"
     },
+    {
+      "description": "Detects the execution of malicious OneNote documents that contain embedded scripts.\nWhen a user clicks on a OneNote attachment and then on the malicious link inside the \".one\" file, it exports and executes the malicious embedded script from specific directories.\n",
+      "meta": {
+        "author": "@kostastsale",
+        "creation_date": "2023-02-02",
+        "falsepositive": [
+          "Unlikely"
+        ],
+        "filename": "proc_creation_win_office_onenote_embedded_script_execution.yml",
+        "level": "high",
+        "logsource.category": "process_creation",
+        "logsource.product": "windows",
+        "refs": [
+          "https://bazaar.abuse.ch/browse/tag/one/",
+          "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_office_onenote_embedded_script_execution.yml"
+        ],
+        "tags": [
+          "attack.defense-evasion",
+          "attack.t1218.001"
+        ]
+      },
+      "related": [
+        {
+          "dest-uuid": "a6937325-9321-4e2e-bb2b-3ed2d40b2a9d",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "related-to"
+        }
+      ],
+      "uuid": "84b1706c-932a-44c4-ae28-892b28a25b94",
+      "value": "OneNote.EXE Execution of Malicious Embedded Scripts"
+    },
     {
       "description": "Detects a certain command line flag combination used by mpiexec.exe LOLBIN from HPC pack that can be used to execute any other binary",
       "meta": {
@@ -25434,8 +25723,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://lolbas-project.github.io/lolbas/Binaries/Winget/",
-          "https://learn.microsoft.com/en-us/windows/package-manager/winget/install#local-install",
           "https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget",
+          "https://learn.microsoft.com/en-us/windows/package-manager/winget/install#local-install",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_winget_local_install_via_manifest.yml"
         ],
         "tags": [
@@ -25789,8 +26078,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/",
           "https://twitter.com/0gtweet/status/1674399582162153472",
+          "https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_provlaunch_potential_abuse.yml"
         ],
         "tags": [
@@ -25824,9 +26113,9 @@
         "logsource.product": "windows",
         "refs": [
           "https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view",
-          "https://www.elastic.co/guide/en/security/current/remote-file-copy-to-a-hidden-share.html",
           "https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/",
           "https://twitter.com/SBousseaden/status/1211636381086339073",
+          "https://www.elastic.co/guide/en/security/current/remote-file-copy-to-a-hidden-share.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_copy_lateral_movement.yml"
         ],
         "tags": [
@@ -25911,12 +26200,12 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://redcanary.com/blog/raspberry-robin/",
           "https://www.trendmicro.com/en_us/research/17/h/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses.html",
+          "https://web.archive.org/web/20191023232753/https://twitter.com/Hexacorn/status/1187143326673330176",
+          "https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/",
           "https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16",
           "https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/",
-          "https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/",
-          "https://redcanary.com/blog/raspberry-robin/",
-          "https://web.archive.org/web/20191023232753/https://twitter.com/Hexacorn/status/1187143326673330176",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_odbcconf_register_dll_regsvr.yml"
         ],
         "tags": [
@@ -25982,9 +26271,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://news.sophos.com/en-us/2022/01/19/zloader-installs-remote-access-backdoors-and-delivers-cobalt-strike/",
           "https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html",
           "https://www.gpg4win.de/documentation.html",
+          "https://news.sophos.com/en-us/2022/01/19/zloader-installs-remote-access-backdoors-and-delivers-cobalt-strike/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_gpg4win_encryption.yml"
         ],
         "tags": [
@@ -26007,10 +26296,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://lolbas-project.github.io/lolbas/Binaries/Wbadmin/",
           "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-backup",
-          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery",
           "https://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Wbadmin.yml",
+          "https://lolbas-project.github.io/lolbas/Binaries/Wbadmin/",
+          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wbadmin_restore_sensitive_files.yml"
         ],
         "tags": [
@@ -26043,8 +26332,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/powershell/module/pki/import-certificate?view=windowsserver2022-ps",
           "https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/",
+          "https://learn.microsoft.com/en-us/powershell/module/pki/import-certificate?view=windowsserver2022-ps",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_import_cert_susp_locations.yml"
         ],
         "tags": [
@@ -26097,6 +26386,42 @@
       "uuid": "d21374ff-f574-44a7-9998-4a8c8bf33d7d",
       "value": "WmiPrvSE Spawned A Process"
     },
+    {
+      "description": "Detects the execution of SharpWSUS or WSUSpendu, utilities that allow for lateral movement through WSUS.\nWindows Server Update Services (WSUS) is a critical component of Windows systems and is frequently configured in a way that allows an attacker to circumvent internal networking limitations.\n",
+      "meta": {
+        "author": "@Kostastsale, Nasreddine Bencherchali (Nextron Systems)",
+        "creation_date": "2022-10-07",
+        "falsepositive": [
+          "Unknown"
+        ],
+        "filename": "proc_creation_win_hktl_sharpwsus_wsuspendu_execution.yml",
+        "level": "high",
+        "logsource.category": "process_creation",
+        "logsource.product": "windows",
+        "refs": [
+          "https://web.archive.org/web/20210512154016/https://github.com/AlsidOfficial/WSUSpendu/blob/master/WSUSpendu.ps1",
+          "https://github.com/nettitude/SharpWSUS",
+          "https://labs.nettitude.com/blog/introducing-sharpwsus/",
+          "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_sharpwsus_wsuspendu_execution.yml"
+        ],
+        "tags": [
+          "attack.execution",
+          "attack.lateral-movement",
+          "attack.t1210"
+        ]
+      },
+      "related": [
+        {
+          "dest-uuid": "9db0cf3a-a3c9-4012-8268-123b9db6fd82",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "related-to"
+        }
+      ],
+      "uuid": "b0ce780f-10bd-496d-9067-066d23dc3aa5",
+      "value": "HackTool - SharpWSUS/WSUSpendu Execution"
+    },
     {
       "description": "Detects the execution of rundll32 with a command line that doesn't contain a common extension",
       "meta": {
@@ -26404,8 +26729,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.002/T1053.002.md",
           "https://eqllib.readthedocs.io/en/latest/analytics/d8db43cf-ed52-4f5c-9fb3-c9a4b95a0b56.html",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.002/T1053.002.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_at_interactive_execution.yml"
         ],
         "tags": [
@@ -26514,8 +26839,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html",
           "https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/",
+          "http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_user_discovery_get_aduser.yml"
         ],
         "tags": [
@@ -26548,8 +26873,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.cybereason.com/blog/threat-analysis-report-lockbit-2.0-all-paths-lead-to-ransom",
           "https://www.darkoperator.com/blog/2018/10/5/operating-offensively-against-sysmon",
+          "https://www.cybereason.com/blog/threat-analysis-report-lockbit-2.0-all-paths-lead-to-ransom",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_fltmc_unload_driver.yml"
         ],
         "tags": [
@@ -26674,11 +26999,11 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://reconshell.com/winpwn-tool-for-internal-windows-pentesting-and-ad-security/",
+          "https://github.com/redcanaryco/atomic-red-team/blob/4d6c4e8e23d465af7a2388620cfe3f8c76e16cf0/atomics/T1082/T1082.md",
           "https://grep.app/search?q=winpwn&filter[repo][0]=redcanaryco/atomic-red-team",
           "https://www.publicnow.com/view/EB87DB49C654D9B63995FAD4C9DE3D3CC4F6C3ED?1671634841",
           "https://github.com/S3cur3Th1sSh1t/WinPwn",
-          "https://github.com/redcanaryco/atomic-red-team/blob/4d6c4e8e23d465af7a2388620cfe3f8c76e16cf0/atomics/T1082/T1082.md",
-          "https://reconshell.com/winpwn-tool-for-internal-windows-pentesting-and-ad-security/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_winpwn.yml"
         ],
         "tags": [
@@ -26771,10 +27096,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/Cyb3rWard0g/status/1453123054243024897",
-          "https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/",
           "https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment",
           "https://github.com/antonioCoco/RogueWinRM",
+          "https://twitter.com/Cyb3rWard0g/status/1453123054243024897",
+          "https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_child_process_as_system_.yml"
         ],
         "tags": [
@@ -26807,8 +27132,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/nao_sec/status/1530196847679401984",
           "https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/",
+          "https://twitter.com/nao_sec/status/1530196847679401984",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_msdt_susp_parent.yml"
         ],
         "tags": [
@@ -27045,8 +27370,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://lolbas-project.github.io/lolbas/Binaries/Msedge/",
           "https://twitter.com/mrd0x/status/1478116126005641220",
+          "https://lolbas-project.github.io/lolbas/Binaries/Msedge/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_browsers_inline_file_download.yml"
         ],
         "tags": [
@@ -27079,8 +27404,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://gist.github.com/nasbench/a989ce64cefa8081bd50cf6ad8c491b5",
           "https://twitter.com/mrd0x/status/1463526834918854661",
+          "https://gist.github.com/nasbench/a989ce64cefa8081bd50cf6ad8c491b5",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pressanykey_lolbin_execution.yml"
         ],
         "tags": [
@@ -27188,12 +27513,12 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://www.joeware.net/freetools/tools/adfind/",
           "https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx",
           "https://thedfirreport.com/2020/05/08/adfind-recon/",
-          "https://www.joeware.net/freetools/tools/adfind/",
+          "https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/",
           "https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/",
           "https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/bf62ece1c679b07b5fb49c4bae947fe24c81811f/fin6/Emulation_Plan/Phase1.md",
-          "https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_renamed_adfind.yml"
         ],
         "tags": [
@@ -27324,8 +27649,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://sushant747.gitbooks.io/total-oscp-guide/content/privilege_escalation_windows.html",
           "https://github.com/carlospolop/PEASS-ng/blob/fa0f2e17fbc1d86f1fd66338a40e665e7182501d/winPEAS/winPEASbat/winPEAS.bat",
+          "https://sushant747.gitbooks.io/total-oscp-guide/content/privilege_escalation_windows.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wmic_recon_hotfix.yml"
         ],
         "tags": [
@@ -27392,10 +27717,10 @@
         "logsource.product": "windows",
         "refs": [
           "https://www.intrinsec.com/akira_ransomware/",
-          "https://github.com/cloudflare/cloudflared/releases",
-          "https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/",
-          "https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/",
           "https://github.com/cloudflare/cloudflared",
+          "https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/",
+          "https://github.com/cloudflare/cloudflared/releases",
+          "https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_renamed_cloudflared.yml"
         ],
         "tags": [
@@ -27428,8 +27753,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/nas_bench/status/1534915321856917506",
           "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Adplus/",
+          "https://twitter.com/nas_bench/status/1534915321856917506",
           "https://twitter.com/nas_bench/status/1534916659676422152",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_adplus_memory_dump.yml"
         ],
@@ -27506,9 +27831,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://news.sophos.com/en-us/2022/01/19/zloader-installs-remote-access-backdoors-and-delivers-cobalt-strike/",
           "https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html",
           "https://www.gpg4win.de/documentation.html",
+          "https://news.sophos.com/en-us/2022/01/19/zloader-installs-remote-access-backdoors-and-delivers-cobalt-strike/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_gpg4win_decryption.yml"
         ],
         "tags": [
@@ -27633,8 +27958,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy",
           "https://learn.microsoft.com/en-us/troubleshoot/windows-client/setup-upgrade-and-drivers/network-provider-settings-removed-in-place-upgrade",
+          "https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_registry_new_network_provider.yml"
         ],
         "tags": [
@@ -27667,9 +27992,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/azure/dns/dns-zones-records",
           "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/dnscmd",
           "https://lolbas-project.github.io/lolbas/Binaries/Dnscmd/",
+          "https://learn.microsoft.com/en-us/azure/dns/dns-zones-records",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_dnscmd_discovery.yml"
         ],
         "tags": [
@@ -27703,8 +28028,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://app.any.run/tasks/f74c5157-8508-4ac6-9805-d63fe7b0d399/",
           "https://twitter.com/swisscom_csirt/status/1331634525722521602?s=20",
+          "https://app.any.run/tasks/f74c5157-8508-4ac6-9805-d63fe7b0d399/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_renamed_rundll32_dllregisterserver.yml"
         ],
         "tags": [
@@ -27851,9 +28176,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md",
-          "https://rvsec0n.wordpress.com/2020/01/24/malwares-that-bypass-windows-defender/",
           "https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/",
+          "https://rvsec0n.wordpress.com/2020/01/24/malwares-that-bypass-windows-defender/",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_disable_defender_av_security_monitoring.yml"
         ],
         "tags": [
@@ -28054,8 +28379,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://anydesk.com/en/changelog/windows",
           "https://www.bleepingcomputer.com/news/security/anydesk-says-hackers-breached-its-production-servers-reset-passwords/",
+          "https://anydesk.com/en/changelog/windows",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_anydesk_revoked_cert.yml"
         ],
         "tags": [
@@ -28080,8 +28405,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://www.uptycs.com/blog/warzonerat-can-now-evade-with-process-hollowing",
-          "https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html",
           "https://reaqta.com/2017/11/short-journey-darkvnc/",
+          "https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_csc_susp_parent.yml"
         ],
         "tags": [
@@ -28139,8 +28464,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://pentestlab.blog/tag/sharpmove/",
           "https://github.com/0xthirteen/SharpMove/",
+          "https://pentestlab.blog/tag/sharpmove/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_sharpmove.yml"
         ],
         "tags": [
@@ -28220,10 +28545,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac",
-          "https://bohops.com/2020/10/15/exploring-the-wdac-microsoft-recommended-block-rules-visualuiaverifynative/",
-          "https://lolbas-project.github.io/lolbas/OtherMSBinaries/VisualUiaVerifyNative/",
           "https://github.com/MicrosoftDocs/windows-itpro-docs/commit/937db704b9148e9cee7c7010cad4d00ce9c4fdad",
+          "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac",
+          "https://lolbas-project.github.io/lolbas/OtherMSBinaries/VisualUiaVerifyNative/",
+          "https://bohops.com/2020/10/15/exploring-the-wdac-microsoft-recommended-block-rules-visualuiaverifynative/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_visualuiaverifynative.yml"
         ],
         "tags": [
@@ -28313,8 +28638,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://sensepost.com/blog/2022/abusing-windows-tokens-to-compromise-active-directory-without-touching-lsass/",
           "https://github.com/sensepost/impersonate",
+          "https://sensepost.com/blog/2022/abusing-windows-tokens-to-compromise-active-directory-without-touching-lsass/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_impersonate.yml"
         ],
         "tags": [
@@ -28343,50 +28668,6 @@
       "uuid": "cf0c254b-22f1-4b2b-8221-e137b3c0af94",
       "value": "HackTool - Impersonate Execution"
     },
-    {
-      "description": "Detects invocation of Microsoft Workflow Compiler, which may permit the execution of arbitrary unsigned code.",
-      "meta": {
-        "author": "Nik Seetharaman, frack113",
-        "creation_date": "2019-01-16",
-        "falsepositive": [
-          "Legitimate MWC use (unlikely in modern enterprise environments)"
-        ],
-        "filename": "proc_creation_win_lolbin_workflow_compiler.yml",
-        "level": "medium",
-        "logsource.category": "process_creation",
-        "logsource.product": "windows",
-        "refs": [
-          "https://lolbas-project.github.io/lolbas/Binaries/Microsoft.Workflow.Compiler/",
-          "https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb",
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md",
-          "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_workflow_compiler.yml"
-        ],
-        "tags": [
-          "attack.defense-evasion",
-          "attack.execution",
-          "attack.t1127",
-          "attack.t1218"
-        ]
-      },
-      "related": [
-        {
-          "dest-uuid": "ff25900d-76d5-449b-a351-8824e62fc81b",
-          "tags": [
-            "estimative-language:likelihood-probability=\"almost-certain\""
-          ],
-          "type": "related-to"
-        },
-        {
-          "dest-uuid": "457c7820-d331-465a-915e-42f85500ccc4",
-          "tags": [
-            "estimative-language:likelihood-probability=\"almost-certain\""
-          ],
-          "type": "related-to"
-        }
-      ],
-      "uuid": "419dbf2b-8a9b-4bea-bf99-7544b050ec8d",
-      "value": "Microsoft Workflow Compiler Execution"
-    },
     {
       "description": "Detects calls to \"SyncInvoke\" that is part of the \"CL_Invocation.ps1\" script to proxy execution using \"System.Diagnostics.Process\"",
       "meta": {
@@ -28400,8 +28681,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/bohops/status/948061991012327424",
           "https://lolbas-project.github.io/lolbas/Scripts/Cl_invocation/",
+          "https://twitter.com/bohops/status/948061991012327424",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_cl_invocation.yml"
         ],
         "tags": [
@@ -28479,43 +28760,6 @@
       "uuid": "67bc0e75-c0a9-4cfc-8754-84a505b63c04",
       "value": "Potentially Suspicious Child Process Of ClickOnce Application"
     },
-    {
-      "description": "Detect usage of the \"ssh.exe\" binary as a proxy to launch other programs",
-      "meta": {
-        "author": "frack113, Nasreddine Bencherchali",
-        "creation_date": "2022-12-29",
-        "falsepositive": [
-          "Legitimate usage for administration purposes"
-        ],
-        "filename": "proc_creation_win_lolbin_ssh.yml",
-        "level": "medium",
-        "logsource.category": "process_creation",
-        "logsource.product": "windows",
-        "refs": [
-          "https://lolbas-project.github.io/lolbas/Binaries/Ssh/",
-          "https://man.openbsd.org/ssh_config#ProxyCommand",
-          "https://man.openbsd.org/ssh_config#LocalCommand",
-          "https://github.com/LOLBAS-Project/LOLBAS/pull/211/files",
-          "https://gtfobins.github.io/gtfobins/ssh/",
-          "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_ssh.yml"
-        ],
-        "tags": [
-          "attack.defense-evasion",
-          "attack.t1202"
-        ]
-      },
-      "related": [
-        {
-          "dest-uuid": "3b0e52ce-517a-4614-a523-1bd5deef6c5e",
-          "tags": [
-            "estimative-language:likelihood-probability=\"almost-certain\""
-          ],
-          "type": "related-to"
-        }
-      ],
-      "uuid": "7d6d30b8-5b91-4b90-a891-46cccaf29598",
-      "value": "Lolbin Ssh.exe Use As Proxy"
-    },
     {
       "description": "Use of the commandline to shutdown or reboot windows",
       "meta": {
@@ -28563,13 +28807,13 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://medium.com/@cyberjyot/lolbin-execution-via-diskshadow-f6ff681a27a4",
-          "https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/",
-          "https://www.lifars.com/wp-content/uploads/2022/01/GriefRansomware_Whitepaper-2.pdf",
           "https://research.checkpoint.com/2022/evilplayout-attack-against-irans-state-broadcaster/",
-          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow",
           "https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration",
+          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow",
           "https://www.zscaler.com/blogs/security-research/technical-analysis-crytox-ransomware",
+          "https://medium.com/@cyberjyot/lolbin-execution-via-diskshadow-f6ff681a27a4",
+          "https://www.lifars.com/wp-content/uploads/2022/01/GriefRansomware_Whitepaper-2.pdf",
+          "https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_diskshadow_child_process_susp.yml"
         ],
         "tags": [
@@ -28602,8 +28846,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://cyble.com/blog/lockfile-ransomware-using-proxyshell-attack-to-deploy-ransomware/",
           "https://www.bitdefender.com/files/News/CaseStudies/study/377/Bitdefender-Whitepaper-WMI-creat4871-en-EN-GenericUse.pdf",
+          "https://cyble.com/blog/lockfile-ransomware-using-proxyshell-attack-to-deploy-ransomware/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wmic_terminate_application.yml"
         ],
         "tags": [
@@ -28803,8 +29047,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/mrd0x/status/1460815932402679809",
           "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Devinit/",
+          "https://twitter.com/mrd0x/status/1460815932402679809",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_devinit_lolbin_usage.yml"
         ],
         "tags": [
@@ -28872,9 +29116,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771151(v=ws.11)",
           "https://ss64.com/nt/dsacls.html",
           "https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/using-dsacls-to-check-ad-object-permissions#password-spraying-anyone",
-          "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771151(v=ws.11)",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_dsacls_password_spray.yml"
         ],
         "tags": [
@@ -28941,8 +29185,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/",
           "https://hausec.com/2021/07/26/cobalt-strike-and-tradecraft/",
+          "https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_cobaltstrike_process_patterns.yml"
         ],
         "tags": [
@@ -28976,10 +29220,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.cybereason.com/blog/deadringer-exposing-chinese-threat-actors-targeting-major-telcos",
-          "https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/",
           "https://twitter.com/EricaZelic/status/1614075109827874817",
           "https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Sysinternals/PsLogList",
+          "https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/",
+          "https://www.cybereason.com/blog/deadringer-exposing-chinese-threat-actors-targeting-major-telcos",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_sysinternals_psloglist.yml"
         ],
         "tags": [
@@ -29028,9 +29272,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/sblmsrsn/status/1445758411803480072?s=20",
           "https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-fe98e74189873d6df72a15df2eaa0315c59ba9cdaca93ecd68afc4ea09194ef2",
           "https://lolbas-project.github.io/lolbas/Binaries/Certoc/",
+          "https://twitter.com/sblmsrsn/status/1445758411803480072?s=20",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_certoc_load_dll_susp_locations.yml"
         ],
         "tags": [
@@ -29132,14 +29376,14 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/SigmaHQ/sigma/issues/3742",
-          "https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e",
-          "https://twitter.com/Hexacorn/status/776122138063409152",
-          "https://reaqta.com/2017/12/mavinject-microsoft-injector/",
-          "https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/6a228d23eefe963ca81f2d52f94b815f61ef5ee0/Tactics/DefenseEvasion.md#t1055-process-injection",
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.004/T1056.004.md",
           "https://twitter.com/gN3mes1s/status/941315826107510784",
+          "https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md",
+          "https://reaqta.com/2017/12/mavinject-microsoft-injector/",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.004/T1056.004.md",
+          "https://twitter.com/Hexacorn/status/776122138063409152",
+          "https://github.com/SigmaHQ/sigma/issues/3742",
+          "https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/6a228d23eefe963ca81f2d52f94b815f61ef5ee0/Tactics/DefenseEvasion.md#t1055-process-injection",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_renamed_mavinject.yml"
         ],
         "tags": [
@@ -29243,29 +29487,6 @@
       "uuid": "1a1ed54a-2ba4-4221-94d5-01dee560d71e",
       "value": "Renamed CreateDump Utility Execution"
     },
-    {
-      "description": "Detects usage of the \"wusa.exe\" (Windows Update Standalone Installer) utility to extract cab using the \"/extract\" argument which is not longer supported. This could indicate an attacker using an old technique",
-      "meta": {
-        "author": "Nasreddine Bencherchali (Nextron Systems)",
-        "creation_date": "2022-08-04",
-        "falsepositive": [
-          "The \"extract\" flag still works on older 'wusa.exe' versions, which could be a legitimate use (monitor the path of the cab being extracted)"
-        ],
-        "filename": "proc_creation_win_wusa_cab_files_extraction.yml",
-        "level": "medium",
-        "logsource.category": "process_creation",
-        "logsource.product": "windows",
-        "refs": [
-          "https://web.archive.org/web/20180331144337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html",
-          "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wusa_cab_files_extraction.yml"
-        ],
-        "tags": [
-          "attack.execution"
-        ]
-      },
-      "uuid": "59b39960-5f9d-4a49-9cef-1e4d2c1d0cb9",
-      "value": "Wusa Extracting Cab Files"
-    },
     {
       "description": "Detects a suspicious LSASS process process clone that could be a sign of credential dumping activity",
       "meta": {
@@ -29279,9 +29500,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/Hexacorn/status/1420053502554951689",
-          "https://twitter.com/SBousseaden/status/1464566846594691073?s=20",
           "https://www.matteomalvica.com/blog/2019/12/02/win-defender-atp-cred-bypass/",
+          "https://twitter.com/SBousseaden/status/1464566846594691073?s=20",
+          "https://twitter.com/Hexacorn/status/1420053502554951689",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lsass_process_clone.yml"
         ],
         "tags": [
@@ -29359,8 +29580,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/takeown",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.001/T1222.001.md#atomic-test-1---take-ownership-using-takeown-utility",
+          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/takeown",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_takeown_recursive_own.yml"
         ],
         "tags": [
@@ -29393,10 +29614,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/ThreatHuntingProject/ThreatHunting/blob/cb22598bb70651f88e0285abc8d835757d2cb596/hunts/suspicious_process_creation_via_windows_event_logs.md",
-          "https://github.com/mbevilacqua/appcompatprocessor/blob/6c847937c5a836e2ce2fe2b915f213c345a3c389/AppCompatSearch.txt",
-          "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses",
           "https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/",
+          "https://github.com/mbevilacqua/appcompatprocessor/blob/6c847937c5a836e2ce2fe2b915f213c345a3c389/AppCompatSearch.txt",
+          "https://github.com/ThreatHuntingProject/ThreatHunting/blob/cb22598bb70651f88e0285abc8d835757d2cb596/hunts/suspicious_process_creation_via_windows_event_logs.md",
+          "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_execution_path.yml"
         ],
         "tags": [
@@ -29495,8 +29716,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://www.nirsoft.net/utils/nircmd2.html#using",
-          "https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/",
           "https://www.nirsoft.net/utils/nircmd.html",
+          "https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pua_nircmd.yml"
         ],
         "tags": [
@@ -29553,8 +29774,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/cobalt-4-5-user-guide.pdf",
           "https://thedfirreport.com/2021/10/04/bazarloader-and-the-conti-leaks/",
+          "https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/cobalt-4-5-user-guide.pdf",
           "https://thedfirreport.com/2022/06/16/sans-ransomware-summit-2022-can-you-detect-this/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_cobaltstrike_bloopers_modules.yml"
         ],
@@ -29588,9 +29809,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/",
-          "https://thedfirreport.com/2022/09/26/bumblebee-round-two/",
           "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime",
+          "https://thedfirreport.com/2022/09/26/bumblebee-round-two/",
+          "https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wab_unusual_parents.yml"
         ],
         "tags": [
@@ -29648,9 +29869,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://eqllib.readthedocs.io/en/latest/analytics/e584f1a1-c303-4885-8a66-21360c90995b.html",
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.003/T1218.003.md",
           "https://lolbas-project.github.io/lolbas/Binaries/Cmstp/",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.003/T1218.003.md",
+          "https://eqllib.readthedocs.io/en/latest/analytics/e584f1a1-c303-4885-8a66-21360c90995b.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_uac_bypass_cmstp.yml"
         ],
         "tags": [
@@ -29692,9 +29913,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://redcanary.com/blog/child-processes/",
-          "https://nasbench.medium.com/what-is-the-dllhost-exe-process-actually-running-ef9fe4c19c08",
           "https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf",
+          "https://nasbench.medium.com/what-is-the-dllhost-exe-process-actually-running-ef9fe4c19c08",
+          "https://redcanary.com/blog/child-processes/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_dllhost_no_cli_execution.yml"
         ],
         "tags": [
@@ -29727,9 +29948,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://app.any.run/tasks/512c1352-6380-4436-b27d-bb62f0c020d6/",
-          "https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf",
           "https://twitter.com/RedDrip7/status/1506480588827467785",
+          "https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf",
+          "https://app.any.run/tasks/512c1352-6380-4436-b27d-bb62f0c020d6/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_schtasks_susp_pattern.yml"
         ],
         "tags": [
@@ -29762,8 +29983,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/pabraeken/status/999090532839313408",
           "https://twitter.com/pabraeken/status/995837734379032576",
+          "https://twitter.com/pabraeken/status/999090532839313408",
           "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msdeploy/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_msdeploy.yml"
         ],
@@ -29873,9 +30094,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/",
-          "https://github.com/The-DFIR-Report/Sigma-Rules/blob/75260568a7ffe61b2458ca05f6f25914efb44337/win_mofcomp_execution.yml",
           "https://learn.microsoft.com/en-us/windows/win32/wmisdk/mofcomp",
+          "https://github.com/The-DFIR-Report/Sigma-Rules/blob/75260568a7ffe61b2458ca05f6f25914efb44337/win_mofcomp_execution.yml",
+          "https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_mofcomp_execution.yml"
         ],
         "tags": [
@@ -29976,17 +30197,17 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.hybrid-analysis.com/sample/465aabe132ccb949e75b8ab9c5bda36d80cf2fd503d52b8bad54e295f28bbc21?environmentId=100",
+          "https://www.vmray.com/analyses/2d2fa29185ad/report/overview.html",
           "https://twitter.com/andythevariable/status/1576953781581144064?s=20&t=QiJILvK4ZiBdR8RJe24u-A",
-          "https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set",
+          "https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml",
           "https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/",
           "https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml",
-          "https://app.any.run/tasks/c903e9c8-0350-440c-8688-3881b556b8e0/",
           "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e",
-          "https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml",
-          "https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml",
           "https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html",
-          "https://www.vmray.com/analyses/2d2fa29185ad/report/overview.html",
+          "https://www.hybrid-analysis.com/sample/465aabe132ccb949e75b8ab9c5bda36d80cf2fd503d52b8bad54e295f28bbc21?environmentId=100",
+          "https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set",
+          "https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml",
+          "https://app.any.run/tasks/c903e9c8-0350-440c-8688-3881b556b8e0/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_office_susp_child_processes.yml"
         ],
         "tags": [
@@ -30036,8 +30257,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://developers.cloudflare.com/cloudflare-one/connections/connect-apps",
           "https://github.com/cloudflare/cloudflared",
+          "https://developers.cloudflare.com/cloudflare-one/connections/connect-apps",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_cloudflared_tunnel_cleanup.yml"
         ],
         "tags": [
@@ -30174,6 +30395,29 @@
       "uuid": "33be4333-2c6b-44f4-ae28-102cdbde0a31",
       "value": "Suspicious Msbuild Execution By Uncommon Parent Process"
     },
+    {
+      "description": "Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.",
+      "meta": {
+        "author": "@Kostastsale, @TheDFIRReport",
+        "creation_date": "2022-12-05",
+        "falsepositive": [
+          "Unknown"
+        ],
+        "filename": "proc_creation_win_susp_emoji_usage_in_cli_2.yml",
+        "level": "high",
+        "logsource.category": "process_creation",
+        "logsource.product": "windows",
+        "refs": [
+          "Internal Research",
+          "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_emoji_usage_in_cli_2.yml"
+        ],
+        "tags": [
+          "attack.defense-evasion"
+        ]
+      },
+      "uuid": "c98f2a0d-e1b8-4f76-90d3-359caf88d6b9",
+      "value": "Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 2"
+    },
     {
       "description": "Detects execution of Microsoft bash launcher with the \"-c\" flag.\nThis can be used to potentially bypass defenses and execute Linux or Windows-based binaries directly via bash.\n",
       "meta": {
@@ -30220,8 +30464,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa",
           "https://www.virustotal.com/gui/file/7872d8845a332dce517adae9c3389fde5313ff2fed38c2577f3b498da786db68/behavior",
+          "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_double_extension_parent.yml"
         ],
         "tags": [
@@ -30278,9 +30522,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/",
           "https://redcanary.com/threat-detection-report/",
           "https://www.cobaltstrike.com/help-windows-executable",
+          "https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_cobaltstrike_load_by_rundll32.yml"
         ],
         "tags": [
@@ -30314,9 +30558,9 @@
         "logsource.product": "windows",
         "refs": [
           "https://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Esentutl.yml",
-          "https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment",
-          "https://room362.com/post/2013/2013-06-10-volume-shadow-copy-ntdsdit-domain-hashes-remotely-part-1/",
           "https://dfironthemountain.wordpress.com/2018/12/06/locked-file-access-using-esentutl-exe/",
+          "https://room362.com/post/2013/2013-06-10-volume-shadow-copy-ntdsdit-domain-hashes-remotely-part-1/",
+          "https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_esentutl_sensitive_file_copy.yml"
         ],
         "tags": [
@@ -30359,8 +30603,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/",
           "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic",
+          "https://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wmic_remote_execution.yml"
         ],
         "tags": [
@@ -30393,8 +30637,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.malwarebytes.com/blog/news/2014/01/the-rtlo-method",
           "https://unicode-explorer.com/c/202E",
+          "https://www.malwarebytes.com/blog/news/2014/01/the-rtlo-method",
           "https://redcanary.com/blog/right-to-left-override/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_right_to_left_override.yml"
         ],
@@ -30428,8 +30672,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/felixw3000/status/853354851128025088",
           "https://twitter.com/rikvduijn/status/853251879320662017",
+          "https://twitter.com/felixw3000/status/853354851128025088",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_rundll32_susp_control_dll_load.yml"
         ],
         "tags": [
@@ -30495,8 +30739,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.hybrid-analysis.com/sample/4be06ecd234e2110bd615649fe4a6fa95403979acf889d7e45a78985eb50acf9?environmentId=1",
           "https://github.com/albertzsigovits/malware-notes/blob/c820c7fea76cf76a861b28ebc77e06100e20ec29/Ransomware/Maze.md",
+          "https://www.hybrid-analysis.com/sample/4be06ecd234e2110bd615649fe4a6fa95403979acf889d7e45a78985eb50acf9?environmentId=1",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wmic_recon_product_class.yml"
         ],
         "tags": [
@@ -30630,9 +30874,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/mrd0x/status/1461041276514623491",
           "https://twitter.com/tccontre18/status/1480950986650832903",
           "https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/",
+          "https://twitter.com/mrd0x/status/1461041276514623491",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_regsvr32_http_ip_pattern.yml"
         ],
         "tags": [
@@ -30665,13 +30909,13 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-hive-ransomware/",
-          "https://www.softperfect.com/products/networkscanner/",
           "https://www.protect.airbus.com/blog/uncovering-cyber-intruders-netscan/",
-          "https://secjoes-reports.s3.eu-central-1.amazonaws.com/Sockbot%2Bin%2BGoLand.pdf",
-          "https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/",
+          "https://www.softperfect.com/products/networkscanner/",
           "https://research.nccgroup.com/2022/07/13/climbing-mount-everest-black-byte-bytes-back/",
+          "https://secjoes-reports.s3.eu-central-1.amazonaws.com/Sockbot%2Bin%2BGoLand.pdf",
           "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/yanluowang-ransomware-attacks-continue",
+          "https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-hive-ransomware/",
+          "https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pua_netscan.yml"
         ],
         "tags": [
@@ -30813,8 +31057,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/",
           "https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin",
+          "https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/",
           "https://isc.sans.edu/diary/22264",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_bitsadmin_download.yml"
         ],
@@ -30968,8 +31212,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md",
           "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wmic_recon_service.yml"
         ],
         "tags": [
@@ -30989,39 +31233,6 @@
       "uuid": "76f55eaa-d27f-4213-9d45-7b0e4b60bbae",
       "value": "Service Reconnaissance Via Wmic.EXE"
     },
-    {
-      "description": "Extexport.exe loads dll and is execute from other folder the original path",
-      "meta": {
-        "author": "frack113",
-        "creation_date": "2021-11-26",
-        "falsepositive": [
-          "Unknown"
-        ],
-        "filename": "proc_creation_win_lolbin_extexport.yml",
-        "level": "medium",
-        "logsource.category": "process_creation",
-        "logsource.product": "windows",
-        "refs": [
-          "https://lolbas-project.github.io/lolbas/Binaries/Extexport/",
-          "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_extexport.yml"
-        ],
-        "tags": [
-          "attack.defense-evasion",
-          "attack.t1218"
-        ]
-      },
-      "related": [
-        {
-          "dest-uuid": "457c7820-d331-465a-915e-42f85500ccc4",
-          "tags": [
-            "estimative-language:likelihood-probability=\"almost-certain\""
-          ],
-          "type": "related-to"
-        }
-      ],
-      "uuid": "fb0b815b-f5f6-4f50-970f-ffe21f253f7a",
-      "value": "Suspicious Extexport Execution"
-    },
     {
       "description": "Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)",
       "meta": {
@@ -31212,9 +31423,9 @@
         "logsource.product": "windows",
         "refs": [
           "https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/",
-          "https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/",
-          "https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml",
           "https://twitter.com/ForensicITGuy/status/1334734244120309760",
+          "https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml",
+          "https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wmiprvse_susp_child_processes.yml"
         ],
         "tags": [
@@ -31264,9 +31475,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://technet.microsoft.com/en-us/library/cc754243(v=ws.11).aspx",
           "https://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1003.005/T1003.005.md#atomic-test-1---cached-credential-dump-via-cmdkey",
           "https://www.peew.pw/blog/2017/11/26/exploring-cmdkey-an-edge-case-for-privilege-escalation",
-          "https://technet.microsoft.com/en-us/library/cc754243(v=ws.11).aspx",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_cmdkey_recon.yml"
         ],
         "tags": [
@@ -31299,9 +31510,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://redcanary.com/blog/lateral-movement-winrm-wmi/",
-          "https://lolbas-project.github.io/lolbas/Scripts/Winrm/",
           "https://twitter.com/bohops/status/994405551751815170",
+          "https://lolbas-project.github.io/lolbas/Scripts/Winrm/",
+          "https://redcanary.com/blog/lateral-movement-winrm-wmi/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_winrm_execution_via_scripting_api_winrm_vbs.yml"
         ],
         "tags": [
@@ -31368,10 +31579,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://support.microsoft.com/fr-fr/topic/an-ms-dos-based-program-that-uses-the-ms-dos-protected-mode-interface-crashes-on-a-computer-that-is-running-windows-7-5dc739ea-987b-b458-15e4-d28d5cca63c7",
-          "https://app.any.run/tasks/93fe92fa-8b2b-4d92-8c09-a841aed2e793/",
-          "https://learn.microsoft.com/en-us/windows/compatibility/ntvdm-and-16-bit-app-support",
           "https://app.any.run/tasks/214094a7-0abc-4a7b-a564-1b757faed79d/",
+          "https://app.any.run/tasks/93fe92fa-8b2b-4d92-8c09-a841aed2e793/",
+          "https://support.microsoft.com/fr-fr/topic/an-ms-dos-based-program-that-uses-the-ms-dos-protected-mode-interface-crashes-on-a-computer-that-is-running-windows-7-5dc739ea-987b-b458-15e4-d28d5cca63c7",
+          "https://learn.microsoft.com/en-us/windows/compatibility/ntvdm-and-16-bit-app-support",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_16bit_application.yml"
         ],
         "tags": [
@@ -31471,8 +31682,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://adsecurity.org/?p=2288",
           "https://www.hybrid-analysis.com/sample/f2943f5e45befa52fb12748ca7171d30096e1d4fc3c365561497c618341299d5?environmentId=100",
+          "https://adsecurity.org/?p=2288",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_sysvol_access.yml"
         ],
         "tags": [
@@ -31569,8 +31780,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://2019.offzone.moscow/ru/report/hunting-for-powershell-abuses/",
           "https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=66",
+          "https://2019.offzone.moscow/ru/report/hunting-for-powershell-abuses/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_cmdline_reversed_strings.yml"
         ],
         "tags": [
@@ -31664,8 +31875,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html",
-          "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-112a",
           "https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps",
+          "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-112a",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_export_certificate.yml"
         ],
         "tags": [
@@ -31783,9 +31994,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://unit42.paloaltonetworks.com/unit42-sure-ill-take-new-combojack-malware-alters-clipboards-steal-cryptocurrency/",
           "https://app.any.run/tasks/c28cabc8-a19f-40f3-a78b-cae506a5c0d4",
           "https://app.any.run/tasks/cfc8870b-ccd7-4210-88cf-a8087476a6d0",
+          "https://unit42.paloaltonetworks.com/unit42-sure-ill-take-new-combojack-malware-alters-clipboards-steal-cryptocurrency/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_attrib_system_susp_paths.yml"
         ],
         "tags": [
@@ -31818,10 +32029,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://youtu.be/5mqid-7zp8k?t=2481",
+          "https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1",
           "https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/",
           "https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html",
-          "https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1",
+          "https://youtu.be/5mqid-7zp8k?t=2481",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_mailboxexport_share.yml"
         ],
         "tags": [
@@ -31946,9 +32157,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin",
           "https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/",
           "https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/",
-          "https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin",
           "https://isc.sans.edu/diary/22264",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_bitsadmin_download_direct_ip.yml"
         ],
@@ -31992,8 +32203,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/cglyer/status/1182389676876980224",
           "https://twitter.com/cglyer/status/1182391019633029120",
+          "https://twitter.com/cglyer/status/1182389676876980224",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wmi_backdoor_exchange_transport_agent.yml"
         ],
         "tags": [
@@ -32049,12 +32260,12 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/",
-          "https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin",
-          "https://isc.sans.edu/diary/22264",
-          "https://www.cisa.gov/uscert/ncas/alerts/aa22-321a",
           "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker",
           "https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/",
+          "https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin",
+          "https://isc.sans.edu/diary/22264",
+          "https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/",
+          "https://www.cisa.gov/uscert/ncas/alerts/aa22-321a",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_bitsadmin_download_file_sharing_domains.yml"
         ],
         "tags": [
@@ -32132,9 +32343,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/DissectMalware/status/998797808907046913",
           "https://www.phpied.com/make-your-javascript-a-windows-exe/",
           "https://lolbas-project.github.io/lolbas/Binaries/Jsc/",
+          "https://twitter.com/DissectMalware/status/998797808907046913",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_jsc_execution.yml"
         ],
         "tags": [
@@ -32167,8 +32378,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md",
           "https://eqllib.readthedocs.io/en/latest/analytics/b8a94d2f-dc75-4630-9d73-1edc6bd26fff.html",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_net_view_share_and_sessions_enum.yml"
         ],
         "tags": [
@@ -32340,6 +32551,40 @@
       "uuid": "883835a7-df45-43e4-bf1d-4268768afda4",
       "value": "Regedit as Trusted Installer"
     },
+    {
+      "description": "Detects the execution of SOAPHound, a .NET tool for collecting Active Directory data, using specific command-line arguments that may indicate an attempt to extract sensitive AD information.\n",
+      "meta": {
+        "author": "@kostastsale",
+        "creation_date": "2024-01-26",
+        "falsepositive": [
+          "Unknown"
+        ],
+        "filename": "proc_creation_win_hktl_soaphound_execution.yml",
+        "level": "high",
+        "logsource.category": "process_creation",
+        "logsource.product": "windows",
+        "refs": [
+          "https://github.com/FalconForceTeam/SOAPHound",
+          "https://medium.com/falconforce/soaphound-tool-to-collect-active-directory-data-via-adws-165aca78288c",
+          "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_soaphound_execution.yml"
+        ],
+        "tags": [
+          "attack.discovery",
+          "attack.t1087"
+        ]
+      },
+      "related": [
+        {
+          "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "related-to"
+        }
+      ],
+      "uuid": "e92a4287-e072-4a40-9739-370c106bb750",
+      "value": "HackTool - SOAPHound Execution"
+    },
     {
       "description": "Detects suspicious child processes of Excel which could be an indicator of lateral movement leveraging the \"ActivateMicrosoftApp\" Excel DCOM object.\n",
       "meta": {
@@ -32353,9 +32598,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://posts.specterops.io/lateral-movement-abuse-the-power-of-dcom-excel-application-3c016d0d9922",
           "https://github.com/grayhatkiller/SharpExShell",
           "https://learn.microsoft.com/en-us/office/vba/api/excel.xlmsapplication",
-          "https://posts.specterops.io/lateral-movement-abuse-the-power-of-dcom-excel-application-3c016d0d9922",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_office_excel_dcom_lateral_movement.yml"
         ],
         "tags": [
@@ -32388,9 +32633,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/sblmsrsn/status/1445758411803480072?s=20",
           "https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-fe98e74189873d6df72a15df2eaa0315c59ba9cdaca93ecd68afc4ea09194ef2",
           "https://lolbas-project.github.io/lolbas/Binaries/Certoc/",
+          "https://twitter.com/sblmsrsn/status/1445758411803480072?s=20",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_certoc_load_dll.yml"
         ],
         "tags": [
@@ -32623,10 +32868,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://twitter.com/CyberRaiju/status/1273597319322058752",
           "https://twitter.com/nas_bench/status/1535322450858233858",
           "https://securityboulevard.com/2019/09/deobfuscating-ostap-trickbots-34000-line-javascript-downloader/",
           "https://twitter.com/bohops/status/1276357235954909188?s=12",
-          "https://twitter.com/CyberRaiju/status/1273597319322058752",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_explorer_break_process_tree.yml"
         ],
         "tags": [
@@ -32659,9 +32904,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage",
           "https://unit42.paloaltonetworks.com/chromeloader-malware/",
           "https://lolbas-project.github.io/lolbas/Binaries/Tar/",
-          "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_tar_extraction.yml"
         ],
         "tags": [
@@ -32703,10 +32948,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://labs.withsecure.com/publications/fin7-target-veeam-servers",
           "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708",
           "https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/",
           "https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv",
-          "https://labs.withsecure.com/publications/fin7-target-veeam-servers",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_download_susp_file_sharing_domains.yml"
         ],
         "tags": [
@@ -32797,8 +33042,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.youtube.com/watch?v=DsJ9ByX84o4&t=6s",
           "https://brica.de/alerts/alert/public/1247926/agent-tesla-keylogger-delivered-inside-a-power-iso-daa-archive/",
+          "https://www.youtube.com/watch?v=DsJ9ByX84o4&t=6s",
           "https://app.any.run/tasks/7eaba74e-c1ea-400f-9c17-5e30eee89906/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_whoami_parent_anomaly.yml"
         ],
@@ -32833,14 +33078,14 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/SigmaHQ/sigma/issues/3742",
-          "https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e",
-          "https://twitter.com/Hexacorn/status/776122138063409152",
-          "https://reaqta.com/2017/12/mavinject-microsoft-injector/",
-          "https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/6a228d23eefe963ca81f2d52f94b815f61ef5ee0/Tactics/DefenseEvasion.md#t1055-process-injection",
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.004/T1056.004.md",
           "https://twitter.com/gN3mes1s/status/941315826107510784",
+          "https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md",
+          "https://reaqta.com/2017/12/mavinject-microsoft-injector/",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.004/T1056.004.md",
+          "https://twitter.com/Hexacorn/status/776122138063409152",
+          "https://github.com/SigmaHQ/sigma/issues/3742",
+          "https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/6a228d23eefe963ca81f2d52f94b815f61ef5ee0/Tactics/DefenseEvasion.md#t1055-process-injection",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_mavinject_process_injection.yml"
         ],
         "tags": [
@@ -32905,8 +33150,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://lolbas-project.github.io/lolbas/Binaries/Wsreset/",
           "https://github.com/hfiref0x/UACME",
+          "https://lolbas-project.github.io/lolbas/Binaries/Wsreset/",
           "https://medium.com/falconforce/falconfriday-detecting-uac-bypasses-0xff16-86c2a9107abf",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_uac_bypass_wsreset_integrity_level.yml"
         ],
@@ -32964,8 +33209,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://eqllib.readthedocs.io/en/latest/analytics/1ec33c93-3d0b-4a28-8014-dbdaae5c60ae.html",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md",
+          "https://eqllib.readthedocs.io/en/latest/analytics/1ec33c93-3d0b-4a28-8014-dbdaae5c60ae.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_rar_compress_data.yml"
         ],
         "tags": [
@@ -33021,9 +33266,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://thedfirreport.com/2021/12/13/diavol-ransomware/",
           "https://www.scythe.io/library/threat-emulation-qakbot",
           "https://sec-consult.com/blog/detail/bumblebee-hunting-with-a-velociraptor/",
-          "https://thedfirreport.com/2021/12/13/diavol-ransomware/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_lolbin_exec_from_non_c_drive.yml"
         ],
         "tags": [
@@ -33079,9 +33324,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://user-images.githubusercontent.com/61026070/136518004-b68cce7d-f9b8-4e9a-9b7b-53b1568a9a94.png",
           "https://bohops.com/2021/10/08/analyzing-and-detecting-a-vmtools-persistence-technique/",
           "https://github.com/vmware/open-vm-tools/blob/master/open-vm-tools/tools.conf",
-          "https://user-images.githubusercontent.com/61026070/136518004-b68cce7d-f9b8-4e9a-9b7b-53b1568a9a94.png",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_vmware_vmtoolsd_susp_child_process.yml"
         ],
         "tags": [
@@ -33185,8 +33430,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/pabraeken/status/990717080805789697",
           "https://lolbas-project.github.io/lolbas/Binaries/Runonce/",
+          "https://twitter.com/pabraeken/status/990717080805789697",
           "https://twitter.com/0gtweet/status/1602644163824156672?s=20&t=kuxbUnZPltpvFPZdCrqPXA",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_runonce_execution.yml"
         ],
@@ -33220,8 +33465,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/sensepost/ruler",
           "https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=49",
+          "https://github.com/sensepost/ruler",
           "https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_office_outlook_susp_child_processes_remote.yml"
         ],
@@ -33263,9 +33508,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://www.echotrail.io/insights/search/regsvr32.exe",
           "https://www.ired.team/offensive-security/code-execution/t1117-regsvr32-aka-squiblydoo",
           "https://redcanary.com/blog/intelligence-insights-april-2022/",
-          "https://www.echotrail.io/insights/search/regsvr32.exe",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_regsvr32_susp_child_process.yml"
         ],
         "tags": [
@@ -33422,8 +33667,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://twitter.com/jseerden/status/1247985304667066373/photo/1",
-          "https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension",
           "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Agentexecutor/",
+          "https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension",
           "https://twitter.com/lefterispan/status/1286259016436514816",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_agentexecutor_potential_abuse.yml"
         ],
@@ -33525,10 +33770,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/mrd0x/status/1511489821247684615",
-          "https://gist.github.com/nasbench/6d58c3c125e2fa1b8f7a09754c1b087f",
-          "https://lolbas-project.github.io/lolbas/OtherMSBinaries/DumpMinitool/",
           "https://twitter.com/mrd0x/status/1511415432888131586",
+          "https://lolbas-project.github.io/lolbas/OtherMSBinaries/DumpMinitool/",
+          "https://gist.github.com/nasbench/6d58c3c125e2fa1b8f7a09754c1b087f",
+          "https://twitter.com/mrd0x/status/1511489821247684615",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_dumpminitool_execution.yml"
         ],
         "tags": [
@@ -33570,8 +33815,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://unit42.paloaltonetworks.com/unit42-sure-ill-take-new-combojack-malware-alters-clipboards-steal-cryptocurrency/",
           "https://www.uptycs.com/blog/lolbins-are-no-laughing-matter",
+          "https://unit42.paloaltonetworks.com/unit42-sure-ill-take-new-combojack-malware-alters-clipboards-steal-cryptocurrency/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_attrib_hiding_files.yml"
         ],
         "tags": [
@@ -33604,8 +33849,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/dotnet/api/microsoft.hpc.scheduler.store.cx509enrollmentwebclassfactoryclass?view=hpc-sdk-5.1.6115",
           "https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=41",
+          "https://learn.microsoft.com/en-us/dotnet/api/microsoft.hpc.scheduler.store.cx509enrollmentwebclassfactoryclass?view=hpc-sdk-5.1.6115",
           "https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=42",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_x509enrollment.yml"
         ],
@@ -33629,7 +33874,7 @@
     {
       "description": "Detects sdiagnhost.exe calling a suspicious child process (e.g. used in exploits for Follina / CVE-2022-30190)",
       "meta": {
-        "author": "Nextron Systems",
+        "author": "Nextron Systems, @Kostastsale",
         "creation_date": "2022-06-01",
         "falsepositive": [
           "Unknown"
@@ -33639,10 +33884,11 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://app.any.run/tasks/c4117d9a-f463-461a-b90f-4cd258746798/",
-          "https://twitter.com/nao_sec/status/1530196847679401984",
           "https://app.any.run/tasks/f420d295-0457-4e9b-9b9e-6732be227583/",
+          "https://app.any.run/tasks/c4117d9a-f463-461a-b90f-4cd258746798/",
+          "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e",
           "https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/",
+          "https://twitter.com/nao_sec/status/1530196847679401984",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_sdiagnhost_susp_child.yml"
         ],
         "tags": [
@@ -33683,8 +33929,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/elastic/protections-artifacts/blob/084067123d3328a823b1c3fdde305b694275c794/behavior/rules/persistence_suspicious_scheduled_task_creation_via_masqueraded_xml_file.toml",
           "https://learn.microsoft.com/en-us/windows/win32/taskschd/daily-trigger-example--xml-",
+          "https://github.com/elastic/protections-artifacts/blob/084067123d3328a823b1c3fdde305b694275c794/behavior/rules/persistence_suspicious_scheduled_task_creation_via_masqueraded_xml_file.toml",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_schtasks_schedule_via_masqueraded_xml_file.yml"
         ],
         "tags": [
@@ -33726,8 +33972,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/",
           "https://www.fireeye.com/blog/threat-research/2020/01/saigon-mysterious-ursnif-fork.html",
+          "https://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/",
           "https://www.vmray.com/cyber-security-blog/analyzing-ursnif-behavior-malware-sandbox/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_driverquery_usage.yml"
         ],
@@ -33784,9 +34030,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://community.broadcom.com/symantecenterprise/communities/community-home/digestviewer/viewthread?MessageKey=6ce94b67-74e1-4333-b16f-000b7fd874f0&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=digestviewer",
           "https://www.exploit-db.com/exploits/37525",
           "https://community.spiceworks.com/topic/2195015-batch-script-to-uninstall-symantec-endpoint-protection",
-          "https://community.broadcom.com/symantecenterprise/communities/community-home/digestviewer/viewthread?MessageKey=6ce94b67-74e1-4333-b16f-000b7fd874f0&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=digestviewer",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_taskkill_sep.yml"
         ],
         "tags": [
@@ -33886,10 +34132,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/",
+          "https://cloud.google.com/blog/topics/threat-intelligence/alphv-ransomware-backup/",
           "https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/raw/800c0e06571993a54e39571cf27fd474dcc5c0bc/2017/2017.11.14.Muddying_the_Water/muddying-the-water-targeted-attacks.pdf",
           "https://github.com/AlessandroZ/LaZagne/tree/master",
-          "https://cloud.google.com/blog/topics/threat-intelligence/alphv-ransomware-backup/",
-          "https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/",
           "https://securelist.com/defttorero-tactics-techniques-and-procedures/107610/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_lazagne.yml"
         ],
@@ -34047,8 +34293,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://web.archive.org/web/20220514073704/https://github.com/ch2sh/Jlaive",
           "https://jstnk9.github.io/jstnk9/research/Jlaive-Antivirus-Evasion-Tool",
+          "https://web.archive.org/web/20220514073704/https://github.com/ch2sh/Jlaive",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_jlaive_batch_execution.yml"
         ],
         "tags": [
@@ -34115,8 +34361,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://ss64.com/nt/netsh.html",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md#atomic-test-2---list-windows-firewall-rules",
+          "https://ss64.com/nt/netsh.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_netsh_fw_rules_discovery.yml"
         ],
         "tags": [
@@ -34151,8 +34397,8 @@
         "refs": [
           "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf",
           "https://www.acronis.com/en-us/blog/posts/lockbit-ransomware/",
-          "https://blog.sygnia.co/kaseya-ransomware-supply-chain-attack",
           "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackbyte-exbyte-ransomware",
+          "https://blog.sygnia.co/kaseya-ransomware-supply-chain-attack",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_cmd_ping_del_combined_execution.yml"
         ],
         "tags": [
@@ -34172,6 +34418,41 @@
       "uuid": "54786ddc-5b8a-11ed-9b6a-0242ac120002",
       "value": "Suspicious Ping/Del Command Combination"
     },
+    {
+      "description": "Detects changes to the registry key \"HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist\" where the value is set to \"0\" in order to hide user account from being listed on the logon screen.\n",
+      "meta": {
+        "author": "@Kostastsale, @TheDFIRReport",
+        "creation_date": "2022-05-14",
+        "falsepositive": [
+          "System administrator activities"
+        ],
+        "filename": "proc_creation_win_registry_special_accounts_hide_user.yml",
+        "level": "medium",
+        "logsource.category": "process_creation",
+        "logsource.product": "windows",
+        "refs": [
+          "https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days/",
+          "https://thedfirreport.com/2024/01/29/buzzing-on-christmas-eve-trigona-ransomware-in-3-hours/",
+          "https://thedfirreport.com/2024/04/01/from-onenote-to-ransomnote-an-ice-cold-intrusion/",
+          "https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/",
+          "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_registry_special_accounts_hide_user.yml"
+        ],
+        "tags": [
+          "attack.t1564.002"
+        ]
+      },
+      "related": [
+        {
+          "dest-uuid": "8c4aef43-48d5-49aa-b2af-c0cd58d30c3d",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "related-to"
+        }
+      ],
+      "uuid": "9ec9fb1b-e059-4489-9642-f270c207923d",
+      "value": "Hiding User Account Via SpecialAccounts Registry Key - CommandLine"
+    },
     {
       "description": "Adversaries may disable security tools to avoid possible detection of their tools and activities by removing Windows Defender Definition Files",
       "meta": {
@@ -34219,8 +34500,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/5c1e6f1b4fafd01c8d1ece85f510160fc1275fbf/atomics/T1546.008/T1546.008.md",
           "https://ss64.com/nt/mklink.html",
+          "https://github.com/redcanaryco/atomic-red-team/blob/5c1e6f1b4fafd01c8d1ece85f510160fc1275fbf/atomics/T1546.008/T1546.008.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_cmd_mklink_osk_cmd.yml"
         ],
         "tags": [
@@ -34299,10 +34580,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://mpgn.gitbook.io/crackmapexec/smb-protocol/authentication/checking-credentials-local",
-          "https://www.mandiant.com/resources/telegram-malware-iranian-espionage",
           "https://www.infosecmatter.com/crackmapexec-module-library/?cmem=mssql-mimikatz",
           "https://www.infosecmatter.com/crackmapexec-module-library/?cmem=smb-pe_inject",
+          "https://www.mandiant.com/resources/telegram-malware-iranian-espionage",
+          "https://mpgn.gitbook.io/crackmapexec/smb-protocol/authentication/checking-credentials-local",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_crackmapexec_execution.yml"
         ],
         "tags": [
@@ -34445,12 +34726,12 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/b/lockbit-attempts-to-stay-afloat-with-a-new-version/technical-appendix-lockbit-ng-dev-analysis.pdf",
-          "https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-report-avaddon-and-new-techniques-emerge-industrial-sector-targeted",
-          "https://www.sentinelone.com/labs/ranzy-ransomware-better-encryption-among-new-features-of-thunderx-derivative/",
-          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-delete-systemstatebackup",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell",
           "https://github.com/albertzsigovits/malware-notes/blob/558898932c1579ff589290092a2c8febefc3a4c9/Ransomware/Lockbit.md",
+          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-delete-systemstatebackup",
+          "https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-report-avaddon-and-new-techniques-emerge-industrial-sector-targeted",
+          "https://www.sentinelone.com/labs/ranzy-ransomware-better-encryption-among-new-features-of-thunderx-derivative/",
+          "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/b/lockbit-attempts-to-stay-afloat-with-a-new-version/technical-appendix-lockbit-ng-dev-analysis.pdf",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wbadmin_delete_all_backups.yml"
         ],
         "tags": [
@@ -34525,8 +34806,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://securityxploded.com/",
           "https://web.archive.org/web/20200601000524/https://cyberx-labs.com/blog/gangnam-industrial-style-apt-campaign-targets-korean-industrial-companies/",
+          "https://securityxploded.com/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_secutyxploded.yml"
         ],
         "tags": [
@@ -34559,10 +34840,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/defaultnamehere/cookie_crimes/",
-          "https://yoroi.company/wp-content/uploads/2022/05/EternityGroup_report_compressed.pdf",
           "https://www.mdsec.co.uk/2022/10/analysing-lastpass-part-1/",
           "https://github.com/wunderwuzzi23/firefox-cookiemonster",
+          "https://yoroi.company/wp-content/uploads/2022/05/EternityGroup_report_compressed.pdf",
+          "https://github.com/defaultnamehere/cookie_crimes/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_browsers_remote_debugging.yml"
         ],
         "tags": [
@@ -34798,9 +35079,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://nmap.org/ncat/",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1095/T1095.md",
           "https://www.revshells.com/",
+          "https://nmap.org/ncat/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pua_netcat.yml"
         ],
         "tags": [
@@ -34900,8 +35181,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/tutorial-for-ntds-goodness-vssadmin-wmis-ntdsdit-system/",
           "https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment",
+          "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/tutorial-for-ntds-goodness-vssadmin-wmis-ntdsdit-system/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_shadow_copies_creation.yml"
         ],
         "tags": [
@@ -35118,11 +35399,11 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.hybrid-analysis.com/search?query=context:74940dcc5b38f9f9b1a0fea760d344735d7d91b610e6d5bd34533dd0153402c5&from_sample=5db135000388385a7644131f&block_redirect=1",
-          "https://en.wikipedia.org/wiki/Hangul_(word_processor)",
           "https://twitter.com/cyberwar_15/status/1187287262054076416",
+          "https://en.wikipedia.org/wiki/Hangul_(word_processor)",
           "https://www.securitynewspaper.com/2016/11/23/technical-teardown-exploit-malware-hwp-files/",
           "https://blog.alyac.co.kr/1901",
+          "https://www.hybrid-analysis.com/search?query=context:74940dcc5b38f9f9b1a0fea760d344735d7d91b610e6d5bd34533dd0153402c5&from_sample=5db135000388385a7644131f&block_redirect=1",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hwp_exploits.yml"
         ],
         "tags": [
@@ -35166,17 +35447,18 @@
         "author": "Cedric MAURUGEON, Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)",
         "creation_date": "2021-09-24",
         "falsepositive": [
-          "Unknown"
+          "Unlikely"
         ],
         "filename": "proc_creation_win_rdrleakdiag_process_dumping.yml",
         "level": "high",
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/",
-          "https://www.pureid.io/dumping-abusing-windows-credentials-part-1/",
           "https://twitter.com/0gtweet/status/1299071304805560321?s=21",
           "https://lolbas-project.github.io/lolbas/Binaries/Rdrleakdiag/",
+          "https://news.sophos.com/en-us/2024/06/05/operation-crimson-palace-a-technical-deep-dive",
+          "https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/",
+          "https://www.pureid.io/dumping-abusing-windows-credentials-part-1/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_rdrleakdiag_process_dumping.yml"
         ],
         "tags": [
@@ -35242,8 +35524,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "http://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/",
           "https://lolbas-project.github.io/lolbas/Binaries/Xwizard/",
+          "http://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_xwizard_execution_non_default_location.yml"
         ],
         "tags": [
@@ -35276,9 +35558,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://businessinsights.bitdefender.com/deep-dive-into-a-backdoordiplomacy-attack-a-study-of-an-attackers-toolkit",
           "https://www.documentcloud.org/documents/5743766-Global-Threat-Report-2019.html",
           "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731033(v=ws.11)",
-          "https://businessinsights.bitdefender.com/deep-dive-into-a-backdoordiplomacy-attack-a-study-of-an-attackers-toolkit",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_ldifde_export.yml"
         ],
         "tags": [
@@ -35368,9 +35650,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://hyp3rlinx.altervista.org/advisories/MICROSOFT_WINDOWS_DEFENDER_TROJAN.WIN32.POWESSERE.G_MITIGATION_BYPASS_PART2.txt",
-          "https://twitter.com/n1nj4sec/status/1421190238081277959",
           "http://hyp3rlinx.altervista.org/advisories/MICROSOFT_WINDOWS_DEFENDER_DETECTION_BYPASS.txt",
+          "https://twitter.com/n1nj4sec/status/1421190238081277959",
+          "https://hyp3rlinx.altervista.org/advisories/MICROSOFT_WINDOWS_DEFENDER_TROJAN.WIN32.POWESSERE.G_MITIGATION_BYPASS_PART2.txt",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_rundll32_mshtml_runhtmlapplication.yml"
         ],
         "tags": [
@@ -35394,8 +35676,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/vysecurity/status/977198418354491392",
           "https://github.com/vysecurity/Aggressor-VYSEC/blob/0d61c80387b9432dab64b8b8a9fb52d20cfef80e/ping.cna",
+          "https://twitter.com/vysecurity/status/977198418354491392",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_ping_hex_ip.yml"
         ],
         "tags": [
@@ -35437,8 +35719,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/",
-          "https://www.trendmicro.com/en_us/research/17/h/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses.html",
           "https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16",
+          "https://www.trendmicro.com/en_us/research/17/h/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_odbcconf_response_file_susp.yml"
         ],
         "tags": [
@@ -35655,8 +35937,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/",
-          "https://web.archive.org/web/20191023232753/https://twitter.com/Hexacorn/status/1187143326673330176",
           "https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/",
+          "https://web.archive.org/web/20191023232753/https://twitter.com/Hexacorn/status/1187143326673330176",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_odbcconf_driver_install.yml"
         ],
         "tags": [
@@ -35689,11 +35971,11 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/nas_bench/status/1433344116071583746",
-          "https://twitter.com/eral4m/status/1479106975967240209",
-          "https://twitter.com/Hexacorn/status/885258886428725250",
           "https://gist.github.com/ryhanson/227229866af52e2d963cf941af135a52",
+          "https://twitter.com/nas_bench/status/1433344116071583746",
           "http://www.hexacorn.com/blog/2017/05/01/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline/",
+          "https://twitter.com/Hexacorn/status/885258886428725250",
+          "https://twitter.com/eral4m/status/1479106975967240209",
           "https://twitter.com/eral4m/status/1479080793003671557",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml"
         ],
@@ -35793,8 +36075,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/archive/blogs/jonathantrull/detecting-sticky-key-backdoors",
           "https://www.fireeye.com/blog/threat-research/2017/03/apt29_domain_frontin.html",
+          "https://learn.microsoft.com/en-us/archive/blogs/jonathantrull/detecting-sticky-key-backdoors",
           "https://www.clearskysec.com/wp-content/uploads/2020/02/ClearSky-Fox-Kitten-Campaign-v1.pdf",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_cmd_sticky_keys_replace.yml"
         ],
@@ -35828,8 +36110,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://forums.veeam.com/veeam-backup-replication-f2/recover-esxi-password-in-veeam-t34630.html",
           "https://thedfirreport.com/2021/12/13/diavol-ransomware/",
+          "https://forums.veeam.com/veeam-backup-replication-f2/recover-esxi-password-in-veeam-t34630.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_sqlcmd_veeam_dump.yml"
         ],
         "tags": [
@@ -35922,11 +36204,11 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil",
-          "https://eqllib.readthedocs.io/en/latest/analytics/5b223758-07d6-4100-9e11-238cfdd0fe97.html",
           "https://gist.github.com/fovtran/ac0624983c7722e80a8f5a4babb170ee",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.001/T1070.001.md",
           "https://jdhnet.wordpress.com/2017/12/19/changing-the-location-of-the-windows-event-logs/",
+          "https://eqllib.readthedocs.io/en/latest/analytics/5b223758-07d6-4100-9e11-238cfdd0fe97.html",
+          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_eventlog_clear.yml"
         ],
         "tags": [
@@ -36134,9 +36416,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://lolbas-project.github.io/lolbas/Binaries/Findstr/",
           "https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/",
           "https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f",
-          "https://lolbas-project.github.io/lolbas/Binaries/Findstr/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_findstr_subfolder_search.yml"
         ],
         "tags": [
@@ -36227,8 +36509,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://app.any.run/tasks/40115012-a919-4208-bfed-41e82cb3dadf/",
-          "http://hyp3rlinx.altervista.org/advisories/Windows_TCPIP_Finger_Command_C2_Channel_and_Bypassing_Security_Software.txt",
           "https://twitter.com/bigmacjpg/status/1349727699863011328?s=12",
+          "http://hyp3rlinx.altervista.org/advisories/Windows_TCPIP_Finger_Command_C2_Channel_and_Bypassing_Security_Software.txt",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_finger_execution.yml"
         ],
         "tags": [
@@ -36401,7 +36683,7 @@
       "value": "Invoke-Obfuscation VAR+ Launcher"
     },
     {
-      "description": "Detects execution of the \"wusa.exe\" (Windows Update Standalone Installer) utility by a parent process that is located in a suspicious location.\n",
+      "description": "Detects execution of the \"wusa.exe\" (Windows Update Standalone Installer) utility by a parent process that is located in a suspicious location.\nAttackers could instantiate an instance of \"wusa.exe\" in order to bypass User Account Control (UAC). They can duplicate the access token from \"wusa.exe\" to gain elevated privileges.\n",
       "meta": {
         "author": "X__Junior (Nextron Systems)",
         "creation_date": "2023-11-26",
@@ -36677,11 +36959,11 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.sans.org/blog/red-team-tactics-hiding-windows-services/",
-          "https://blog.talosintelligence.com/2021/10/threat-hunting-in-large-datasets-by.html",
           "https://twitter.com/0gtweet/status/1628720819537936386",
-          "https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/",
           "https://twitter.com/Alh4zr3d/status/1580925761996828672",
+          "https://www.sans.org/blog/red-team-tactics-hiding-windows-services/",
+          "https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/",
+          "https://blog.talosintelligence.com/2021/10/threat-hunting-in-large-datasets-by.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_sc_sdset_modification.yml"
         ],
         "tags": [
@@ -36716,9 +36998,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://docs.python.org/3/using/cmdline.html#cmdoption-c",
           "https://www.revshells.com/",
           "https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet",
+          "https://docs.python.org/3/using/cmdline.html#cmdoption-c",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_python_inline_command_execution.yml"
         ],
         "tags": [
@@ -36874,10 +37156,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/",
-          "https://www.intrinsec.com/akira_ransomware/",
           "https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/",
           "https://github.com/cloudflare/cloudflared",
+          "https://www.intrinsec.com/akira_ransomware/",
+          "https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_cloudflared_quicktunnel_execution.yml"
         ],
         "tags": [
@@ -36910,8 +37192,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/lib/modules/powershell/persistence/userland/schtasks.py",
           "https://github.com/0xdeadbeefJERKY/PowerSploit/blob/8690399ef70d2cad10213575ac67e8fa90ddf7c3/Persistence/Persistence.psm1",
+          "https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/lib/modules/powershell/persistence/userland/schtasks.py",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_powersploit_empire_default_schtasks.yml"
         ],
         "tags": [
@@ -36958,8 +37240,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://eqllib.readthedocs.io/en/latest/analytics/fcdb99c2-ac3c-4bde-b664-4b336329bed2.html",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1124/T1124.md",
+          "https://eqllib.readthedocs.io/en/latest/analytics/fcdb99c2-ac3c-4bde-b664-4b336329bed2.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_remote_time_discovery.yml"
         ],
         "tags": [
@@ -36992,8 +37274,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://lab52.io/blog/winter-vivern-all-summer/",
           "https://blog.redteam.pl/2020/06/black-kingdom-ransomware.html",
+          "https://lab52.io/blog/winter-vivern-all-summer/",
           "https://hatching.io/blog/powershell-analysis/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_download_patterns.yml"
         ],
@@ -37094,10 +37376,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://enigma0x3.net/2016/11/21/bypassing-application-whitelisting-by-using-rcsi-exe/",
           "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Rcsi/",
-          "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Csi/",
           "https://twitter.com/Z3Jpa29z/status/1317545798981324801",
+          "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Csi/",
+          "https://enigma0x3.net/2016/11/21/bypassing-application-whitelisting-by-using-rcsi-exe/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_csi_execution.yml"
         ],
         "tags": [
@@ -37215,9 +37497,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://github.com/nccgroup/redsnarf/blob/35949b30106ae543dc6f2bc3f1be10c6d9a8d40e/redsnarf.py",
           "https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/",
           "https://github.com/S3cur3Th1sSh1t/Creds/blob/eac23d67f7f90c7fc8e3130587d86158c22aa398/PowershellScripts/jaws-enum.ps1",
-          "https://github.com/nccgroup/redsnarf/blob/35949b30106ae543dc6f2bc3f1be10c6d9a8d40e/redsnarf.py",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wmic_recon_unquoted_service_search.yml"
         ],
         "tags": [
@@ -37284,8 +37566,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://unit42.paloaltonetworks.com/unit42-sofacy-groups-parallel-attacks/",
-          "https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/",
           "https://github.com/offsecginger/koadic/blob/457f9a3ff394c989cdb4c599ab90eb34fb2c762c/data/stager/js/stdlib.js",
+          "https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_koadic.yml"
         ],
         "tags": [
@@ -37334,9 +37616,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Cdb/",
           "https://twitter.com/nas_bench/status/1534957360032120833",
           "https://web.archive.org/web/20170715043507/http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html",
+          "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Cdb/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_cdb_arbitrary_command_execution.yml"
         ],
         "tags": [
@@ -37452,8 +37734,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/Kevin-Robertson/Inveigh",
           "https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/",
+          "https://github.com/Kevin-Robertson/Inveigh",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_inveigh.yml"
         ],
         "tags": [
@@ -37622,8 +37904,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1482/T1482.md",
           "https://posts.specterops.io/an-introduction-to-manual-active-directory-querying-with-dsquery-and-ldapsearch-84943c13d7eb?gi=41b97a644843",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1482/T1482.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_dsquery_domain_trust_discovery.yml"
         ],
         "tags": [
@@ -37742,9 +38024,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/oulusoyum/status/1191329746069655553",
-          "https://lolbas-project.github.io/lolbas/Binaries/Tttracer/",
           "https://twitter.com/mattifestation/status/1196390321783025666",
+          "https://lolbas-project.github.io/lolbas/Binaries/Tttracer/",
+          "https://twitter.com/oulusoyum/status/1191329746069655553",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_tttracer_mod_load.yml"
         ],
         "tags": [
@@ -37987,6 +38269,40 @@
       "uuid": "05ebafc8-7aa2-4bcd-a269-2aec93f9e842",
       "value": "Add New Download Source To Winget"
     },
+    {
+      "description": "Detects uncommon child processes spawning from \"sigverif.exe\", which could indicate potential abuse of the latter as a living of the land binary in order to proxy execution.\n",
+      "meta": {
+        "author": "Nasreddine Bencherchali (Nextron Systems)",
+        "creation_date": "2022-08-19",
+        "falsepositive": [
+          "Unknown"
+        ],
+        "filename": "proc_creation_win_sigverif_uncommon_child_process.yml",
+        "level": "medium",
+        "logsource.category": "process_creation",
+        "logsource.product": "windows",
+        "refs": [
+          "https://twitter.com/0gtweet/status/1457676633809330184",
+          "https://www.hexacorn.com/blog/2018/04/27/i-shot-the-sigverif-exe-the-gui-based-lolbin/",
+          "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_sigverif_uncommon_child_process.yml"
+        ],
+        "tags": [
+          "attack.defense-evasion",
+          "attack.t1216"
+        ]
+      },
+      "related": [
+        {
+          "dest-uuid": "f6fe9070-7a65-49ea-ae72-76292f42cebe",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "related-to"
+        }
+      ],
+      "uuid": "7d4aaec2-08ed-4430-8b96-28420e030e04",
+      "value": "Uncommon Sigverif.EXE Child Process"
+    },
     {
       "description": "Detects the execution of PowerShell with a specific flag sequence that is used by the Wmiexec script",
       "meta": {
@@ -38066,9 +38382,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html",
-          "https://www.sprocketsecurity.com/resources/crossing-the-log4j-horizon-a-vulnerability-with-no-return",
           "https://www.rapid7.com/blog/post/2022/01/18/active-exploitation-of-vmware-horizon-servers/",
+          "https://www.sprocketsecurity.com/resources/crossing-the-log4j-horizon-a-vulnerability-with-no-return",
+          "http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html",
           "https://nodejs.org/api/cli.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_node_abuse.yml"
         ],
@@ -38102,9 +38418,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://labs.withsecure.com/publications/fin7-target-veeam-servers",
           "https://github.com/pr0xylife/IcedID/blob/8dd1e218460db4f750d955b4c65b2f918a1db906/icedID_09.28.2023.txt",
           "https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv",
-          "https://labs.withsecure.com/publications/fin7-target-veeam-servers",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_curl_download_direct_ip_susp_extensions.yml"
         ],
         "tags": [
@@ -38128,8 +38444,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://www.helpnetsecurity.com/2023/08/02/aws-instances-attackers-access/",
-          "https://www.mitiga.io/blog/mitiga-security-advisory-abusing-the-ssm-agent-as-a-remote-access-trojan",
           "https://www.bleepingcomputer.com/news/security/amazons-aws-ssm-agent-can-be-used-as-post-exploitation-rat-malware/",
+          "https://www.mitiga.io/blog/mitiga-security-advisory-abusing-the-ssm-agent-as-a-remote-access-trojan",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_ssm_agent_abuse.yml"
         ],
         "tags": [
@@ -38198,8 +38514,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.youtube.com/watch?v=ro2QuZTIMBM",
           "https://learn.microsoft.com/en-us/sysinternals/downloads/psexec",
+          "https://www.youtube.com/watch?v=ro2QuZTIMBM",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_renamed_sysinternals_psexec_service.yml"
         ],
         "tags": [
@@ -38255,24 +38571,24 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/calebstewart/CVE-2021-1675",
-          "https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1",
-          "https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries",
           "https://github.com/samratashok/nishang",
-          "https://adsecurity.org/?p=2921",
-          "https://github.com/BloodHoundAD/BloodHound/blob/0927441f67161cc6dc08a53c63ceb8e333f55874/Collectors/AzureHound.ps1",
-          "https://github.com/HarmJ0y/DAMP",
-          "https://github.com/DarkCoderSc/PowerRunAsSystem/",
-          "https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/",
-          "https://github.com/adrecon/ADRecon",
-          "https://github.com/Kevin-Robertson/Powermad",
-          "https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1",
-          "https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1",
-          "https://bloodhound.readthedocs.io/en/latest/data-collection/azurehound.html",
           "https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/",
-          "https://github.com/adrecon/AzureADRecon",
+          "https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1",
+          "https://github.com/BloodHoundAD/BloodHound/blob/0927441f67161cc6dc08a53c63ceb8e333f55874/Collectors/AzureHound.ps1",
+          "https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1",
           "https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1",
+          "https://github.com/Kevin-Robertson/Powermad",
+          "https://github.com/calebstewart/CVE-2021-1675",
+          "https://github.com/adrecon/ADRecon",
+          "https://adsecurity.org/?p=2921",
+          "https://github.com/DarkCoderSc/PowerRunAsSystem/",
           "https://github.com/besimorhino/powercat",
+          "https://github.com/adrecon/AzureADRecon",
+          "https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1",
+          "https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/",
+          "https://github.com/HarmJ0y/DAMP",
+          "https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries",
+          "https://bloodhound.readthedocs.io/en/latest/data-collection/azurehound.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_malicious_cmdlets.yml"
         ],
         "tags": [
@@ -38407,50 +38723,6 @@
       "uuid": "bed2a484-9348-4143-8a8a-b801c979301c",
       "value": "Webshell Detection With Command Line Keywords"
     },
-    {
-      "description": "Detects potential abuse of Windows Subsystem for Linux (WSL) binary as a LOLBIN to execute arbitrary Linux or Windows commands",
-      "meta": {
-        "author": "oscd.community, Zach Stanford @svch0st, Nasreddine Bencherchali (Nextron Systems)",
-        "creation_date": "2020-10-05",
-        "falsepositive": [
-          "Automation and orchestration scripts may use this method to execute scripts etc.",
-          "Legitimate use by Windows to kill processes opened via WSL (example VsCode WSL server)"
-        ],
-        "filename": "proc_creation_win_wsl_lolbin_execution.yml",
-        "level": "medium",
-        "logsource.category": "process_creation",
-        "logsource.product": "windows",
-        "refs": [
-          "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Wsl/",
-          "https://twitter.com/nas_bench/status/1535431474429808642",
-          "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wsl_lolbin_execution.yml"
-        ],
-        "tags": [
-          "attack.execution",
-          "attack.defense-evasion",
-          "attack.t1218",
-          "attack.t1202"
-        ]
-      },
-      "related": [
-        {
-          "dest-uuid": "457c7820-d331-465a-915e-42f85500ccc4",
-          "tags": [
-            "estimative-language:likelihood-probability=\"almost-certain\""
-          ],
-          "type": "related-to"
-        },
-        {
-          "dest-uuid": "3b0e52ce-517a-4614-a523-1bd5deef6c5e",
-          "tags": [
-            "estimative-language:likelihood-probability=\"almost-certain\""
-          ],
-          "type": "related-to"
-        }
-      ],
-      "uuid": "dec44ca7-61ad-493c-bfd7-8819c5faa09b",
-      "value": "Arbitrary Command Execution Using WSL"
-    },
     {
       "description": "Detects when a browser process or browser tab is launched from an application that handles document files such as Adobe, Microsoft Office, etc. And connects to a web application over http(s), this could indicate a possible phishing attempt.\n",
       "meta": {
@@ -38498,9 +38770,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.elastic.co/guide/en/security/current/execution-of-com-object-via-xwizard.html",
           "https://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/",
           "https://lolbas-project.github.io/lolbas/Binaries/Xwizard/",
+          "https://www.elastic.co/guide/en/security/current/execution-of-com-object-via-xwizard.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_xwizard_runwizard_com_object_exec.yml"
         ],
         "tags": [
@@ -38601,8 +38873,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://lolbas-project.github.io/lolbas/Binaries/MpCmdRun/",
           "https://web.archive.org/web/20200903194959/https://twitter.com/djmtshepana/status/1301608169496612866",
+          "https://lolbas-project.github.io/lolbas/Binaries/MpCmdRun/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_mpcmdrun_download_arbitrary_file.yml"
         ],
         "tags": [
@@ -38743,9 +39015,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/defender-endpoint/configure-process-opened-file-exclusions-microsoft-defender-antivirus",
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md",
           "https://twitter.com/AdamTheAnalyst/status/1483497517119590403",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md",
+          "https://learn.microsoft.com/en-us/defender-endpoint/configure-process-opened-file-exclusions-microsoft-defender-antivirus",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_base64_mppreference.yml"
         ],
         "tags": [
@@ -38888,10 +39160,10 @@
         "logsource.product": "windows",
         "refs": [
           "https://www.intrinsec.com/akira_ransomware/",
-          "https://github.com/cloudflare/cloudflared/releases",
-          "https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/",
-          "https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/",
           "https://github.com/cloudflare/cloudflared",
+          "https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/",
+          "https://github.com/cloudflare/cloudflared/releases",
+          "https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_cloudflared_portable_execution.yml"
         ],
         "tags": [
@@ -39074,8 +39346,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/pabraeken/status/990758590020452353",
           "https://learn.microsoft.com/en-us/visualstudio/debugger/debug-using-the-just-in-time-debugger?view=vs-2019",
+          "https://twitter.com/pabraeken/status/990758590020452353",
           "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Vsjitdebugger/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_use_of_vsjitdebugger_bin.yml"
         ],
@@ -39167,8 +39439,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://twitter.com/jseerden/status/1247985304667066373/photo/1",
-          "https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension",
           "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Agentexecutor/",
+          "https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension",
           "https://twitter.com/lefterispan/status/1286259016436514816",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_agentexecutor_susp_usage.yml"
         ],
@@ -39269,8 +39541,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://gist.github.com/nasbench/a989ce64cefa8081bd50cf6ad8c491b5",
           "https://twitter.com/mrd0x/status/1463526834918854661",
+          "https://gist.github.com/nasbench/a989ce64cefa8081bd50cf6ad8c491b5",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_renamed_pressanykey.yml"
         ],
         "tags": [
@@ -39304,10 +39576,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.virustotal.com/gui/file/4abe1395a09fda06d897a9c4eb247278c1b6cddda5d126ce5b3f4f499e3b8fa2/behavior",
-          "https://www.virustotal.com/gui/file/34de4c8beded481a4084a1fd77855c3e977e8ac643e5c5842d0f15f7f9b9086f/behavior",
-          "https://www.virustotal.com/gui/file/427616528b7dbc4a6057ac89eb174a3a90f7abcf3f34e5a359b7a910d82f7a72/behavior",
           "https://www.virustotal.com/gui/file/35c22725a92d5cb1016b09421c0a6cdbfd860fd4778b3313669b057d4a131cb7/behavior",
+          "https://www.virustotal.com/gui/file/34de4c8beded481a4084a1fd77855c3e977e8ac643e5c5842d0f15f7f9b9086f/behavior",
+          "https://www.virustotal.com/gui/file/4abe1395a09fda06d897a9c4eb247278c1b6cddda5d126ce5b3f4f499e3b8fa2/behavior",
+          "https://www.virustotal.com/gui/file/427616528b7dbc4a6057ac89eb174a3a90f7abcf3f34e5a359b7a910d82f7a72/behavior",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_certutil_encode_susp_location.yml"
         ],
         "tags": [
@@ -39340,8 +39612,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.youtube.com/watch?v=DsJ9ByX84o4&t=6s",
           "https://brica.de/alerts/alert/public/1247926/agent-tesla-keylogger-delivered-inside-a-power-iso-daa-archive/",
+          "https://www.youtube.com/watch?v=DsJ9ByX84o4&t=6s",
           "https://app.any.run/tasks/7eaba74e-c1ea-400f-9c17-5e30eee89906/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_whoami_output.yml"
         ],
@@ -39376,8 +39648,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://news.sophos.com/en-us/2022/01/19/zloader-installs-remote-access-backdoors-and-delivers-cobalt-strike/",
           "https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html",
+          "https://news.sophos.com/en-us/2022/01/19/zloader-installs-remote-access-backdoors-and-delivers-cobalt-strike/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_gpg4win_susp_location.yml"
         ],
         "tags": [
@@ -39433,12 +39705,12 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://www.localpotato.com/",
+          "https://github.com/ohpe/juicy-potato",
           "https://hunter2.gitbook.io/darthsidious/other/war-stories/domain-admin-in-30-minutes",
+          "https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/",
           "https://pentestlab.blog/2017/04/13/hot-potato/",
           "https://hunter2.gitbook.io/darthsidious/execution/responder-with-ntlm-relay-and-empire",
-          "https://github.com/ohpe/juicy-potato",
-          "https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/",
-          "https://www.localpotato.com/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_relay_attacks_tools.yml"
         ],
         "tags": [
@@ -39541,9 +39813,9 @@
         "refs": [
           "https://labs.f-secure.com/blog/prelude-to-ransomware-systembc",
           "https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html",
-          "https://assets.documentcloud.org/documents/20444693/fbi-pin-egregor-ransomware-bc-01062021.pdf",
           "https://thedfirreport.com/2021/01/18/all-that-for-a-coinminer",
           "https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/",
+          "https://assets.documentcloud.org/documents/20444693/fbi-pin-egregor-ransomware-bc-01062021.pdf",
           "https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Other/Advanced%20IP%20Scanner",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pua_advanced_ip_scanner.yml"
         ],
@@ -39686,8 +39958,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1072/T1072.md",
           "https://www.pdq.com/pdq-deploy/",
+          "https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1072/T1072.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pdqdeploy_execution.yml"
         ],
         "tags": [
@@ -39721,8 +39993,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/knight0x07/WinRAR-Code-Execution-Vulnerability-CVE-2023-38831/blob/26ab6c40b6d2c09bb4fc60feaa4a3a90cfd20c23/Part-1-Overview.md",
           "https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/",
+          "https://github.com/knight0x07/WinRAR-Code-Execution-Vulnerability-CVE-2023-38831/blob/26ab6c40b6d2c09bb4fc60feaa4a3a90cfd20c23/Part-1-Overview.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_winrar_susp_child_process.yml"
         ],
         "tags": [
@@ -39800,8 +40072,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://github.com/samratashok/ADModule",
-          "https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-enumeration-with-ad-module-without-rsat-or-admin-privileges",
           "https://twitter.com/cyb3rops/status/1617108657166061568?s=20",
+          "https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-enumeration-with-ad-module-without-rsat-or-admin-privileges",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_active_directory_module_dll_import.yml"
         ],
         "tags": [
@@ -39814,7 +40086,7 @@
       "value": "Potential Active Directory Enumeration Using AD Module - ProcCreation"
     },
     {
-      "description": "Detects the execution of Windows binaries from within a WSL instance. This could be used to masquerade parent-child relationships",
+      "description": "Detects the execution of Windows binaries from within a WSL instance.\nThis could be used to masquerade parent-child relationships\n",
       "meta": {
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "creation_date": "2023-02-14",
@@ -39895,13 +40167,13 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html",
-          "https://ngrok.com/docs",
-          "https://www.virustotal.com/gui/file/58d21840d915aaf4040ceb89522396124c82f325282f805d1085527e1e2ccfa1/detection",
           "https://cybleinc.com/2021/02/15/ngrok-platform-abused-by-hackers-to-deliver-a-new-wave-of-phishing-attacks/",
-          "https://stackoverflow.com/questions/42442320/ssh-tunnel-to-ngrok-and-initiate-rdp",
           "https://twitter.com/xorJosh/status/1598646907802451969",
           "https://www.softwaretestinghelp.com/how-to-use-ngrok/",
+          "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html",
+          "https://stackoverflow.com/questions/42442320/ssh-tunnel-to-ngrok-and-initiate-rdp",
+          "https://www.virustotal.com/gui/file/58d21840d915aaf4040ceb89522396124c82f325282f805d1085527e1e2ccfa1/detection",
+          "https://ngrok.com/docs",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pua_ngrok.yml"
         ],
         "tags": [
@@ -39967,9 +40239,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md",
           "https://twitter.com/_st0pp3r_/status/1583914515996897281",
-          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_msiexec_execute_dll.yml"
         ],
         "tags": [
@@ -40037,8 +40309,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://social.technet.microsoft.com/wiki/contents/articles/32905.remote-desktop-services-enable-restricted-admin-mode.aspx",
+          "https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/",
           "https://github.com/redcanaryco/atomic-red-team/blob/a8e3cf63e97b973a25903d3df9fd55da6252e564/atomics/T1112/T1112.md",
+          "https://social.technet.microsoft.com/wiki/contents/articles/32905.remote-desktop-services-enable-restricted-admin-mode.aspx",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_reg_lsa_disable_restricted_admin.yml"
         ],
         "tags": [
@@ -40142,8 +40415,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.fortinet.com/content/dam/fortinet/assets/analyst-reports/ar-qakbot.pdf",
           "https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/",
+          "https://www.fortinet.com/content/dam/fortinet/assets/analyst-reports/ar-qakbot.pdf",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_msra_process_injection.yml"
         ],
         "tags": [
@@ -40220,8 +40493,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://www.virustotal.com/gui/file/91ba814a86ddedc7a9d546e26f912c541205b47a853d227756ab1334ade92c3f",
-          "https://learn.microsoft.com/en-us/windows/win32/shell/csidl",
           "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-russia-ukraine-military",
+          "https://learn.microsoft.com/en-us/windows/win32/shell/csidl",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_script_exec_from_env_folder.yml"
         ],
         "tags": [
@@ -40491,12 +40764,12 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://lolbas-project.github.io/lolbas/Binaries/Certutil/",
-          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil",
-          "https://twitter.com/egre55/status/1087685529016193025",
-          "https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/",
           "https://forensicitguy.github.io/agenttesla-vba-certutil-download/",
           "https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/",
+          "https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/",
+          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil",
+          "https://twitter.com/egre55/status/1087685529016193025",
+          "https://lolbas-project.github.io/lolbas/Binaries/Certutil/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_certutil_download_file_sharing_domains.yml"
         ],
         "tags": [
@@ -40531,8 +40804,8 @@
         "refs": [
           "https://github.com/hfiref0x/UACME",
           "https://twitter.com/hFireF0X/status/897640081053364225",
-          "https://medium.com/falconforce/falconfriday-detecting-uac-bypasses-0xff16-86c2a9107abf",
           "https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/",
+          "https://medium.com/falconforce/falconfriday-detecting-uac-bypasses-0xff16-86c2a9107abf",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_uac_bypass_cmstp_com_object_access.yml"
         ],
         "tags": [
@@ -40577,8 +40850,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://posts.slayerlabs.com/living-off-the-land/#gathernetworkinfovbs",
           "https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government",
+          "https://posts.slayerlabs.com/living-off-the-land/#gathernetworkinfovbs",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_gather_network_info.yml"
         ],
         "tags": [
@@ -40620,8 +40893,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/danielbohannon/Invoke-DOSfuscation",
           "https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/dosfuscation-report.pdf",
+          "https://github.com/danielbohannon/Invoke-DOSfuscation",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_cmd_dosfuscation.yml"
         ],
         "tags": [
@@ -40655,15 +40928,15 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.bleepingcomputer.com/news/security/why-everyone-should-disable-vssadmin-exe-now/",
-          "https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment",
+          "https://github.com/Neo23x0/Raccine#the-process",
           "https://redcanary.com/blog/intelligence-insights-october-2021/",
           "https://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/gen_ransomware_command_lines.yar",
+          "https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment",
           "https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/new-teslacrypt-ransomware-arrives-via-spam/",
-          "https://blog.talosintelligence.com/2017/05/wannacry.html",
           "https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100",
-          "https://github.com/Neo23x0/Raccine#the-process",
+          "https://www.bleepingcomputer.com/news/security/why-everyone-should-disable-vssadmin-exe-now/",
           "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackbyte-exbyte-ransomware",
+          "https://blog.talosintelligence.com/2017/05/wannacry.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_shadow_copies_deletion.yml"
         ],
         "tags": [
@@ -40890,8 +41163,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1072/T1072.md",
           "https://www.radmin.fr/",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1072/T1072.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pua_radmin.yml"
         ],
         "tags": [
@@ -40925,9 +41198,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/",
           "https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5",
           "https://lolbas-project.github.io/lolbas/Binaries/Verclsid/",
+          "https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_verclsid_runs_com.yml"
         ],
         "tags": [
@@ -40960,10 +41233,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.4",
-          "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.4",
-          "https://adsecurity.org/?p=2604",
           "https://thedfirreport.com/2021/11/01/from-zero-to-domain-admin/",
+          "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.4",
+          "https://adsecurity.org/?p=2604",
+          "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.4",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_set_policies_to_unsecure_level.yml"
         ],
         "tags": [
@@ -40997,8 +41270,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/",
-          "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10)",
           "https://twitter.com/jonasLyk/status/1555914501802921984",
+          "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10)",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_ntfs_short_name_use_cli.yml"
         ],
         "tags": [
@@ -41104,8 +41377,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks",
           "https://www.elastic.co/security-labs/exploring-the-qbot-attack-pattern",
+          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_schtasks_system.yml"
         ],
         "tags": [
@@ -41229,12 +41502,12 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://lolbas-project.github.io/lolbas/Binaries/Certutil/",
-          "https://twitter.com/JohnLaTwC/status/835149808817991680",
-          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil",
-          "https://learn.microsoft.com/en-us/archive/blogs/pki/basic-crl-checking-with-certutil",
-          "https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/",
           "https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/",
+          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil",
+          "https://lolbas-project.github.io/lolbas/Binaries/Certutil/",
+          "https://learn.microsoft.com/en-us/archive/blogs/pki/basic-crl-checking-with-certutil",
+          "https://twitter.com/JohnLaTwC/status/835149808817991680",
+          "https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_certutil_decode.yml"
         ],
         "tags": [
@@ -41267,9 +41540,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1615/T1615.md",
           "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/gpresult",
           "https://unit42.paloaltonetworks.com/emissary-trojan-changelog-did-operation-lotus-blossom-cause-it-to-evolve/",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1615/T1615.md",
           "https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_gpresult_execution.yml"
         ],
@@ -41303,9 +41576,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.poweradmin.com/paexec/",
-          "https://learn.microsoft.com/en-us/sysinternals/downloads/psexec",
           "https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html",
+          "https://learn.microsoft.com/en-us/sysinternals/downloads/psexec",
+          "https://www.poweradmin.com/paexec/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_sysinternals_psexec_remote_execution.yml"
         ],
         "tags": [
@@ -41363,9 +41636,9 @@
         "logsource.product": "windows",
         "refs": [
           "https://learn.microsoft.com/en-us/troubleshoot/developer/browsers/security-privacy/ie-security-zones-registry-entries",
-          "https://twitter.com/M_haggis/status/1699056847154725107",
-          "https://www.virustotal.com/gui/file/339ff720c74dc44265b917b6d3e3ba0411d61f3cd3c328e9a2bae81592c8a6e5/content",
           "https://twitter.com/JAMESWT_MHT/status/1699042827261391247",
+          "https://www.virustotal.com/gui/file/339ff720c74dc44265b917b6d3e3ba0411d61f3cd3c328e9a2bae81592c8a6e5/content",
+          "https://twitter.com/M_haggis/status/1699056847154725107",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_registry_ie_security_zone_protocol_defaults_downgrade.yml"
         ],
         "tags": [
@@ -41389,8 +41662,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.echotrail.io/insights/search/mshta.exe",
           "https://en.wikipedia.org/wiki/HTML_Application",
+          "https://www.echotrail.io/insights/search/mshta.exe",
           "https://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_mshta_susp_pattern.yml"
         ],
@@ -41425,8 +41698,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html",
-          "https://lolbas-project.github.io/lolbas/Binaries/Rasautou/",
           "https://github.com/fireeye/DueDLLigence",
+          "https://lolbas-project.github.io/lolbas/Binaries/Rasautou/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_rasautou_dll_execution.yml"
         ],
         "tags": [
@@ -41501,8 +41774,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/nas_bench/status/1618021838407495681",
           "https://twitter.com/nas_bench/status/1618021415852335105",
+          "https://twitter.com/nas_bench/status/1618021838407495681",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_vscode_child_processes_anomalies.yml"
         ],
         "tags": [
@@ -41544,9 +41817,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.virustotal.com/gui/search/filename%253A*spoof*%2520filename%253A*ppid*/files",
           "https://www.ired.team/offensive-security/defense-evasion/parent-process-id-ppid-spoofing",
           "https://pentestlab.blog/2020/02/24/parent-pid-spoofing/",
+          "https://www.virustotal.com/gui/search/filename%253A*spoof*%2520filename%253A*ppid*/files",
           "https://www.picussecurity.com/resource/blog/how-to-detect-parent-pid-ppid-spoofing-attacks",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_selectmyparent.yml"
         ],
@@ -41613,14 +41886,14 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/dotnet/runtime/blob/ee2355c801d892f2894b0f7b14a20e6cc50e0e54/docs/design/coreclr/jit/viewing-jit-dumps.md#setting-configuration-variables",
-          "https://github.com/dotnet/runtime/blob/7abe42dc1123722ed385218268bb9fe04556e3d3/src/coreclr/src/inc/clrconfig.h#L33-L39",
           "https://github.com/dotnet/runtime/blob/4f9ae42d861fcb4be2fcd5d3d55d5f227d30e723/docs/coding-guidelines/clr-jit-coding-conventions.md#1412-disabling-code",
           "https://social.msdn.microsoft.com/Forums/vstudio/en-US/0878832e-39d7-4eaf-8e16-a729c4c40975/what-can-i-use-e13c0d23ccbc4e12931bd9cc2eee27e4-for?forum=clr",
-          "https://i.blackhat.com/EU-21/Wednesday/EU-21-Teodorescu-Veni-No-Vidi-No-Vici-Attacks-On-ETW-Blind-EDRs.pdf",
-          "http://managed670.rssing.com/chan-5590147/all_p1.html",
-          "https://twitter.com/_xpn_/status/1268712093928378368",
           "https://github.com/dotnet/runtime/search?p=1&q=COMPlus_&unscoped_q=COMPlus_",
+          "https://twitter.com/_xpn_/status/1268712093928378368",
+          "https://github.com/dotnet/runtime/blob/ee2355c801d892f2894b0f7b14a20e6cc50e0e54/docs/design/coreclr/jit/viewing-jit-dumps.md#setting-configuration-variables",
+          "http://managed670.rssing.com/chan-5590147/all_p1.html",
+          "https://github.com/dotnet/runtime/blob/7abe42dc1123722ed385218268bb9fe04556e3d3/src/coreclr/src/inc/clrconfig.h#L33-L39",
+          "https://i.blackhat.com/EU-21/Wednesday/EU-21-Teodorescu-Veni-No-Vidi-No-Vici-Attacks-On-ETW-Blind-EDRs.pdf",
           "https://bunnyinside.com/?term=f71e8cb9c76a",
           "https://github.com/dotnet/runtime/blob/f62e93416a1799aecc6b0947adad55a0d9870732/src/coreclr/src/inc/clrconfigvalues.h#L35-L38",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_etw_modification_cmdline.yml"
@@ -41678,10 +41951,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://medium.com/tsscyber/pentesting-and-hta-bypassing-powershell-constrained-language-mode-53a42856c997",
-          "https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/xml/xslt/xslt-stylesheet-scripting-using-msxsl-script",
-          "https://0x00sec.org/t/clientside-exploitation-in-2018-how-pentesting-has-changed/7356",
           "http://blog.sevagas.com/?Hacking-around-HTA-files",
+          "https://0x00sec.org/t/clientside-exploitation-in-2018-how-pentesting-has-changed/7356",
+          "https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/xml/xslt/xslt-stylesheet-scripting-using-msxsl-script",
+          "https://medium.com/tsscyber/pentesting-and-hta-bypassing-powershell-constrained-language-mode-53a42856c997",
           "https://twitter.com/mattifestation/status/1326228491302563846",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_mshta_susp_execution.yml"
         ],
@@ -41733,15 +42006,15 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil",
-          "http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html",
-          "http://www.solomonson.com/posts/2010-07-09-reading-eventviewer-command-line/",
-          "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-7.3",
-          "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a",
           "https://www.group-ib.com/blog/apt41-world-tour-2021/",
-          "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-eventlog?view=powershell-5.1",
-          "https://labs.withsecure.com/content/dam/labs/docs/f-secureLABS-tlp-white-lazarus-threat-intel-report2.pdf",
           "https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/",
+          "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-7.3",
+          "https://labs.withsecure.com/content/dam/labs/docs/f-secureLABS-tlp-white-lazarus-threat-intel-report2.pdf",
+          "http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html",
+          "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-eventlog?view=powershell-5.1",
+          "http://www.solomonson.com/posts/2010-07-09-reading-eventviewer-command-line/",
+          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil",
+          "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_eventlog_content_recon.yml"
         ],
         "tags": [
@@ -41944,9 +42217,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://www.sans.org/blog/red-team-tactics-hiding-windows-services/",
           "https://twitter.com/Alh4zr3d/status/1580925761996828672",
           "https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/",
-          "https://www.sans.org/blog/red-team-tactics-hiding-windows-services/",
           "https://blog.talosintelligence.com/2021/10/threat-hunting-in-large-datasets-by.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_sc_sdset_hide_sevices.yml"
         ],
@@ -41982,8 +42255,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://forensafe.com/blogs/typedpaths.html",
           "https://twitter.com/dez_/status/1560101453150257154",
+          "https://forensafe.com/blogs/typedpaths.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_registry_typed_paths_persistence.yml"
         ],
         "tags": [
@@ -42006,9 +42279,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "http://www.hexacorn.com/blog/2019/03/30/sqirrel-packages-manager-as-a-lolbin-a-k-a-many-electron-apps-are-lolbins-by-default/",
-          "http://www.hexacorn.com/blog/2018/08/16/squirrel-as-a-lolbin/",
           "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Squirrel/",
+          "http://www.hexacorn.com/blog/2018/08/16/squirrel-as-a-lolbin/",
+          "http://www.hexacorn.com/blog/2019/03/30/sqirrel-packages-manager-as-a-lolbin-a-k-a-many-electron-apps-are-lolbins-by-default/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_squirrel_proxy_execution.yml"
         ],
         "tags": [
@@ -42042,9 +42315,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin",
           "https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/",
           "https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/",
-          "https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin",
           "https://isc.sans.edu/diary/22264",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_targetfolder.yml"
         ],
@@ -42154,13 +42427,13 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://www.cobaltstrike.com/help-opsec",
           "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/regsvr32",
-          "https://blog.malwarebytes.com/malwarebytes-news/2020/10/kraken-attack-abuses-wer-service/",
-          "https://twitter.com/CyberRaiju/status/1251492025678983169",
           "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/rundll32",
           "https://learn.microsoft.com/en-us/dotnet/framework/tools/regsvcs-exe-net-services-installation-tool",
           "https://learn.microsoft.com/en-us/dotnet/framework/tools/regasm-exe-assembly-registration-tool",
-          "https://www.cobaltstrike.com/help-opsec",
+          "https://twitter.com/CyberRaiju/status/1251492025678983169",
+          "https://blog.malwarebytes.com/malwarebytes-news/2020/10/kraken-attack-abuses-wer-service/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_bad_opsec_sacrificial_processes.yml"
         ],
         "tags": [
@@ -42249,8 +42522,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://cybercryptosec.medium.com/covid-19-cyber-infection-c615ead7c29",
           "https://learn.microsoft.com/en-us/windows/win32/secauthz/mandatory-integrity-control",
+          "https://cybercryptosec.medium.com/covid-19-cyber-infection-c615ead7c29",
           "https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_conhost_legacy_option.yml"
         ],
@@ -42317,8 +42590,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/",
           "https://www.hybrid-analysis.com/sample/e122bc8bf291f15cab182a5d2d27b8db1e7019e4e96bb5cdbd1dfe7446f3f51f?environmentId=100",
+          "https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_eventvwr_susp_child_process.yml"
         ],
         "tags": [
@@ -42431,9 +42704,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.echotrail.io/insights/search/wermgr.exe",
           "https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html",
           "https://github.com/binderlabs/DirCreate2System",
+          "https://www.echotrail.io/insights/search/wermgr.exe",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wermgr_susp_exec_location.yml"
         ],
         "tags": [
@@ -42456,8 +42729,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv",
           "https://labs.withsecure.com/publications/fin7-target-veeam-servers",
+          "https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_curl_download_susp_file_sharing_domains.yml"
         ],
         "tags": [
@@ -42597,8 +42870,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://lolbas-project.github.io/lolbas/Binaries/Infdefaultinstall/",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md#atomic-test-4---infdefaultinstallexe-inf-execution",
+          "https://lolbas-project.github.io/lolbas/Binaries/Infdefaultinstall/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_infdefaultinstall_execute_sct_scripts.yml"
         ],
         "tags": [
@@ -42655,8 +42928,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://blogs.msdn.microsoft.com/canberrapfe/2012/03/30/capture-a-network-trace-without-installing-anything-capture-a-network-trace-of-a-reboot/",
           "https://klausjochem.me/2016/02/03/netsh-the-cyber-attackers-tool-of-choice/",
+          "https://blogs.msdn.microsoft.com/canberrapfe/2012/03/30/capture-a-network-trace-without-installing-anything-capture-a-network-trace-of-a-reboot/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_netsh_packet_capture.yml"
         ],
         "tags": [
@@ -42815,11 +43088,11 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/pfiatde/status/1681977680688738305",
           "https://soroush.me/blog/2010/12/a-dotty-salty-directory-a-secret-place-in-ntfs-for-secret-files/",
-          "https://github.com/redcanaryco/atomic-red-team/blob/5c3b23002d2bbede3c07e7307165fc2a235a427d/atomics/T1564.004/T1564.004.md#atomic-test-5---create-hidden-directory-via-index_allocation",
           "https://sec-consult.com/blog/detail/pentesters-windows-ntfs-tricks-collection/",
           "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/c54dec26-1551-4d3a-a0ea-4fa40f848eb3",
+          "https://twitter.com/pfiatde/status/1681977680688738305",
+          "https://github.com/redcanaryco/atomic-red-team/blob/5c3b23002d2bbede3c07e7307165fc2a235a427d/atomics/T1564.004/T1564.004.md#atomic-test-5---create-hidden-directory-via-index_allocation",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_hidden_dir_index_allocation.yml"
         ],
         "tags": [
@@ -42852,8 +43125,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1115/T1115.md",
           "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/clip",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1115/T1115.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_clip_execution.yml"
         ],
         "tags": [
@@ -42919,8 +43192,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/mrd0x/status/1478234484881436672?s=12",
           "https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html",
+          "https://twitter.com/mrd0x/status/1478234484881436672?s=12",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_file_download.yml"
         ],
         "tags": [
@@ -43055,9 +43328,9 @@
         "logsource.product": "windows",
         "refs": [
           "https://lolbas-project.github.io/lolbas/Binaries/Wsreset/",
-          "https://eqllib.readthedocs.io/en/latest/analytics/532b5ed4-7930-11e9-8f5c-d46d6d62a49e.html",
           "https://www.activecyber.us/activelabs/windows-uac-bypass",
           "https://twitter.com/ReaQta/status/1222548288731217921",
+          "https://eqllib.readthedocs.io/en/latest/analytics/532b5ed4-7930-11e9-8f5c-d46d6d62a49e.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_uac_bypass_wsreset.yml"
         ],
         "tags": [
@@ -43248,8 +43521,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://lolbas-project.github.io/lolbas/Binaries/Eventvwr/#execute",
           "https://twitter.com/orange_8361/status/1518970259868626944",
+          "https://lolbas-project.github.io/lolbas/Binaries/Eventvwr/#execute",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_uac_bypass_eventvwr_recentviews.yml"
         ],
         "tags": [
@@ -43273,8 +43546,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/",
           "https://www.nirsoft.net/utils/nircmd.html",
+          "https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_renamed_nircmd.yml"
         ],
         "tags": [
@@ -43416,8 +43689,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/Gerenios/AADInternals",
           "https://o365blog.com/aadinternals/",
+          "https://github.com/Gerenios/AADInternals",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_aadinternals_cmdlets_execution.yml"
         ],
         "tags": [
@@ -43502,8 +43775,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/convertto-securestring?view=powershell-7.3#examples",
           "https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=65",
+          "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/convertto-securestring?view=powershell-7.3#examples",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_cmdline_convertto_securestring.yml"
         ],
         "tags": [
@@ -43644,8 +43917,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-acl?view=powershell-5.1",
           "https://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c99747976447dc884cb1a39/atomics/T1505.005/T1505.005.md",
+          "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-acl?view=powershell-5.1",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_set_acl.yml"
         ],
         "tags": [
@@ -43669,8 +43942,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://www.nirsoft.net/utils/nircmd2.html#using",
-          "https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/",
           "https://www.nirsoft.net/utils/nircmd.html",
+          "https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pua_nircmd_as_system.yml"
         ],
         "tags": [
@@ -44039,9 +44312,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://kb.acronis.com/content/60892",
           "https://4sysops.com/archives/creating-a-complete-memory-dump-without-a-blue-screen/",
           "https://learn.microsoft.com/en-us/sysinternals/downloads/livekd",
-          "https://kb.acronis.com/content/60892",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_sysinternals_livekd_kernel_memory_dump.yml"
         ],
         "tags": [
@@ -44106,8 +44379,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/",
           "https://redcanary.com/threat-detection-report/threats/qbot/",
+          "https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_reg_defender_exclusion.yml"
         ],
         "tags": [
@@ -44140,8 +44413,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://lolbas-project.github.io/lolbas/OtherMSBinaries/DefaultPack/",
           "https://www.echotrail.io/insights/search/defaultpack.exe",
+          "https://lolbas-project.github.io/lolbas/OtherMSBinaries/DefaultPack/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_defaultpack_uncommon_child_process.yml"
         ],
         "tags": [
@@ -44176,8 +44449,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/",
-          "https://www.trendmicro.com/en_us/research/17/h/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses.html",
           "https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16",
+          "https://www.trendmicro.com/en_us/research/17/h/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_odbcconf_register_dll_regsvr_susp.yml"
         ],
         "tags": [
@@ -44210,8 +44483,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/wdormann/status/1478011052130459653?s=20",
           "https://twitter.com/0gtweet/status/1477925112561209344",
+          "https://twitter.com/wdormann/status/1478011052130459653?s=20",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_format_uncommon_filesystem_load.yml"
         ],
         "tags": [
@@ -44235,8 +44508,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://lolbas-project.github.io/lolbas/Binaries/Msiexec/",
-          "https://twitter.com/_st0pp3r_/status/1583914515996897281",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md",
+          "https://twitter.com/_st0pp3r_/status/1583914515996897281",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_msiexec_dll.yml"
         ],
         "tags": [
@@ -44437,8 +44710,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md",
           "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wmic_recon_process.yml"
         ],
         "tags": [
@@ -44471,8 +44744,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets",
+          "https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment",
           "https://www.wietzebeukema.nl/blog/windows-command-line-obfuscation",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003/T1003.md",
           "https://eqllib.readthedocs.io/en/latest/analytics/aed95fc6-5e3f-49dc-8b35-06508613f979.html",
@@ -44525,9 +44798,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chm-badness-delivers-a-banking-trojan/",
           "https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-27939090904026cc396b0b629c8e4314acd6f5dac40a676edbc87f4567b47eb7",
           "https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/",
-          "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chm-badness-delivers-a-banking-trojan/",
           "https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hh_susp_execution.yml"
         ],
@@ -44710,13 +44983,13 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/Wietze/status/1542107456507203586",
-          "https://twitter.com/shantanukhande/status/1229348874298388484",
-          "https://github.com/Hackndo/lsassy/blob/14d8f8ae596ecf22b449bfe919829173b8a07635/lsassy/dumpmethod/comsvcs.py",
           "https://twitter.com/SBousseaden/status/1167417096374050817",
           "https://twitter.com/Hexacorn/status/1224848930795552769",
           "https://twitter.com/pythonresponder/status/1385064506049630211?s=21",
+          "https://twitter.com/Wietze/status/1542107456507203586",
+          "https://github.com/Hackndo/lsassy/blob/14d8f8ae596ecf22b449bfe919829173b8a07635/lsassy/dumpmethod/comsvcs.py",
           "https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/",
+          "https://twitter.com/shantanukhande/status/1229348874298388484",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_rundll32_process_dump_via_comsvcs.yml"
         ],
         "tags": [
@@ -44759,9 +45032,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://isc.sans.edu/diary/Wipe+the+drive+Stealthy+Malware+Persistence+Mechanism+-+Part+1/15394",
-          "https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html",
           "http://0xthem.blogspot.com/2014/03/t-emporal-persistence-with-and-schtasks.html",
+          "https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html",
+          "https://isc.sans.edu/diary/Wipe+the+drive+Stealthy+Malware+Persistence+Mechanism+-+Part+1/15394",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_bitsadmin_potential_persistence.yml"
         ],
         "tags": [
@@ -44794,8 +45067,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.B.2_C36B49B5-DF58-4A34-9FE9-56189B9DEFEA.md",
           "https://github.com/OTRF/detection-hackathon-apt29/issues/6",
+          "https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.B.2_C36B49B5-DF58-4A34-9FE9-56189B9DEFEA.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_uac_bypass_sdclt.yml"
         ],
         "tags": [
@@ -44829,9 +45102,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://mgreen27.github.io/posts/2019/05/12/BinaryRename.html",
           "https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1036.003/T1036.003.md#atomic-test-1---masquerading-as-windows-lsass-process",
           "https://mgreen27.github.io/posts/2019/05/29/BinaryRename2.html",
+          "https://mgreen27.github.io/posts/2019/05/12/BinaryRename.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_renamed_binary.yml"
         ],
         "tags": [
@@ -44864,9 +45137,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md",
-          "https://ss64.com/ps/foreach-object.html",
           "https://ss64.com/nt/for.html",
+          "https://ss64.com/ps/foreach-object.html",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_network_scan_loop.yml"
         ],
         "tags": [
@@ -44908,9 +45181,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/mrd0x/status/1461041276514623491",
           "https://twitter.com/tccontre18/status/1480950986650832903",
           "https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/",
+          "https://twitter.com/mrd0x/status/1461041276514623491",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_regsvr32_network_pattern.yml"
         ],
         "tags": [
@@ -45197,8 +45470,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/Yasser_Elsnbary/status/1553804135354564608",
           "https://h.43z.one/ipconverter/",
+          "https://twitter.com/Yasser_Elsnbary/status/1553804135354564608",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_obfuscated_ip_via_cli.yml"
         ],
         "tags": [
@@ -45254,8 +45527,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/JohnLaTwC/status/1082851155481288706",
           "https://app.any.run/tasks/f87f1c4e-47e2-4c46-9cf4-31454c06ce03",
+          "https://twitter.com/JohnLaTwC/status/1082851155481288706",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_susp_ps_appdata.yml"
         ],
         "tags": [
@@ -45289,9 +45562,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.poweradmin.com/paexec/",
-          "https://learn.microsoft.com/en-us/sysinternals/downloads/psexec",
           "https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html",
+          "https://learn.microsoft.com/en-us/sysinternals/downloads/psexec",
+          "https://www.poweradmin.com/paexec/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_sysinternals_susp_psexec_paexec_flags.yml"
         ],
         "tags": [
@@ -45360,11 +45633,11 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://lolbas-project.github.io/lolbas/Binaries/DataSvcUtil/",
           "https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/wcf/how-to-add-a-data-service-reference-wcf-data-services",
+          "https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/wcf/generating-the-data-service-client-library-wcf-data-services",
           "https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/wcf/wcf-data-service-client-utility-datasvcutil-exe",
           "https://gist.github.com/teixeira0xfffff/837e5bfed0d1b0a29a7cb1e5dbdd9ca6",
-          "https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/wcf/generating-the-data-service-client-library-wcf-data-services",
-          "https://lolbas-project.github.io/lolbas/Binaries/DataSvcUtil/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_data_exfiltration_by_using_datasvcutil.yml"
         ],
         "tags": [
@@ -45508,8 +45781,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/",
           "https://lolbas-project.github.io/lolbas/Binaries/Ie4uinit/",
+          "https://bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_ie4uinit.yml"
         ],
         "tags": [
@@ -45542,11 +45815,11 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/",
           "https://labs.sentinelone.com/egregor-raas-continues-the-chaos-with-cobalt-strike-and-rclone",
+          "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a",
+          "https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/",
           "https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware",
           "https://www.splunk.com/en_us/blog/security/darkside-ransomware-splunk-threat-update-and-detections.html",
-          "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pua_rclone_execution.yml"
         ],
         "tags": [
@@ -45579,10 +45852,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://web.archive.org/web/20190209154607/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html",
-          "https://atomicredteam.io/defense-evasion/T1220/",
-          "https://lolbas-project.github.io/lolbas/Binaries/Wmic/",
           "https://twitter.com/mattifestation/status/986280382042595328",
+          "https://web.archive.org/web/20190209154607/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html",
+          "https://lolbas-project.github.io/lolbas/Binaries/Wmic/",
+          "https://atomicredteam.io/defense-evasion/T1220/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wmic_squiblytwo_bypass.yml"
         ],
         "tags": [
@@ -45641,8 +45914,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil",
-          "https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63",
           "https://abuse.io/lockergoga.txt",
+          "https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_etw_trace_evasion.yml"
         ],
         "tags": [
@@ -45805,13 +46078,13 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/vletoux/pingcastle",
+          "https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/",
           "https://github.com/802-1x/Compliance/blob/2e53df8b6e89686a0b91116b3f42c8f717dca820/Ping%20Castle/Get-PingCastle-HTMLComplianceReport.ps1#L8",
-          "https://github.com/projectHULK/AD_Recon/blob/dde2daba9b3393a9388cbebda87068972cc0bd3b/SecurityAssessment.ps1#L2699",
           "https://github.com/fengjixuchui/Start-ADEnum/blob/e237a739db98b6104427d833004836507da36a58/Functions/Start-ADEnum.ps1#L450",
           "https://github.com/lkys37en/Start-ADEnum/blob/5b42c54215fe5f57fc59abc52c20487d15764005/Functions/Start-ADEnum.ps1#L680",
+          "https://github.com/projectHULK/AD_Recon/blob/dde2daba9b3393a9388cbebda87068972cc0bd3b/SecurityAssessment.ps1#L2699",
           "https://github.com/EvotecIT/TheDashboard/blob/481a9ce8f82f2fd55fe65220ee6486bae6df0c9d/Examples/RunReports/PingCastle.ps1",
-          "https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/",
+          "https://github.com/vletoux/pingcastle",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pua_pingcastle.yml"
         ],
         "tags": [
@@ -45844,8 +46117,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html",
           "https://www.hybrid-analysis.com/sample/465aabe132ccb949e75b8ab9c5bda36d80cf2fd503d52b8bad54e295f28bbc21?environmentId=100",
+          "https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_office_outlook_susp_child_processes.yml"
         ],
         "tags": [
@@ -46022,8 +46295,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/skelsec/pypykatz",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md#atomic-test-2---registry-parse-with-pypykatz",
+          "https://github.com/skelsec/pypykatz",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_pypykatz.yml"
         ],
         "tags": [
@@ -46132,8 +46405,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://nmap.org/",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md#atomic-test-3---port-scan-nmap-for-windows",
+          "https://nmap.org/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pua_nmap_zenmap.yml"
         ],
         "tags": [
@@ -46167,10 +46440,10 @@
         "logsource.product": "windows",
         "refs": [
           "https://twitter.com/bohops/status/980659399495741441",
-          "https://lolbas-project.github.io/lolbas/Scripts/Manage-bde/",
-          "https://gist.github.com/bohops/735edb7494fe1bd1010d67823842b712",
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1216/T1216.md",
           "https://twitter.com/JohnLaTwC/status/1223292479270600706",
+          "https://gist.github.com/bohops/735edb7494fe1bd1010d67823842b712",
+          "https://lolbas-project.github.io/lolbas/Scripts/Manage-bde/",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1216/T1216.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_manage_bde.yml"
         ],
         "tags": [
@@ -46291,6 +46564,40 @@
       "uuid": "dee4af55-1f22-4e1d-a9d2-4bdc7ecb472a",
       "value": "Disabled Volume Snapshots"
     },
+    {
+      "description": "Detects the execution of \"DXCap.EXE\" with the \"-c\" flag, which allows a user to launch any arbitrary binary or windows package through DXCap itself. This can be abused to potentially bypass application whitelisting.\n",
+      "meta": {
+        "author": "Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems)",
+        "creation_date": "2019-10-26",
+        "falsepositive": [
+          "Legitimate execution of dxcap.exe by legitimate user"
+        ],
+        "filename": "proc_creation_win_dxcap_arbitrary_binary_execution.yml",
+        "level": "medium",
+        "logsource.category": "process_creation",
+        "logsource.product": "windows",
+        "refs": [
+          "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Dxcap/",
+          "https://twitter.com/harr0ey/status/992008180904419328",
+          "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_dxcap_arbitrary_binary_execution.yml"
+        ],
+        "tags": [
+          "attack.defense-evasion",
+          "attack.t1218"
+        ]
+      },
+      "related": [
+        {
+          "dest-uuid": "457c7820-d331-465a-915e-42f85500ccc4",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "related-to"
+        }
+      ],
+      "uuid": "60f16a96-db70-42eb-8f76-16763e333590",
+      "value": "New Capture Session Launched Via DXCap.EXE"
+    },
     {
       "description": "Detects the import of an alternate data stream with regini.exe, regini.exe can be used to modify registry keys.",
       "meta": {
@@ -46304,8 +46611,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/regini",
           "https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f",
+          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/regini",
           "https://lolbas-project.github.io/lolbas/Binaries/Regini/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_regini_ads.yml"
         ],
@@ -46339,8 +46646,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.hybrid-analysis.com/sample/f16c729aad5c74f19784a24257236a8bbe27f7cdc4a89806031ec7f1bebbd475?environmentId=100",
           "https://www.hybrid-analysis.com/sample/3a1f01206684410dbe8f1900bbeaaa543adfcd07368ba646b499fa5274b9edf6?environmentId=100",
+          "https://www.hybrid-analysis.com/sample/f16c729aad5c74f19784a24257236a8bbe27f7cdc4a89806031ec7f1bebbd475?environmentId=100",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_cmd_http_appdata.yml"
         ],
         "tags": [
@@ -46390,8 +46697,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/windows/msix/package/unsigned-package",
           "https://twitter.com/WindowsDocs/status/1620078135080325122",
+          "https://learn.microsoft.com/en-us/windows/msix/package/unsigned-package",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_install_unsigned_appx_packages.yml"
         ],
         "tags": [
@@ -46481,12 +46788,12 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://lolbas-project.github.io/lolbas/Binaries/Certutil/",
-          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil",
-          "https://twitter.com/egre55/status/1087685529016193025",
-          "https://twitter.com/_JohnHammond/status/1708910264261980634",
           "https://forensicitguy.github.io/agenttesla-vba-certutil-download/",
           "https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/",
+          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil",
+          "https://twitter.com/_JohnHammond/status/1708910264261980634",
+          "https://twitter.com/egre55/status/1087685529016193025",
+          "https://lolbas-project.github.io/lolbas/Binaries/Certutil/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_certutil_download_direct_ip.yml"
         ],
         "tags": [
@@ -46561,11 +46868,11 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://mgreen27.github.io/posts/2019/05/12/BinaryRename.html",
+          "https://twitter.com/christophetd/status/1164506034720952320",
+          "https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/megacortex-ransomware-spotted-attacking-enterprise-networks",
           "https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/",
           "https://mgreen27.github.io/posts/2019/05/29/BinaryRename2.html",
-          "https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/megacortex-ransomware-spotted-attacking-enterprise-networks",
-          "https://twitter.com/christophetd/status/1164506034720952320",
+          "https://mgreen27.github.io/posts/2019/05/12/BinaryRename.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_renamed_binary_highly_relevant.yml"
         ],
         "tags": [
@@ -46698,8 +47005,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/windows/win32/projfs/enabling-windows-projected-file-system",
           "https://learn.microsoft.com/en-us/windows/wsl/install-on-server",
+          "https://learn.microsoft.com/en-us/windows/win32/projfs/enabling-windows-projected-file-system",
           "https://learn.microsoft.com/en-us/powershell/module/dism/enable-windowsoptionalfeature?view=windowsserver2022-ps",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_enable_susp_windows_optional_feature.yml"
         ],
@@ -46723,8 +47030,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/",
           "https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin",
+          "https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/",
           "https://isc.sans.edu/diary/22264",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_extensions.yml"
         ],
@@ -46811,8 +47118,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/",
-          "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10)",
           "https://twitter.com/jonasLyk/status/1555914501802921984",
+          "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10)",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_ntfs_short_name_use_image.yml"
         ],
         "tags": [
@@ -46894,8 +47201,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://enigma0x3.net/2016/11/17/bypassing-application-whitelisting-by-using-dnx-exe/",
           "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Csi/",
+          "https://enigma0x3.net/2016/11/17/bypassing-application-whitelisting-by-using-dnx-exe/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_dnx_execute_csharp_code.yml"
         ],
         "tags": [
@@ -47002,8 +47309,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/dotnet/core/diagnostics/dotnet-dump#dotnet-dump-collect",
           "https://twitter.com/bohops/status/1635288066909966338",
+          "https://learn.microsoft.com/en-us/dotnet/core/diagnostics/dotnet-dump#dotnet-dump-collect",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_dotnetdump_memory_dump.yml"
         ],
         "tags": [
@@ -47144,8 +47451,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1220/T1220.md",
+          "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_msxsl_remote_execution.yml"
         ],
         "tags": [
@@ -47178,8 +47485,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.hexacorn.com/blog/2018/08/31/beyond-good-ol-run-key-part-85/",
           "https://cocomelonc.github.io/malware/2022/11/02/malware-pers-18.html",
+          "https://www.hexacorn.com/blog/2018/08/31/beyond-good-ol-run-key-part-85/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_werfault_reflect_debugger_exec.yml"
         ],
         "tags": [
@@ -47246,12 +47553,12 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://lolbas-project.github.io/lolbas/Binaries/Msedge/",
-          "https://lolbas-project.github.io/lolbas/Binaries/msedgewebview2/",
-          "https://chromium.googlesource.com/chromium/chromium/+/master/content/public/common/content_switches.cc",
-          "https://medium.com/@MalFuzzer/one-electron-to-rule-them-all-dc2e9b263daf",
           "https://positive.security/blog/ms-officecmd-rce",
+          "https://medium.com/@MalFuzzer/one-electron-to-rule-them-all-dc2e9b263daf",
+          "https://chromium.googlesource.com/chromium/chromium/+/master/content/public/common/content_switches.cc",
+          "https://lolbas-project.github.io/lolbas/Binaries/Msedge/",
           "https://lolbas-project.github.io/lolbas/Binaries/Teams/",
+          "https://lolbas-project.github.io/lolbas/Binaries/msedgewebview2/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_electron_execution_proxy.yml"
         ],
         "tags": [
@@ -47316,8 +47623,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://posts.slayerlabs.com/living-off-the-land/#gathernetworkinfovbs",
           "https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government",
+          "https://posts.slayerlabs.com/living-off-the-land/#gathernetworkinfovbs",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_gather_network_info_execution.yml"
         ],
         "tags": [
@@ -47394,8 +47701,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://pentestlab.blog/2020/02/10/credential-access-password-filter-dll/",
           "https://github.com/3gstudent/PasswordFilter/tree/master/PasswordFilter",
+          "https://pentestlab.blog/2020/02/10/credential-access-password-filter-dll/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_reg_credential_access_via_password_filter.yml"
         ],
         "tags": [
@@ -47428,8 +47735,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://ss64.com/nt/dsacls.html",
           "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771151(v=ws.11)",
+          "https://ss64.com/nt/dsacls.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_dsacls_abuse_permissions.yml"
         ],
         "tags": [
@@ -47562,11 +47869,11 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/pr0xylife/Qakbot/blob/4f0795d79dabee5bc9dd69f17a626b48852e7869/Qakbot_AA_23.06.2022.txt",
           "https://twitter.com/max_mal_/status/1542461200797163522",
+          "https://www.volexity.com/blog/2022/07/28/sharptongue-deploys-clever-mail-stealing-browser-extension-sharpext/",
           "https://web.archive.org/web/20200128160046/https://twitter.com/reegun21/status/1222093798009790464",
           "https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1105/T1105.md#atomic-test-18---curl-download-file",
-          "https://www.volexity.com/blog/2022/07/28/sharptongue-deploys-clever-mail-stealing-browser-extension-sharpext/",
+          "https://github.com/pr0xylife/Qakbot/blob/4f0795d79dabee5bc9dd69f17a626b48852e7869/Qakbot_AA_23.06.2022.txt",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_curl_susp_download.yml"
         ],
         "tags": [
@@ -47599,9 +47906,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://twitter.com/bryon_/status/975835709587075072",
           "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Sqlps/",
           "https://learn.microsoft.com/en-us/sql/tools/sqlps-utility?view=sql-server-ver15",
-          "https://twitter.com/bryon_/status/975835709587075072",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_mssql_sqlps_susp_execution.yml"
         ],
         "tags": [
@@ -47692,9 +47999,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software",
-          "https://www.virustotal.com/gui/file/91e405e8a527023fb8696624e70498ae83660fe6757cef4871ce9bcc659264d3/details",
           "https://boinc.berkeley.edu/",
+          "https://www.virustotal.com/gui/file/91e405e8a527023fb8696624e70498ae83660fe6757cef4871ce9bcc659264d3/details",
+          "https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_renamed_boinc.yml"
         ],
         "tags": [
@@ -47769,8 +48076,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/",
           "https://www.fireeye.com/blog/threat-research/2020/01/saigon-mysterious-ursnif-fork.html",
+          "https://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/",
           "https://www.vmray.com/cyber-security-blog/analyzing-ursnif-behavior-malware-sandbox/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_driverquery_recon.yml"
         ],
@@ -47794,9 +48101,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://pentestlab.blog/2018/07/04/dumping-domain-password-hashes/",
           "https://twitter.com/vxunderground/status/1423336151860002816?s=20",
           "https://www.virustotal.com/gui/file/03e9b8c2e86d6db450e5eceec057d7e369ee2389b9daecaf06331a95410aa5f8/detection",
-          "https://pentestlab.blog/2018/07/04/dumping-domain-password-hashes/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_cmd_shadowcopy_access.yml"
         ],
         "tags": [
@@ -47829,8 +48136,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://securelist.com/muddywater/88059/",
           "https://www.virustotal.com/#/file/276a765a10f98cda1a38d3a31e7483585ca3722ecad19d784441293acf1b7beb/detection",
+          "https://securelist.com/muddywater/88059/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_file_characteristics.yml"
         ],
         "tags": [
@@ -47863,8 +48170,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/erase",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.004/T1070.004.md",
+          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/erase",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_cmd_del_execution.yml"
         ],
         "tags": [
@@ -48028,10 +48335,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/synacktiv/Radmin3-Password-Cracker/blob/acfc87393e4b7c06353973a14a6c7126a51f36ac/regkey.txt",
-          "https://github.com/HyperSine/how-does-MobaXterm-encrypt-password",
-          "https://isc.sans.edu/diary/More+Data+Exfiltration/25698",
           "https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#inside-the-registry",
+          "https://isc.sans.edu/diary/More+Data+Exfiltration/25698",
+          "https://github.com/HyperSine/how-does-MobaXterm-encrypt-password",
+          "https://github.com/synacktiv/Radmin3-Password-Cracker/blob/acfc87393e4b7c06353973a14a6c7126a51f36ac/regkey.txt",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_registry_enumeration_for_credentials_cli.yml"
         ],
         "tags": [
@@ -48110,8 +48417,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://lolbas-project.github.io/lolbas/Binaries/Regedit/",
           "https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f",
+          "https://lolbas-project.github.io/lolbas/Binaries/Regedit/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_regedit_import_keys_ads.yml"
         ],
         "tags": [
@@ -48144,8 +48451,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.youtube.com/watch?v=ro2QuZTIMBM",
           "https://learn.microsoft.com/en-us/sysinternals/downloads/psexec",
+          "https://www.youtube.com/watch?v=ro2QuZTIMBM",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_sysinternals_psexesvc.yml"
         ],
         "tags": [
@@ -48168,8 +48475,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://lolbas-project.github.io/lolbas/Binaries/Regedit/",
           "https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f",
+          "https://lolbas-project.github.io/lolbas/Binaries/Regedit/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_regedit_export_critical_keys.yml"
         ],
         "tags": [
@@ -48384,9 +48691,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/mrd0x/status/1511489821247684615",
-          "https://lolbas-project.github.io/lolbas/OtherMSBinaries/DumpMinitool/",
           "https://twitter.com/mrd0x/status/1511415432888131586",
+          "https://lolbas-project.github.io/lolbas/OtherMSBinaries/DumpMinitool/",
+          "https://twitter.com/mrd0x/status/1511489821247684615",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_dumpminitool_susp_execution.yml"
         ],
         "tags": [
@@ -48460,8 +48767,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/harleyQu1nn/AggressorScripts",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518/T1518.md",
+          "https://github.com/harleyQu1nn/AggressorScripts",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_reg_software_discovery.yml"
         ],
         "tags": [
@@ -48604,10 +48911,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731033(v=ws.11)",
+          "https://strontic.github.io/xcyclopedia/library/setres.exe-0E30E4C09637D7A128A37B59A3BC4D09.html",
           "https://twitter.com/0gtweet/status/1583356502340870144",
           "https://lolbas-project.github.io/lolbas/Binaries/Setres/",
-          "https://strontic.github.io/xcyclopedia/library/setres.exe-0E30E4C09637D7A128A37B59A3BC4D09.html",
+          "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731033(v=ws.11)",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_setres_uncommon_child_process.yml"
         ],
         "tags": [
@@ -48648,10 +48955,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://twitter.com/gbti_sa/status/1249653895900602375?lang=en",
+          "https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/",
           "https://www.softpedia.com/get/Antivirus/Removal-Tools/ithurricane-PowerTool.shtml",
           "https://www.trendmicro.com/en_us/research/22/i/play-ransomware-s-attack-playbook-unmasks-it-as-another-hive-aff.html",
-          "https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/",
-          "https://twitter.com/gbti_sa/status/1249653895900602375?lang=en",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_powertool.yml"
         ],
         "tags": [
@@ -48684,14 +48991,14 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://thedfirreport.com/2021/08/16/trickbot-leads-up-to-fake-1password-installation/",
+          "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731935(v=ws.11)",
           "https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/",
           "https://book.hacktricks.xyz/windows/basic-cmd-for-pentesters",
-          "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731935(v=ws.11)",
           "https://eqllib.readthedocs.io/en/latest/analytics/03e231a6-74bc-467a-acb1-e5676b0fb55e.html",
+          "https://thedfirreport.com/2021/08/16/trickbot-leads-up-to-fake-1password-installation/",
+          "https://github.com/redcanaryco/atomic-red-team/blob/5360c9d9ffa3b25f6495f7a16e267b719eba2c37/atomics/T1482/T1482.md#atomic-test-2---windows---discover-domain-trusts-with-nltest",
           "https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/",
           "https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/",
-          "https://github.com/redcanaryco/atomic-red-team/blob/5360c9d9ffa3b25f6495f7a16e267b719eba2c37/atomics/T1482/T1482.md#atomic-test-2---windows---discover-domain-trusts-with-nltest",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_nltest_recon.yml"
         ],
         "tags": [
@@ -48806,8 +49113,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://asec.ahnlab.com/en/39828/",
           "https://twitter.com/GelosSnake/status/934900723426439170",
+          "https://asec.ahnlab.com/en/39828/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_system_exe_anomaly.yml"
         ],
         "tags": [
@@ -48841,8 +49148,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://lolbas-project.github.io/lolbas/Binaries/Regedit/",
           "https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f",
+          "https://lolbas-project.github.io/lolbas/Binaries/Regedit/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_regedit_import_keys.yml"
         ],
         "tags": [
@@ -48910,9 +49217,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "http://www.korznikov.com/2017/03/0-day-or-feature-privilege-escalation.html",
           "https://www.ired.team/offensive-security/lateral-movement/t1076-rdp-hijacking-for-lateral-movement",
           "https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6",
-          "http://www.korznikov.com/2017/03/0-day-or-feature-privilege-escalation.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_tscon_localsystem.yml"
         ],
         "tags": [
@@ -48947,10 +49254,10 @@
         "logsource.product": "windows",
         "refs": [
           "https://blog.cluster25.duskrise.com/2023/05/22/back-in-black-blackbyte-nt",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070/T1070.md",
           "https://eqllib.readthedocs.io/en/latest/analytics/c91f422a-5214-4b17-8664-c5fcf115c0a2.html",
           "https://github.com/albertzsigovits/malware-notes/blob/558898932c1579ff589290092a2c8febefc3a4c9/Ransomware/Lockbit.md",
           "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn",
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070/T1070.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_fsutil_usage.yml"
         ],
         "tags": [
@@ -48992,9 +49299,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://github.com/gordonbay/Windows-On-Reins/blob/e587ac7a0407847865926d575e3c46f68cf7c68d/wor.ps1",
           "https://vms.drweb.fr/virus/?i=24144899",
           "https://bidouillesecurity.com/disable-windows-defender-in-powershell/",
-          "https://github.com/gordonbay/Windows-On-Reins/blob/e587ac7a0407847865926d575e3c46f68cf7c68d/wor.ps1",
           "https://twitter.com/JohnLaTwC/status/1415295021041979392",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_reg_disable_sec_services.yml"
         ],
@@ -49029,8 +49336,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://thedfirreport.com/2021/08/01/bazarcall-to-conti-ransomware-via-trickbot-and-cobalt-strike/",
-          "https://attack.mitre.org/software/S0404/",
           "https://twitter.com/vxunderground/status/1423336151860002816",
+          "https://attack.mitre.org/software/S0404/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_esentutl_params.yml"
         ],
         "tags": [
@@ -49298,8 +49605,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/nas_bench/status/1537896324837781506",
           "https://github.com/GossiTheDog/ThreatHunting/blob/e85884abbf05d5b41efc809ea6532b10b45bd05c/AdvancedHuntingQueries/DogWalk-DiagCab",
+          "https://twitter.com/nas_bench/status/1537896324837781506",
           "https://irsl.medium.com/the-trouble-with-microsofts-troubleshooters-6e32fc80b8bd",
           "https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-9015912909545e72ed42cbac4d1e96295e8964579c406d23fd9c47a8091576a0",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_msdt_susp_cab_options.yml"
@@ -49334,8 +49641,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://asec.ahnlab.com/en/38156/",
           "https://github.com/fatedier/frp",
+          "https://asec.ahnlab.com/en/38156/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pua_frp.yml"
         ],
         "tags": [
@@ -49368,9 +49675,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://github.com/pr0xylife/Pikabot/blob/main/Pikabot_30.10.2023.txt",
           "https://github.com/pr0xylife/Pikabot/blob/main/Pikabot_22.12.2023.txt",
           "Internal Research",
-          "https://github.com/pr0xylife/Pikabot/blob/main/Pikabot_30.10.2023.txt",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wscript_cscript_susp_child_processes.yml"
         ],
         "tags": [
@@ -49492,8 +49799,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/erase",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.004/T1070.004.md",
+          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/erase",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_cmd_rmdir_execution.yml"
         ],
         "tags": [
@@ -49559,9 +49866,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.hhs.gov/sites/default/files/manage-engine-vulnerability-sector-alert-tlpclear.pdf",
-          "https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/",
           "https://github.com/redcanaryco/atomic-red-team/blob/987e3ca988ae3cff4b9f6e388c139c05bf44bbb8/atomics/T1518.001/T1518.001.md#atomic-test-1---security-software-discovery",
+          "https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/",
+          "https://www.hhs.gov/sites/default/files/manage-engine-vulnerability-sector-alert-tlpclear.pdf",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_findstr_security_keyword_lookup.yml"
         ],
         "tags": [
@@ -49662,8 +49969,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html",
           "https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=44",
+          "https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html",
           "https://support.microsoft.com/en-us/topic/how-to-control-the-rule-actions-to-start-an-application-or-run-a-macro-in-outlook-2016-and-outlook-2013-e4964b72-173c-959d-5d7b-ead562979048",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_office_outlook_enable_unsafe_client_mail_rules.yml"
         ],
@@ -49706,8 +50013,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/",
           "https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment",
+          "https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_meterpreter_getsystem.yml"
         ],
         "tags": [
@@ -49823,9 +50130,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/fr0s7_/status/1712780207105404948",
-          "https://twitter.com/Yasser_Elsnbary/status/1553804135354564608",
           "https://h.43z.one/ipconverter/",
+          "https://twitter.com/Yasser_Elsnbary/status/1553804135354564608",
+          "https://twitter.com/fr0s7_/status/1712780207105404948",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_obfuscated_ip_download.yml"
         ],
         "tags": [
@@ -49946,6 +50253,29 @@
       "uuid": "86588b36-c6d3-465f-9cee-8f9093e07798",
       "value": "Scheduled Task Executing Payload from Registry"
     },
+    {
+      "description": "Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.",
+      "meta": {
+        "author": "@Kostastsale, @TheDFIRReport",
+        "creation_date": "2022-12-05",
+        "falsepositive": [
+          "Unknown"
+        ],
+        "filename": "proc_creation_win_susp_emoji_usage_in_cli_3.yml",
+        "level": "high",
+        "logsource.category": "process_creation",
+        "logsource.product": "windows",
+        "refs": [
+          "Internal Research",
+          "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_emoji_usage_in_cli_3.yml"
+        ],
+        "tags": [
+          "attack.defense-evasion"
+        ]
+      },
+      "uuid": "f9578658-9e71-4711-b634-3f9b50cd3c06",
+      "value": "Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3"
+    },
     {
       "description": "An adversary might use WMI to discover information about the system, such as the volume name, size,\nfree space, and other disk information. This can be done using the `wmic` command-line utility and has been\nobserved being used by threat actors such as Volt Typhoon.\n",
       "meta": {
@@ -50038,8 +50368,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.poweradmin.com/paexec/",
           "https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s05-att&cking-fin7.pdf",
+          "https://www.poweradmin.com/paexec/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_renamed_paexec.yml"
         ],
         "tags": [
@@ -50106,8 +50436,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://blog.jourdant.me/post/3-ways-to-download-files-with-powershell",
           "https://4sysops.com/archives/use-powershell-to-download-a-file-with-http-https-and-ftp/",
+          "https://blog.jourdant.me/post/3-ways-to-download-files-with-powershell",
           "https://learn.microsoft.com/en-us/powershell/module/bitstransfer/add-bitsfile?view=windowsserver2019-ps",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_web_request_cmd_and_cmdlets.yml"
         ],
@@ -50353,8 +50683,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://www.sans.org/blog/protecting-privileged-domain-accounts-lm-hashes-the-good-the-bad-and-the-ugly/",
-          "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a",
           "https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/prevent-windows-store-lm-hash-password",
+          "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_reg_nolmhash.yml"
         ],
         "tags": [
@@ -50497,9 +50827,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://security.stackexchange.com/questions/210843/is-it-possible-to-change-original-filename-of-an-exe",
           "https://www.virustotal.com/gui/file/02e8e8c5d430d8b768980f517b62d7792d690982b9ba0f7e04163cbc1a6e7915",
           "https://github.com/electron/rcedit",
-          "https://security.stackexchange.com/questions/210843/is-it-possible-to-change-original-filename-of-an-exe",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pua_rcedit_execution.yml"
         ],
         "tags": [
@@ -50590,13 +50920,13 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1087.002/T1087.002.md#atomic-test-7---adfind---enumerate-active-directory-user-objects",
+          "https://www.joeware.net/freetools/tools/adfind/",
           "https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx",
           "https://thedfirreport.com/2020/05/08/adfind-recon/",
-          "https://www.joeware.net/freetools/tools/adfind/",
+          "https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/",
+          "https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1087.002/T1087.002.md#atomic-test-7---adfind---enumerate-active-directory-user-objects",
           "https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/",
           "https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/bf62ece1c679b07b5fb49c4bae947fe24c81811f/fin6/Emulation_Plan/Phase1.md",
-          "https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pua_adfind_susp_usage.yml"
         ],
         "tags": [
@@ -50654,8 +50984,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://sourceforge.net/projects/mouselock/",
           "https://github.com/klsecservices/Publications/blob/657deb6a6eb6e00669afd40173f425fb49682eaa/Incident-Response-Analyst-Report-2020.pdf",
+          "https://sourceforge.net/projects/mouselock/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pua_mouselock_execution.yml"
         ],
         "tags": [
@@ -50689,8 +51019,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731033(v=ws.11)",
           "https://strontic.github.io/xcyclopedia/library/ldifde.exe-979DE101F5059CEC1D2C56967CA2BAC0.html",
+          "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731033(v=ws.11)",
           "https://twitter.com/0gtweet/status/1564968845726580736",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_ldifde_file_load.yml"
         ],
@@ -50808,12 +51138,12 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/b/lockbit-attempts-to-stay-afloat-with-a-new-version/technical-appendix-lockbit-ng-dev-analysis.pdf",
-          "https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-report-avaddon-and-new-techniques-emerge-industrial-sector-targeted",
-          "https://www.sentinelone.com/labs/ranzy-ransomware-better-encryption-among-new-features-of-thunderx-derivative/",
-          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-delete-systemstatebackup",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell",
           "https://github.com/albertzsigovits/malware-notes/blob/558898932c1579ff589290092a2c8febefc3a4c9/Ransomware/Lockbit.md",
+          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-delete-systemstatebackup",
+          "https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-report-avaddon-and-new-techniques-emerge-industrial-sector-targeted",
+          "https://www.sentinelone.com/labs/ranzy-ransomware-better-encryption-among-new-features-of-thunderx-derivative/",
+          "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/b/lockbit-attempts-to-stay-afloat-with-a-new-version/technical-appendix-lockbit-ng-dev-analysis.pdf",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wbadmin_delete_backups.yml"
         ],
         "tags": [
@@ -50888,8 +51218,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://eqllib.readthedocs.io/en/latest/analytics/c4732632-9c1d-4980-9fa8-1d98c93f918e.html",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md",
+          "https://eqllib.readthedocs.io/en/latest/analytics/c4732632-9c1d-4980-9fa8-1d98c93f918e.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_bcdedit_boot_conf_tamper.yml"
         ],
         "tags": [
@@ -50990,9 +51320,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Dotnet/",
           "https://bohops.com/2019/08/19/dotnet-core-a-vector-for-awl-bypass-defense-evasion/",
           "https://twitter.com/_felamos/status/1204705548668555264",
-          "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Dotnet/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_dotnet_arbitrary_dll_csproj_execution.yml"
         ],
         "tags": [
@@ -51025,9 +51355,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://lolbas-project.github.io/lolbas/Binaries/Findstr/",
           "https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/",
           "https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f",
-          "https://lolbas-project.github.io/lolbas/Binaries/Findstr/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_findstr_download.yml"
         ],
         "tags": [
@@ -51085,9 +51415,9 @@
         "logsource.product": "windows",
         "refs": [
           "https://lolbas-project.github.io/lolbas/Libraries/Setupapi/",
-          "https://gist.githubusercontent.com/bohops/0cc6586f205f3691e04a1ebf1806aabd/raw/baf7b29891bb91e76198e30889fbf7d6642e8974/calc_exe.inf",
-          "https://raw.githubusercontent.com/huntresslabs/evading-autoruns/master/shady.inf",
           "https://twitter.com/Z3Jpa29z/status/1313742350292746241?s=20",
+          "https://raw.githubusercontent.com/huntresslabs/evading-autoruns/master/shady.inf",
+          "https://gist.githubusercontent.com/bohops/0cc6586f205f3691e04a1ebf1806aabd/raw/baf7b29891bb91e76198e30889fbf7d6642e8974/calc_exe.inf",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_rundll32_setupapi_installhinfsection.yml"
         ],
         "tags": [
@@ -51341,8 +51671,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.001/T1218.001.md",
           "https://eqllib.readthedocs.io/en/latest/analytics/b25aa548-7937-11e9-8f5c-d46d6d62a49e.html",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.001/T1218.001.md",
           "https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hh_chm_execution.yml"
         ],
@@ -51511,9 +51841,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://www.hexacorn.com/blog/2018/04/20/kernel-hacking-tool-you-might-have-never-heard-of-xuetr-pchunter/",
           "https://web.archive.org/web/20231210115125/http://www.xuetr.com/",
           "https://www.crowdstrike.com/blog/falcon-overwatch-report-finds-increase-in-ecrime/",
-          "https://www.hexacorn.com/blog/2018/04/20/kernel-hacking-tool-you-might-have-never-heard-of-xuetr-pchunter/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_pchunter.yml"
         ],
         "tags": [
@@ -51612,8 +51942,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.autohotkey.com/download/",
           "https://thedfirreport.com/2023/02/06/collect-exfiltrate-sleep-repeat/",
+          "https://www.autohotkey.com/download/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_renamed_autohotkey.yml"
         ],
         "tags": [
@@ -51669,9 +51999,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.carbonblack.com/2014/06/10/screenshot-demo-hunt-evil-faster-than-ever-with-carbon-black/",
-          "https://web.archive.org/web/20180718061628/https://securitybytes.io/blue-team-fundamentals-part-two-windows-processes-759fe15965e2",
           "https://www.13cubed.com/downloads/windows_process_genealogy_v2.pdf",
+          "https://web.archive.org/web/20180718061628/https://securitybytes.io/blue-team-fundamentals-part-two-windows-processes-759fe15965e2",
+          "https://www.carbonblack.com/2014/06/10/screenshot-demo-hunt-evil-faster-than-ever-with-carbon-black/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_proc_wrong_parent.yml"
         ],
         "tags": [
@@ -51745,8 +52075,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/84215139ee5127f8e3a117e063b604812bd71928/atomics/T1047/T1047.md#atomic-test-5---wmi-execute-local-process",
           "https://www.sans.org/blog/wmic-for-incident-response/",
+          "https://github.com/redcanaryco/atomic-red-team/blob/84215139ee5127f8e3a117e063b604812bd71928/atomics/T1047/T1047.md#atomic-test-5---wmi-execute-local-process",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wmic_process_creation.yml"
         ],
         "tags": [
@@ -51780,9 +52110,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.007/T1546.007.md",
-          "https://web.archive.org/web/20160928212230/https://www.adaptforward.com/2016/09/using-netshell-to-execute-evil-dlls-and-persist-on-a-host/",
           "https://github.com/outflanknl/NetshHelperBeacon",
+          "https://web.archive.org/web/20160928212230/https://www.adaptforward.com/2016/09/using-netshell-to-execute-evil-dlls-and-persist-on-a-host/",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.007/T1546.007.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_netsh_helper_dll_persistence.yml"
         ],
         "tags": [
@@ -52097,8 +52427,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://twitter.com/vysecurity/status/974806438316072960",
-          "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh875578(v=ws.11)",
           "https://twitter.com/vysecurity/status/873181705024266241",
+          "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh875578(v=ws.11)",
           "https://lolbas-project.github.io/lolbas/Binaries/Rpcping/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_rpcping_credential_capture.yml"
         ],
@@ -52301,8 +52631,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://blogs.blackberry.com/en/2022/05/dirty-deeds-done-dirt-cheap-russian-rat-offers-backdoor-bargains",
           "https://github.com/redcanaryco/atomic-red-team/blob/d0dad62dbcae9c60c519368e82c196a3db577055/atomics/T1124/T1124.md",
+          "https://blogs.blackberry.com/en/2022/05/dirty-deeds-done-dirt-cheap-russian-rat-offers-backdoor-bargains",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_w32tm.yml"
         ],
         "tags": [
@@ -52443,9 +52773,9 @@
         "logsource.product": "windows",
         "refs": [
           "https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment?slide=43",
-          "https://www.youtube.com/watch?v=JGs-aKf2OtU&ab_channel=OFFZONEMOSCOW",
-          "https://github.com/gladiatx0r/Powerless/blob/04f553bbc0c65baf4e57344deff84e3f016e6b51/Powerless.bat",
           "https://github.com/carlospolop/PEASS-ng/blob/fa0f2e17fbc1d86f1fd66338a40e665e7182501d/winPEAS/winPEASbat/winPEAS.bat",
+          "https://github.com/gladiatx0r/Powerless/blob/04f553bbc0c65baf4e57344deff84e3f016e6b51/Powerless.bat",
+          "https://www.youtube.com/watch?v=JGs-aKf2OtU&ab_channel=OFFZONEMOSCOW",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_sysinternals_accesschk_check_permissions.yml"
         ],
         "tags": [
@@ -52478,9 +52808,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://labs.withsecure.com/publications/fin7-target-veeam-servers",
           "https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/",
           "https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv",
-          "https://labs.withsecure.com/publications/fin7-target-veeam-servers",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wget_download_susp_file_sharing_domains.yml"
         ],
         "tags": [
@@ -52536,8 +52866,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://lolbas-project.github.io/lolbas/Binaries/Regedit/",
           "https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f",
+          "https://lolbas-project.github.io/lolbas/Binaries/Regedit/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_regedit_export_keys.yml"
         ],
         "tags": [
@@ -52775,9 +53105,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage",
           "https://unit42.paloaltonetworks.com/chromeloader-malware/",
           "https://lolbas-project.github.io/lolbas/Binaries/Tar/",
-          "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_tar_compression.yml"
         ],
         "tags": [
@@ -52941,31 +53271,6 @@
       "uuid": "517490a7-115a-48c6-8862-1a481504d5a8",
       "value": "Potential Shim Database Persistence via Sdbinst.EXE"
     },
-    {
-      "description": "Detects suspicious LOLBIN AccCheckConsole execution with parameters as used to load an arbitrary DLL",
-      "meta": {
-        "author": "Florian Roth (Nextron Systems)",
-        "creation_date": "2022-01-06",
-        "falsepositive": [
-          "Legitimate use of the UI Accessibility Checker"
-        ],
-        "filename": "proc_creation_win_lolbin_susp_acccheckconsole.yml",
-        "level": "high",
-        "logsource.category": "process_creation",
-        "logsource.product": "windows",
-        "refs": [
-          "https://lolbas-project.github.io/lolbas/OtherMSBinaries/AccCheckConsole/",
-          "https://twitter.com/bohops/status/1477717351017680899?s=12",
-          "https://gist.github.com/bohops/2444129419c8acf837aedda5f0e7f340",
-          "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_susp_acccheckconsole.yml"
-        ],
-        "tags": [
-          "attack.execution"
-        ]
-      },
-      "uuid": "0f6da907-5854-4be6-859a-e9958747b0aa",
-      "value": "Suspicious LOLBIN AccCheckConsole"
-    },
     {
       "description": "Detects audio capture via PowerShell Cmdlet.",
       "meta": {
@@ -52979,9 +53284,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://eqllib.readthedocs.io/en/latest/analytics/ab7a6ef4-0983-4275-a4f1-5c6bd3c31c23.html",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1123/T1123.md",
           "https://github.com/frgnca/AudioDeviceCmdlets",
+          "https://eqllib.readthedocs.io/en/latest/analytics/ab7a6ef4-0983-4275-a4f1-5c6bd3c31c23.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_audio_capture.yml"
         ],
         "tags": [
@@ -53014,8 +53319,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-4---system-discovery-using-sharpview",
           "https://github.com/tevora-threat/SharpView/",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-4---system-discovery-using-sharpview",
           "https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/PowerView.ps1",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_sharpview.yml"
         ],
@@ -53226,8 +53531,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://hackingiscool.pl/cmdhijack-command-argument-confusion-with-path-traversal-in-cmd-exe/",
           "https://twitter.com/Oddvarmoe/status/1270633613449723905",
+          "https://hackingiscool.pl/cmdhijack-command-argument-confusion-with-path-traversal-in-cmd-exe/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_cmd_path_traversal.yml"
         ],
         "tags": [
@@ -53407,8 +53712,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1082/T1082.md#atomic-test-6---hostname-discovery-windows",
           "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/hostname",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1082/T1082.md#atomic-test-6---hostname-discovery-windows",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hostname_execution.yml"
         ],
         "tags": [
@@ -53519,9 +53824,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md",
           "https://twitter.com/_st0pp3r_/status/1583914244344799235",
           "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_msiexec_install_quiet.yml"
         ],
         "tags": [
@@ -53541,6 +53846,29 @@
       "uuid": "79a87aa6-e4bd-42fc-a5bb-5e6fbdcd62f5",
       "value": "Msiexec Quiet Installation"
     },
+    {
+      "description": "Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.",
+      "meta": {
+        "author": "@Kostastsale, @TheDFIRReport",
+        "creation_date": "2022-12-05",
+        "falsepositive": [
+          "Unknown"
+        ],
+        "filename": "proc_creation_win_susp_emoji_usage_in_cli_4.yml",
+        "level": "high",
+        "logsource.category": "process_creation",
+        "logsource.product": "windows",
+        "refs": [
+          "Internal Research",
+          "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_emoji_usage_in_cli_4.yml"
+        ],
+        "tags": [
+          "attack.defense-evasion"
+        ]
+      },
+      "uuid": "225274c4-8dd1-40db-9e09-71dff4f6fb3c",
+      "value": "Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 4"
+    },
     {
       "description": "Detects potential abuse of the provisioning registry key for indirect command execution through \"Provlaunch.exe\".",
       "meta": {
@@ -53554,8 +53882,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/",
           "https://twitter.com/0gtweet/status/1674399582162153472",
+          "https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_registry_provlaunch_provisioning_command.yml"
         ],
         "tags": [
@@ -53588,8 +53916,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/mrd0x/status/1478234484881436672?s=12",
           "https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html",
+          "https://twitter.com/mrd0x/status/1478234484881436672?s=12",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_exec.yml"
         ],
         "tags": [
@@ -53623,9 +53951,9 @@
         "logsource.product": "windows",
         "refs": [
           "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/mode",
-          "https://www.virustotal.com/gui/file/5e75ef02517afd6e8ba6462b19217dc4a5a574abb33d10eb0f2bab49d8d48c22/behavior",
-          "https://learn.microsoft.com/en-us/windows/win32/intl/code-page-identifiers",
           "https://strontic.github.io/xcyclopedia/library/mode.com-59D1ED51ACB8C3D50F1306FD75F20E99.html",
+          "https://learn.microsoft.com/en-us/windows/win32/intl/code-page-identifiers",
+          "https://www.virustotal.com/gui/file/5e75ef02517afd6e8ba6462b19217dc4a5a574abb33d10eb0f2bab49d8d48c22/behavior",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_mode_codepage_russian.yml"
         ],
         "tags": [
@@ -53658,9 +53986,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Sqldumper/",
           "https://twitter.com/countuponsec/status/910977826853068800",
           "https://twitter.com/countuponsec/status/910969424215232518",
+          "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Sqldumper/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_susp_sqldumper_activity.yml"
         ],
         "tags": [
@@ -53694,8 +54022,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://twitter.com/splinter_code/status/1483815103279603714",
-          "https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3",
           "https://www.elastic.co/security-labs/operation-bleeding-bear",
+          "https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3",
           "https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pua_advancedrun_priv_user.yml"
         ],
@@ -53765,8 +54093,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://pentestlab.blog/tag/svchost/",
           "https://www.n00py.io/2021/05/dumping-plaintext-rdp-credentials-from-svchost-exe/",
+          "https://pentestlab.blog/tag/svchost/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_tasklist_module_enumeration.yml"
         ],
         "tags": [
@@ -53871,8 +54199,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/0gtweet/status/1206692239839289344",
           "https://lolbas-project.github.io/lolbas/Binaries/Runexehelper/",
+          "https://twitter.com/0gtweet/status/1206692239839289344",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_runexehelper.yml"
         ],
         "tags": [
@@ -54047,9 +54375,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1087.002/T1087.002.md",
-          "https://www.joeware.net/freetools/tools/adfind/",
           "https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx",
+          "https://www.joeware.net/freetools/tools/adfind/",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1087.002/T1087.002.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pua_adfind_enumeration.yml"
         ],
         "tags": [
@@ -54117,8 +54445,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/Azure/Azure-Sentinel/blob/7e6aa438e254d468feec061618a7877aa528ee9f/Hunting%20Queries/Microsoft%20365%20Defender/Ransomware/DEV-0270/Email%20data%20exfiltration%20via%20PowerShell.yaml",
           "https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/",
+          "https://github.com/Azure/Azure-Sentinel/blob/7e6aa438e254d468feec061618a7877aa528ee9f/Hunting%20Queries/Microsoft%20365%20Defender/Ransomware/DEV-0270/Email%20data%20exfiltration%20via%20PowerShell.yaml",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_email_exfil.yml"
         ],
         "tags": [
@@ -54141,13 +54469,13 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://medium.com/@cyberjyot/lolbin-execution-via-diskshadow-f6ff681a27a4",
-          "https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/",
-          "https://www.lifars.com/wp-content/uploads/2022/01/GriefRansomware_Whitepaper-2.pdf",
           "https://research.checkpoint.com/2022/evilplayout-attack-against-irans-state-broadcaster/",
-          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow",
           "https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration",
+          "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow",
           "https://www.zscaler.com/blogs/security-research/technical-analysis-crytox-ransomware",
+          "https://medium.com/@cyberjyot/lolbin-execution-via-diskshadow-f6ff681a27a4",
+          "https://www.lifars.com/wp-content/uploads/2022/01/GriefRansomware_Whitepaper-2.pdf",
+          "https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_diskshadow_script_mode_susp_location.yml"
         ],
         "tags": [
@@ -54182,11 +54510,11 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1027.004/T1027.004.md#atomic-test-1---compile-after-delivery-using-cscexe",
           "https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf",
           "https://securityboulevard.com/2019/08/agent-tesla-evading-edr-by-removing-api-hooks/",
-          "https://app.any.run/tasks/c6993447-d1d8-414e-b856-675325e5aa09/",
           "https://twitter.com/gN3mes1s/status/1206874118282448897",
-          "https://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1027.004/T1027.004.md#atomic-test-1---compile-after-delivery-using-cscexe",
+          "https://app.any.run/tasks/c6993447-d1d8-414e-b856-675325e5aa09/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_csc_susp_dynamic_compilation.yml"
         ],
         "tags": [
@@ -54287,9 +54615,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://www.poweradmin.com/paexec/",
-          "https://learn.microsoft.com/en-us/sysinternals/downloads/psexec",
           "https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html",
+          "https://learn.microsoft.com/en-us/sysinternals/downloads/psexec",
+          "https://www.poweradmin.com/paexec/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_sysinternals_psexec_paexec_escalate_system.yml"
         ],
         "tags": [
@@ -54523,8 +54851,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/SwiftOnSecurity/status/1455897435063074824",
           "https://github.com/LOLBAS-Project/LOLBAS/pull/151",
+          "https://twitter.com/SwiftOnSecurity/status/1455897435063074824",
           "https://lolbas-project.github.io/lolbas/Binaries/Cmdl32/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_cmdl32_arbitrary_file_download.yml"
         ],
@@ -54601,8 +54929,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://ss64.com/nt/cmd.html",
           "https://twitter.com/cyb3rops/status/1562072617552678912",
+          "https://ss64.com/nt/cmd.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_cmd_no_space_execution.yml"
         ],
         "tags": [
@@ -54635,8 +54963,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/Moriarty_Meng/status/984380793383370752",
           "https://github.com/LOLBAS-Project/LOLBAS/blob/4db780e0f0b2e2bb8cb1fa13e09196da9b9f1834/yml/LOLUtilz/OSBinaries/Powershell.yml",
+          "https://twitter.com/Moriarty_Meng/status/984380793383370752",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_run_script_from_input_stream.yml"
         ],
         "tags": [
@@ -54770,8 +55098,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/cobalt-4-5-user-guide.pdf",
           "https://thedfirreport.com/2021/10/04/bazarloader-and-the-conti-leaks/",
+          "https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/cobalt-4-5-user-guide.pdf",
           "https://thedfirreport.com/2022/06/16/sans-ransomware-summit-2022-can-you-detect-this/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_cobaltstrike_bloopers_cmd.yml"
         ],
@@ -54972,9 +55300,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
+          "https://blog.talosintelligence.com/2021/10/threat-hunting-in-large-datasets-by.html",
           "https://guides.lib.umich.edu/c.php?g=282942&p=1885348",
           "https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/",
-          "https://blog.talosintelligence.com/2021/10/threat-hunting-in-large-datasets-by.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_regsvr32_susp_extensions.yml"
         ],
         "tags": [
@@ -55007,10 +55335,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "windows",
         "refs": [
-          "https://mez0.cc/posts/cobaltstrike-powershell-exec/",
           "https://zero2auto.com/2020/05/19/netwalker-re/",
-          "https://redcanary.com/blog/yellow-cockatoo/",
           "https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=65",
+          "https://redcanary.com/blog/yellow-cockatoo/",
+          "https://mez0.cc/posts/cobaltstrike-powershell-exec/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_xor_commandline.yml"
         ],
         "tags": [
@@ -55102,9 +55430,9 @@
         "logsource.category": "wmi_event",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-20-wmievent-wmieventconsumer-activity-detected",
-          "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-19-wmievent-wmieventfilter-activity-detected",
           "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-21-wmievent-wmieventconsumertofilter-activity-detected",
+          "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-19-wmievent-wmieventfilter-activity-detected",
+          "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-20-wmievent-wmieventconsumer-activity-detected",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/wmi_event/sysmon_wmi_event_subscription.yml"
         ],
         "tags": [
@@ -55137,9 +55465,9 @@
         "logsource.category": "wmi_event",
         "logsource.product": "windows",
         "refs": [
+          "https://in.security/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/",
           "https://github.com/RiccardoAncarani/LiquidSnake",
           "https://github.com/Neo23x0/signature-base/blob/615bf1f6bac3c1bdc417025c40c073e6c2771a76/yara/gen_susp_lnk_files.yar#L19",
-          "https://in.security/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/wmi_event/sysmon_wmi_susp_scripting.yml"
         ],
         "tags": [
@@ -55240,8 +55568,8 @@
         "logsource.category": "network_connection",
         "logsource.product": "windows",
         "refs": [
-          "https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/",
           "https://pentestlab.blog/2017/05/11/applocker-bypass-regsvr32/",
+          "https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection/net_connection_win_regsvr32_network_activity.yml"
         ],
         "tags": [
@@ -55283,9 +55611,9 @@
         "logsource.category": "network_connection",
         "logsource.product": "windows",
         "refs": [
+          "https://cydefops.com/vscode-data-exfiltration",
           "https://badoption.eu/blog/2023/01/31/code_c2.html",
           "https://ipfyx.fr/post/visual-studio-code-tunnel/",
-          "https://cydefops.com/vscode-data-exfiltration",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection/net_connection_win_domain_vscode_tunnel_connection.yml"
         ],
         "tags": [
@@ -55318,9 +55646,9 @@
         "logsource.category": "network_connection",
         "logsource.product": "windows",
         "refs": [
-          "https://blueteamops.medium.com/detecting-dev-tunnels-16f0994dc3e2",
-          "https://cydefops.com/devtunnels-unleashed",
           "https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security",
+          "https://cydefops.com/devtunnels-unleashed",
+          "https://blueteamops.medium.com/detecting-dev-tunnels-16f0994dc3e2",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection/net_connection_win_domain_devtunnels.yml"
         ],
         "tags": [
@@ -55353,8 +55681,8 @@
         "logsource.category": "network_connection",
         "logsource.product": "windows",
         "refs": [
-          "https://www.mandiant.com/resources/russian-targeting-gov-business",
           "https://megatools.megous.com/",
+          "https://www.mandiant.com/resources/russian-targeting-gov-business",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection/net_connection_win_domain_mega_nz.yml"
         ],
         "tags": [
@@ -55464,8 +55792,8 @@
         "logsource.category": "network_connection",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/mttaggart/OffensiveNotion",
           "https://medium.com/@huskyhacks.mk/we-put-a-c2-in-your-notetaking-app-offensivenotion-3e933bace332",
+          "https://github.com/mttaggart/OffensiveNotion",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection/net_connection_win_domain_notion_api_susp_communication.yml"
         ],
         "tags": [
@@ -55574,11 +55902,11 @@
         "logsource.category": "network_connection",
         "logsource.product": "windows",
         "refs": [
+          "https://www.bleepingcomputer.com/news/security/hackers-abuse-google-command-and-control-red-team-tool-in-attacks/",
+          "https://youtu.be/n2dFlSaBBKo",
+          "https://services.google.com/fh/files/blogs/gcat_threathorizons_full_apr2023.pdf",
           "https://github.com/looCiprian/GC2-sheet",
           "https://www.tanium.com/blog/apt41-deploys-google-gc2-for-attacks-cyber-threat-intelligence-roundup/",
-          "https://www.bleepingcomputer.com/news/security/hackers-abuse-google-command-and-control-red-team-tool-in-attacks/",
-          "https://services.google.com/fh/files/blogs/gcat_threathorizons_full_apr2023.pdf",
-          "https://youtu.be/n2dFlSaBBKo",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection/net_connection_win_domain_google_api_non_browser_access.yml"
         ],
         "tags": [
@@ -55712,9 +56040,9 @@
         "logsource.category": "network_connection",
         "logsource.product": "windows",
         "refs": [
-          "https://portmap.io/",
-          "https://github.com/rapid7/metasploit-framework/issues/11337",
           "https://pro.twitter.com/JaromirHorejsi/status/1795001037746761892/photo/2",
+          "https://github.com/rapid7/metasploit-framework/issues/11337",
+          "https://portmap.io/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection/net_connection_win_domain_portmap.yml"
         ],
         "tags": [
@@ -55791,8 +56119,8 @@
         "logsource.category": "network_connection",
         "logsource.product": "windows",
         "refs": [
-          "https://corelight.com/blog/detecting-cve-2021-42292",
           "https://learn.microsoft.com/de-de/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide",
+          "https://corelight.com/blog/detecting-cve-2021-42292",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection/net_connection_win_office_outbound_non_local_ip.yml"
         ],
         "tags": [
@@ -55859,9 +56187,9 @@
         "logsource.category": "network_connection",
         "logsource.product": "windows",
         "refs": [
-          "Internal Research",
-          "https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/",
           "https://defr0ggy.github.io/research/Abusing-Cloudflared-A-Proxy-Service-To-Host-Share-Applications/",
+          "https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/",
+          "Internal Research",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection/net_connection_win_domain_cloudflared_communication.yml"
         ],
         "tags": [
@@ -55928,8 +56256,8 @@
         "logsource.category": "network_connection",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/tekdefense/status/1519711183162556416?s=12&t=OTsHCBkQOTNs1k3USz65Zg",
           "https://www.mandiant.com/resources/bypassing-network-restrictions-through-rdp-tunneling",
+          "https://twitter.com/tekdefense/status/1519711183162556416?s=12&t=OTsHCBkQOTNs1k3USz65Zg",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection/net_connection_win_rdp_to_http.yml"
         ],
         "tags": [
@@ -56062,11 +56390,11 @@
         "logsource.category": "network_connection",
         "logsource.product": "windows",
         "refs": [
-          "https://www.cisa.gov/uscert/ncas/alerts/aa22-321a",
-          "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker",
           "https://twitter.com/M_haggis/status/900741347035889665",
+          "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker",
           "https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/exfil/Invoke-ExfilDataToGitHub.ps1",
           "https://twitter.com/M_haggis/status/1032799638213066752",
+          "https://www.cisa.gov/uscert/ncas/alerts/aa22-321a",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection/net_connection_win_susp_file_sharing_domains_susp_folders.yml"
         ],
         "tags": [
@@ -56168,9 +56496,9 @@
         "logsource.category": "network_connection",
         "logsource.product": "windows",
         "refs": [
-          "https://app.any.run/tasks/ec207948-4916-47eb-a0f4-4c6abb2e7668/",
           "https://lolbas-project.github.io/lolbas/Binaries/Regasm/",
           "https://research.splunk.com/endpoint/07921114-6db4-4e2e-ae58-3ea8a52ae93f/",
+          "https://app.any.run/tasks/ec207948-4916-47eb-a0f4-4c6abb2e7668/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection/net_connection_win_regasm_network_activity.yml"
         ],
         "tags": [
@@ -56203,10 +56531,10 @@
         "logsource.category": "network_connection",
         "logsource.product": "windows",
         "refs": [
+          "https://strontic.github.io/xcyclopedia/library/dialer.exe-0B69655F912619756C704A0BF716B61F.html",
+          "https://app.any.run/tasks/6720b85b-9c53-4a12-b1dc-73052a78477d",
           "https://tria.ge/240301-rk34sagf5x/behavioral2",
           "https://research.checkpoint.com/2023/rhadamanthys-v0-5-0-a-deep-dive-into-the-stealers-components/",
-          "https://app.any.run/tasks/6720b85b-9c53-4a12-b1dc-73052a78477d",
-          "https://strontic.github.io/xcyclopedia/library/dialer.exe-0B69655F912619756C704A0BF716B61F.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection/net_connection_win_dialer_initiated_connection.yml"
         ],
         "tags": [
@@ -56262,10 +56590,10 @@
         "logsource.category": "network_connection",
         "logsource.product": "windows",
         "refs": [
+          "https://ngrok.com/blog-post/new-ngrok-domains",
           "https://ngrok.com/",
           "https://www.rnbo.gov.ua/files/2023_YEAR/CYBERCENTER/november/APT29%20attacks%20Embassies%20using%20CVE-2023-38831%20-%20report%20en.pdf",
           "https://www.virustotal.com/gui/file/cca0c1182ac114b44dc52dd2058fcd38611c20bb6b5ad84710681d38212f835a/",
-          "https://ngrok.com/blog-post/new-ngrok-domains",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection/net_connection_win_domain_ngrok.yml"
         ],
         "tags": [
@@ -56285,6 +56613,40 @@
       "uuid": "18249279-932f-45e2-b37a-8925f2597670",
       "value": "Process Initiated Network  Connection To Ngrok Domain"
     },
+    {
+      "description": "Detects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated with ADWS management.\n",
+      "meta": {
+        "author": "@kostastsale",
+        "creation_date": "2024-01-26",
+        "falsepositive": [
+          "ADWS is used by a number of legitimate applications that need to interact with Active Directory. These applications should be added to the allow-listing to avoid false positives."
+        ],
+        "filename": "net_connection_win_adws_unusual_connection.yml",
+        "level": "medium",
+        "logsource.category": "network_connection",
+        "logsource.product": "windows",
+        "refs": [
+          "https://github.com/FalconForceTeam/FalconFriday/blob/master/Discovery/ADWS_Connection_from_Unexpected_Binary-Win.md",
+          "https://medium.com/falconforce/soaphound-tool-to-collect-active-directory-data-via-adws-165aca78288c",
+          "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection/net_connection_win_adws_unusual_connection.yml"
+        ],
+        "tags": [
+          "attack.discovery",
+          "attack.t1087"
+        ]
+      },
+      "related": [
+        {
+          "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "related-to"
+        }
+      ],
+      "uuid": "b3ad3c0f-c949-47a1-a30e-b0491ccae876",
+      "value": "Uncommon Connection to Active Directory Web Services"
+    },
     {
       "description": "Detects initiated network connections to crypto mining pools",
       "meta": {
@@ -56298,9 +56660,9 @@
         "logsource.category": "network_connection",
         "logsource.product": "windows",
         "refs": [
+          "https://www.poolwatch.io/coin/monero",
           "https://github.com/stamparm/maltrail/blob/3ea70459b9559134449423c0a7d8b965ac5c40ea/trails/static/suspicious/crypto_mining.txt",
           "https://www.virustotal.com/gui/search/behaviour_network%253A*.miningocean.org/files",
-          "https://www.poolwatch.io/coin/monero",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection/net_connection_win_domain_crypto_mining_pools.yml"
         ],
         "tags": [
@@ -56409,8 +56771,8 @@
         "logsource.category": "network_connection",
         "logsource.product": "windows",
         "refs": [
-          "https://www.sentinelone.com/labs/wip26-espionage-threat-actors-abuse-cloud-infrastructure-in-targeted-telco-attacks/",
           "https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/",
+          "https://www.sentinelone.com/labs/wip26-espionage-threat-actors-abuse-cloud-infrastructure-in-targeted-telco-attacks/",
           "https://symantec-enterprise-blogs.security.com/threat-intelligence/harvester-new-apt-attacks-asia",
           "https://intezer.com/blog/research/how-we-escaped-docker-in-azure-functions/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection/net_connection_win_domain_azurewebsites.yml"
@@ -56487,8 +56849,8 @@
         "logsource.category": "network_connection",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/hakluke/status/1587733971814977537/photo/1",
           "https://ngrok.com/docs/secure-tunnels/tunnels/ssh-reverse-tunnel-agent",
+          "https://twitter.com/hakluke/status/1587733971814977537/photo/1",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection/net_connection_win_domain_ngrok_tunnel.yml"
         ],
         "tags": [
@@ -56682,9 +57044,9 @@
         "logsource.category": "network_connection",
         "logsource.product": "windows",
         "refs": [
+          "https://news.sophos.com/en-us/2019/07/18/a-new-equation-editor-exploit-goes-commercial-as-maldoc-attacks-using-it-spike/",
           "https://twitter.com/forensicitguy/status/1513538712986079238",
           "https://forensicitguy.github.io/xloader-formbook-velvetsweatshop-spreadsheet/",
-          "https://news.sophos.com/en-us/2019/07/18/a-new-equation-editor-exploit-goes-commercial-as-maldoc-attacks-using-it-spike/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection/net_connection_win_eqnedt.yml"
         ],
         "tags": [
@@ -56717,10 +57079,10 @@
         "logsource.category": "network_connection",
         "logsource.product": "windows",
         "refs": [
-          "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-302a",
-          "https://github.com/rsp/scripts/blob/c8bb272d68164a9836e4f273d8f924927f39b8c6/externalip-benchmark.md",
           "https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html",
+          "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-302a",
           "https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/",
+          "https://github.com/rsp/scripts/blob/c8bb272d68164a9836e4f273d8f924927f39b8c6/externalip-benchmark.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection/net_connection_win_domain_external_ip_lookup.yml"
         ],
         "tags": [
@@ -56857,9 +57219,9 @@
         "refs": [
           "https://securelist.com/the-tetrade-brazilian-banking-malware/97779/",
           "https://web.archive.org/web/20220830134315/https://content.fireeye.com/apt-41/rpt-apt41/",
-          "https://blog.bushidotoken.net/2021/04/dead-drop-resolvers-espionage-inspired.html",
           "https://github.com/kleiton0x00/RedditC2",
           "https://www.linkedin.com/posts/kleiton-kurti_github-kleiton0x00redditc2-abusing-reddit-activity-7009939662462984192-5DbI/?originalSubdomain=al",
+          "https://blog.bushidotoken.net/2021/04/dead-drop-resolvers-espionage-inspired.html",
           "https://twitter.com/kleiton0x7e/status/1600567316810551296",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection/net_connection_win_domain_dead_drop_resolvers.yml"
         ],
@@ -56886,7 +57248,7 @@
         }
       ],
       "uuid": "297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7",
-      "value": "Potential Dead Drop Resolvers"
+      "value": "New Connection Initiated To Potential Dead Drop Resolver Domain"
     },
     {
       "description": "Detects a network connection initiated by \"wordpad.exe\" over uncommon destination ports.\nThis might indicate potential process injection activity from a beacon or similar mechanisms.\n",
@@ -57158,9 +57520,9 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/",
-          "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md",
+          "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker",
+          "https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/",
           "https://twitter.com/malmoeb/status/1535142803075960832",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/bits_client/win_bits_client_new_transfer_via_file_sharing_domains.yml"
         ],
@@ -57263,9 +57625,9 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
+          "https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin",
           "https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/",
           "https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/",
-          "https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin",
           "https://isc.sans.edu/diary/22264",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/bits_client/win_bits_client_new_transfer_via_ip_address.yml"
         ],
@@ -57300,8 +57662,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker",
           "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker",
+          "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker",
           "https://nxlog.co/documentation/nxlog-user-guide/applocker.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/applocker/win_applocker_file_was_not_allowed_to_run.yml"
         ],
@@ -57534,9 +57896,9 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://malware.news/t/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/72170",
-          "https://cybersecuritynews.com/rhysida-ransomware-attacking-windows/",
           "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.004/T1562.004.md#atomic-test-24---set-a-firewall-rule-using-new-netfirewallrule",
+          "https://cybersecuritynews.com/rhysida-ransomware-attacking-windows/",
+          "https://malware.news/t/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/72170",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/firewall_as/win_firewall_as_add_rule_wmiprvse.yml"
         ],
         "tags": [
@@ -57777,8 +58139,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://medium.com/@7a616368/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072",
           "https://twitter.com/duzvik/status/1269671601852813320",
+          "https://medium.com/@7a616368/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_camera_microphone_access.yml"
         ],
         "tags": [
@@ -57954,8 +58316,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1",
-          "https://twitter.com/_dirkjan/status/1309214379003588608",
           "https://dirkjanm.io/a-different-way-of-abusing-zerologon/",
+          "https://twitter.com/_dirkjan/status/1309214379003588608",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_dce_rpc_smb_spoolss_named_pipe.yml"
         ],
         "tags": [
@@ -58154,9 +58516,9 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://threathunterplaybook.com/hunts/windows/180815-ADObjectAccessReplication/notebook.html",
           "https://threathunterplaybook.com/hunts/windows/190101-ADModDirectoryReplication/notebook.html",
           "https://threathunterplaybook.com/library/windows/active_directory_replication.html",
+          "https://threathunterplaybook.com/hunts/windows/180815-ADObjectAccessReplication/notebook.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_ad_object_writedac_access.yml"
         ],
         "tags": [
@@ -58189,8 +58551,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/OTRF/ThreatHunter-Playbook/blob/f7a58156dbfc9b019f17f638b8c62d22e557d350/playbooks/WIN-201012004336.yaml",
           "https://securitydatasets.com/notebooks/atomic/windows/lateral_movement/SDWIN-200806015757.html?highlight=create%20file",
+          "https://github.com/OTRF/ThreatHunter-Playbook/blob/f7a58156dbfc9b019f17f638b8c62d22e557d350/playbooks/WIN-201012004336.yaml",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_smb_file_creation_admin_shares.yml"
         ],
         "tags": [
@@ -58385,9 +58747,9 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/SBousseaden/status/1490608838701166596",
           "https://www.x86matthew.com/view_post?id=create_svc_rpc",
           "https://www.elastic.co/guide/en/security/current/windows-service-installed-via-an-unusual-client.html",
+          "https://twitter.com/SBousseaden/status/1490608838701166596",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_service_installation_by_unusal_client.yml"
         ],
         "tags": [
@@ -58420,8 +58782,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/SBousseaden/status/1101431884540710913",
           "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625",
+          "https://twitter.com/SBousseaden/status/1101431884540710913",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_susp_failed_logon_reasons.yml"
         ],
         "tags": [
@@ -58457,8 +58819,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/",
           "https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment",
+          "https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_meterpreter_or_cobaltstrike_getsystem_service_install.yml"
         ],
         "tags": [
@@ -58633,10 +58995,10 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf",
           "https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf",
-          "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4800",
           "https://www.cisecurity.org/controls/cis-controls-list/",
+          "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4800",
+          "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_workstation_was_locked.yml"
         ],
         "tags": [
@@ -58659,8 +59021,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "http://www.stuffithoughtiknew.com/2019/02/detecting-bloodhound.html",
           "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4662",
+          "http://www.stuffithoughtiknew.com/2019/02/detecting-bloodhound.html",
           "https://www.specterops.io/assets/resources/an_ace_up_the_sleeve.pdf",
           "https://learn.microsoft.com/en-us/windows/win32/adschema/attributes-all",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_ad_user_enumeration.yml"
@@ -58870,9 +59232,9 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
+          "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4634",
           "https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md",
           "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4647",
-          "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4634",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_user_logoff.yml"
         ],
         "tags": [
@@ -59006,9 +59368,9 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml",
-          "https://github.com/topotam/PetitPotam",
           "https://isc.sans.edu/forums/diary/Active+Directory+Certificate+Services+ADCS+PKI+domain+admin+vulnerability/27668/",
+          "https://github.com/topotam/PetitPotam",
+          "https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_petitpotam_susp_tgt_request.yml"
         ],
         "tags": [
@@ -59095,6 +59457,40 @@
       "uuid": "962fe167-e48d-4fd6-9974-11e5b9a5d6d1",
       "value": "LSASS Access From Non System Account"
     },
+    {
+      "description": "This rule will collect the data needed to start looking into possible kerberoasting activity.\nFurther analysis or computation within the query is needed focusing on requests from one specific host/IP towards multiple service names within a time period of 5 seconds.\nYou can then set a threshold for the number of requests and time between the requests to turn this into an alert.\n",
+      "meta": {
+        "author": "@kostastsale",
+        "creation_date": "2022-01-21",
+        "falsepositive": [
+          "Legacy applications."
+        ],
+        "filename": "win_security_kerberoasting_activity.yml",
+        "level": "medium",
+        "logsource.category": "No established category",
+        "logsource.product": "windows",
+        "refs": [
+          "https://adsecurity.org/?p=3513",
+          "https://www.trustedsec.com/blog/art_of_kerberoast/",
+          "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_kerberoasting_activity.yml"
+        ],
+        "tags": [
+          "attack.credential-access",
+          "attack.t1558.003"
+        ]
+      },
+      "related": [
+        {
+          "dest-uuid": "f2877f7f-9a4c-4251-879f-1224e3006bee",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "related-to"
+        }
+      ],
+      "uuid": "d04ae2b8-ad54-4de0-bd87-4bc1da66aa59",
+      "value": "Kerberoasting Activity - Initial Query"
+    },
     {
       "description": "Potential adversaries stopping ETW providers recording loaded .NET assemblies.",
       "meta": {
@@ -59108,14 +59504,14 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/dotnet/runtime/blob/ee2355c801d892f2894b0f7b14a20e6cc50e0e54/docs/design/coreclr/jit/viewing-jit-dumps.md#setting-configuration-variables",
-          "https://github.com/dotnet/runtime/blob/7abe42dc1123722ed385218268bb9fe04556e3d3/src/coreclr/src/inc/clrconfig.h#L33-L39",
           "https://github.com/dotnet/runtime/blob/4f9ae42d861fcb4be2fcd5d3d55d5f227d30e723/docs/coding-guidelines/clr-jit-coding-conventions.md#1412-disabling-code",
           "https://social.msdn.microsoft.com/Forums/vstudio/en-US/0878832e-39d7-4eaf-8e16-a729c4c40975/what-can-i-use-e13c0d23ccbc4e12931bd9cc2eee27e4-for?forum=clr",
-          "https://i.blackhat.com/EU-21/Wednesday/EU-21-Teodorescu-Veni-No-Vidi-No-Vici-Attacks-On-ETW-Blind-EDRs.pdf",
-          "http://managed670.rssing.com/chan-5590147/all_p1.html",
-          "https://twitter.com/_xpn_/status/1268712093928378368",
           "https://github.com/dotnet/runtime/search?p=1&q=COMPlus_&unscoped_q=COMPlus_",
+          "https://twitter.com/_xpn_/status/1268712093928378368",
+          "https://github.com/dotnet/runtime/blob/ee2355c801d892f2894b0f7b14a20e6cc50e0e54/docs/design/coreclr/jit/viewing-jit-dumps.md#setting-configuration-variables",
+          "http://managed670.rssing.com/chan-5590147/all_p1.html",
+          "https://github.com/dotnet/runtime/blob/7abe42dc1123722ed385218268bb9fe04556e3d3/src/coreclr/src/inc/clrconfig.h#L33-L39",
+          "https://i.blackhat.com/EU-21/Wednesday/EU-21-Teodorescu-Veni-No-Vidi-No-Vici-Attacks-On-ETW-Blind-EDRs.pdf",
           "https://bunnyinside.com/?term=f71e8cb9c76a",
           "https://github.com/dotnet/runtime/blob/f62e93416a1799aecc6b0947adad55a0d9870732/src/coreclr/src/inc/clrconfigvalues.h#L35-L38",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_dot_net_etw_tamper.yml"
@@ -59200,8 +59596,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://www.secureworks.com/blog/ransomware-as-a-distraction",
           "https://twitter.com/menasec1/status/1106899890377052160",
+          "https://www.secureworks.com/blog/ransomware-as-a-distraction",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_gpo_scheduledtasks.yml"
         ],
         "tags": [
@@ -59276,8 +59672,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://adsecurity.org/?p=3466",
           "https://blog.harmj0y.net/redteaming/another-word-on-delegation/",
+          "https://adsecurity.org/?p=3466",
           "https://msdn.microsoft.com/en-us/library/cc220234.aspx",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_alert_ad_user_backdoors.yml"
         ],
@@ -59419,9 +59815,9 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/",
-          "https://www.crowdstrike.com/blog/getting-the-bacon-from-cobalt-strike-beacon/",
           "https://www.sans.org/webcasts/119395",
+          "https://www.crowdstrike.com/blog/getting-the-bacon-from-cobalt-strike-beacon/",
+          "https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_cobaltstrike_service_installs.yml"
         ],
         "tags": [
@@ -59473,8 +59869,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://twitter.com/gentilkiwi/status/1003236624925413376",
-          "https://web.archive.org/web/20180203014709/https://blog.alsid.eu/dcshadow-explained-4510f52fc19d?gi=c426ac876c48",
           "https://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2",
+          "https://web.archive.org/web/20180203014709/https://blog.alsid.eu/dcshadow-explained-4510f52fc19d?gi=c426ac876c48",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_possible_dc_shadow.yml"
         ],
         "tags": [
@@ -59507,10 +59903,10 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://www.proofpoint.com/us/blog/threat-insight/threat-actor-profile-ta2719-uses-colorful-lures-deliver-rats-local-languages",
           "https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image",
-          "https://twitter.com/MsftSecIntel/status/1257324139515269121",
           "https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/malicious-spam-campaign-uses-iso-image-files-to-deliver-lokibot-and-nanocore",
+          "https://twitter.com/MsftSecIntel/status/1257324139515269121",
+          "https://www.proofpoint.com/us/blog/threat-insight/threat-actor-profile-ta2719-uses-colorful-lures-deliver-rats-local-languages",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_iso_mount.yml"
         ],
         "tags": [
@@ -59685,8 +60081,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://www.jpcert.or.jp/english/pub/sr/ir_research.html",
           "https://learn.microsoft.com/en-gb/sysinternals/downloads/sdelete",
+          "https://www.jpcert.or.jp/english/pub/sr/ir_research.html",
           "https://jpcertcc.github.io/ToolAnalysisResultSheet/details/sdelete.htm",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_susp_sdelete.yml"
         ],
@@ -59746,9 +60142,9 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://cyberstoph.org/posts/2022/03/detecting-shadow-credentials/",
-          "https://www.elastic.co/guide/en/security/8.4/potential-shadow-credentials-added-to-ad-object.html",
           "https://twitter.com/SBousseaden/status/1581300963650187264?",
+          "https://www.elastic.co/guide/en/security/8.4/potential-shadow-credentials-added-to-ad-object.html",
+          "https://cyberstoph.org/posts/2022/03/detecting-shadow-credentials/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_susp_possible_shadow_credentials_added.yml"
         ],
         "tags": [
@@ -59815,8 +60211,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://adsecurity.org/?p=2053",
           "https://blog.harmj0y.net/redteaming/another-word-on-delegation/",
+          "https://adsecurity.org/?p=2053",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_alert_enable_weak_encryption.yml"
         ],
         "tags": [
@@ -59952,9 +60348,9 @@
         "logsource.product": "windows",
         "refs": [
           "https://www.deepinstinct.com/blog/nofilter-abusing-windows-filtering-platform-for-privilege-escalation",
-          "https://github.com/deepinstinct/NoFilter/blob/121d215ab130c5e8e3ad45a7e7fcd56f4de97b4d/NoFilter/Consts.cpp",
           "https://x.com/_st0pp3r_/status/1742203752361128162?s=20",
           "https://github.com/deepinstinct/NoFilter",
+          "https://github.com/deepinstinct/NoFilter/blob/121d215ab130c5e8e3ad45a7e7fcd56f4de97b4d/NoFilter/Consts.cpp",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_hktl_nofilter.yml"
         ],
         "tags": [
@@ -60113,8 +60509,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/SecurityEvent/SecurityEventLogCleared.yaml",
-          "https://twitter.com/deviouspolack/status/832535435960209408",
           "https://www.hybrid-analysis.com/sample/027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745?environmentId=100",
+          "https://twitter.com/deviouspolack/status/832535435960209408",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_audit_log_cleared.yml"
         ],
         "tags": [
@@ -60148,9 +60544,9 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://securityjosh.github.io/2020/04/23/Mute-Sysmon.html",
           "https://twitter.com/Flangvik/status/1283054508084473861",
           "https://gist.github.com/Cyb3rWard0g/cf08c38c61f7e46e8404b38201ca01c8",
+          "https://securityjosh.github.io/2020/04/23/Mute-Sysmon.html",
           "https://twitter.com/SecurityJosh/status/1283027365770276866",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_sysmon_channel_reference_deletion.yml"
         ],
@@ -60259,9 +60655,9 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://threathunterplaybook.com/hunts/windows/180815-ADObjectAccessReplication/notebook.html",
           "https://threathunterplaybook.com/hunts/windows/190101-ADModDirectoryReplication/notebook.html",
           "https://threathunterplaybook.com/library/windows/active_directory_replication.html",
+          "https://threathunterplaybook.com/hunts/windows/180815-ADObjectAccessReplication/notebook.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_ad_replication_non_machine_account.yml"
         ],
         "tags": [
@@ -60294,8 +60690,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md",
           "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4741",
+          "https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md",
           "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4743",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_add_remove_computer.yml"
         ],
@@ -60684,9 +61080,9 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
+          "https://github.com/fox-it/LDAPFragger",
           "https://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes/",
           "https://medium.com/@ivecodoe/detecting-ldapfragger-a-newly-released-cobalt-strike-beacon-using-ldap-for-c2-communication-c274a7f00961",
-          "https://github.com/fox-it/LDAPFragger",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_susp_ldap_dataexchange.yml"
         ],
         "tags": [
@@ -61060,10 +61456,10 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://blog.blacklanternsecurity.com/p/detecting-dcsync?s=r",
           "https://twitter.com/gentilkiwi/status/1003236624925413376",
           "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4662",
           "https://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2",
+          "https://blog.blacklanternsecurity.com/p/detecting-dcsync?s=r",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_dcsync.yml"
         ],
         "tags": [
@@ -61097,8 +61493,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://www.jpcert.or.jp/english/pub/sr/ir_research.html",
           "https://jpcertcc.github.io/ToolAnalysisResultSheet",
+          "https://www.jpcert.or.jp/english/pub/sr/ir_research.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_mal_wceaux_dll.yml"
         ],
         "tags": [
@@ -61534,8 +61930,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/jpalanco/alienvault-ossim/blob/f74359c0c027e42560924b5cff25cdf121e5505a/os-sim/agent/src/ParserUtil.py#L951",
           "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4661",
+          "https://github.com/jpalanco/alienvault-ossim/blob/f74359c0c027e42560924b5cff25cdf121e5505a/os-sim/agent/src/ParserUtil.py#L951",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_password_policy_enumerated.yml"
         ],
         "tags": [
@@ -61749,8 +62145,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://web.archive.org/web/20230331181619/https://blog.dylan.codes/evading-sysmon-and-windows-event-logging/",
           "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4673",
+          "https://web.archive.org/web/20230331181619/https://blog.dylan.codes/evading-sysmon-and-windows-event-logging/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_user_driver_loaded.yml"
         ],
         "tags": [
@@ -61784,10 +62180,10 @@
         "logsource.product": "windows",
         "refs": [
           "https://github.com/sensepost/ruler",
-          "https://github.com/staaldraad/go-ntlm/blob/cd032d41aa8ce5751c07cb7945400c0f5c81e2eb/ntlm/ntlmv1.go#L427",
-          "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4624",
           "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4776",
           "https://github.com/sensepost/ruler/issues/47",
+          "https://github.com/staaldraad/go-ntlm/blob/cd032d41aa8ce5751c07cb7945400c0f5c81e2eb/ntlm/ntlmv1.go#L427",
+          "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4624",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_alert_ruler.yml"
         ],
         "tags": [
@@ -61961,8 +62357,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment",
           "https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html",
+          "https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_susp_lsass_dump_generic.yml"
         ],
         "tags": [
@@ -62107,8 +62503,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/SigmaHQ/sigma/blob/master/documentation/logsource-guides/windows/service/security.md",
           "https://docs.google.com/presentation/d/1dkrldTTlN3La-OjWtkWJBb4hVk6vfsSMBFBERs6R8zA/edit",
+          "https://github.com/SigmaHQ/sigma/blob/master/documentation/logsource-guides/windows/service/security.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_disable_event_auditing_critical.yml"
         ],
         "tags": [
@@ -62277,8 +62673,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/Purp1eW0lf/status/1616144561965002752",
           "https://www.inversecos.com/2020/04/successful-4624-anonymous-logons-to.html",
+          "https://twitter.com/Purp1eW0lf/status/1616144561965002752",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/account_management/win_security_successful_external_remote_smb_login.yml"
         ],
         "tags": [
@@ -62412,8 +62808,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/AdamTheAnalyst/status/1134394070045003776",
           "https://github.com/zerosum0x0/CVE-2019-0708",
+          "https://twitter.com/AdamTheAnalyst/status/1134394070045003776",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/account_management/win_security_rdp_bluekeep_poc_scanner.yml"
         ],
         "tags": [
@@ -62592,8 +62988,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://blog.stealthbits.com/how-to-detect-pass-the-hash-attacks/",
-          "https://github.com/iadgov/Event-Forwarding-Guidance/tree/master/Events",
           "https://web.archive.org/web/20170909091934/https://blog.binarydefense.com/reliably-detecting-pass-the-hash-through-event-log-analysis",
+          "https://github.com/iadgov/Event-Forwarding-Guidance/tree/master/Events",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/account_management/win_security_pass_the_hash_2.yml"
         ],
         "tags": [
@@ -62626,11 +63022,11 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4730",
-          "https://www.cisecurity.org/controls/cis-controls-list/",
-          "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf",
           "https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf",
+          "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4730",
           "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=634",
+          "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf",
+          "https://www.cisecurity.org/controls/cis-controls-list/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/account_management/win_security_security_enabled_global_group_deleted.yml"
         ],
         "tags": [
@@ -62663,8 +63059,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/Purp1eW0lf/status/1616144561965002752",
           "https://www.inversecos.com/2020/04/successful-4624-anonymous-logons-to.html",
+          "https://twitter.com/Purp1eW0lf/status/1616144561965002752",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/account_management/win_security_successful_external_remote_rdp_login.yml"
         ],
         "tags": [
@@ -62783,11 +63179,11 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=633",
-          "https://www.cisecurity.org/controls/cis-controls-list/",
-          "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf",
           "https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf",
           "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4729",
+          "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=633",
+          "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf",
+          "https://www.cisecurity.org/controls/cis-controls-list/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/account_management/win_security_member_removed_security_enabled_global_group.yml"
         ],
         "tags": [
@@ -62820,11 +63216,11 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4728",
-          "https://www.cisecurity.org/controls/cis-controls-list/",
-          "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf",
           "https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf",
           "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=632",
+          "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf",
+          "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4728",
+          "https://www.cisecurity.org/controls/cis-controls-list/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/account_management/win_security_member_added_security_enabled_global_group.yml"
         ],
         "tags": [
@@ -62857,8 +63253,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/amjcyber/EDRNoiseMaker",
           "https://github.com/netero1010/EDRSilencer",
+          "https://github.com/amjcyber/EDRNoiseMaker",
           "https://ghoulsec.medium.com/misc-series-4-forensics-on-edrsilencer-events-428b20b3f983",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/object_access/win_security_wfp_endpoint_agent_blocked.yml"
         ],
@@ -62892,9 +63288,9 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "Internal Research",
-          "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations",
           "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations",
+          "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations",
+          "Internal Research",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/code_integrity/win_codeintegrity_revoked_driver_loaded.yml"
         ],
         "tags": [
@@ -62917,9 +63313,9 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "Internal Research",
-          "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations",
           "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations",
+          "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations",
+          "Internal Research",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/code_integrity/win_codeintegrity_whql_failure.yml"
         ],
         "tags": [
@@ -62942,9 +63338,9 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "Internal Research",
-          "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations",
           "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations",
+          "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations",
+          "Internal Research",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/code_integrity/win_codeintegrity_revoked_image_loaded.yml"
         ],
         "tags": [
@@ -62967,9 +63363,9 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "Internal Research",
-          "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations",
           "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations",
+          "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations",
+          "Internal Research",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/code_integrity/win_codeintegrity_revoked_image_blocked.yml"
         ],
         "tags": [
@@ -62992,9 +63388,9 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "Internal Research",
-          "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations",
           "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations",
+          "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations",
+          "Internal Research",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/code_integrity/win_codeintegrity_blocked_protected_process_file.yml"
         ],
         "tags": [
@@ -63017,9 +63413,9 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "Internal Research",
-          "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations",
           "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations",
+          "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations",
+          "Internal Research",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/code_integrity/win_codeintegrity_unsigned_driver_loaded.yml"
         ],
         "tags": [
@@ -63042,9 +63438,9 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "Internal Research",
-          "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations",
           "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations",
+          "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations",
+          "Internal Research",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/code_integrity/win_codeintegrity_revoked_driver_blocked.yml"
         ],
         "tags": [
@@ -63077,9 +63473,9 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "Internal Research",
-          "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations",
           "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations",
+          "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations",
+          "Internal Research",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/code_integrity/win_codeintegrity_unsigned_image_loaded.yml"
         ],
         "tags": [
@@ -63103,9 +63499,9 @@
         "logsource.product": "windows",
         "refs": [
           "https://twitter.com/SBousseaden/status/1483810148602814466",
+          "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations",
           "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations",
           "https://github.com/MicrosoftDocs/windows-itpro-docs/blob/40fe118976734578f83e5e839b9c63ae7a4af82d/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md#windows-codeintegrity-operational-log",
-          "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/code_integrity/win_codeintegrity_attempted_dll_load.yml"
         ],
         "tags": [
@@ -63128,9 +63524,9 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/MicrosoftDocs/windows-itpro-docs/blob/40fe118976734578f83e5e839b9c63ae7a4af82d/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md#windows-codeintegrity-operational-log",
           "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations",
           "https://twitter.com/wdormann/status/1590434950335320065",
+          "https://github.com/MicrosoftDocs/windows-itpro-docs/blob/40fe118976734578f83e5e839b9c63ae7a4af82d/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md#windows-codeintegrity-operational-log",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/code_integrity/win_codeintegrity_enforced_policy_block.yml"
         ],
         "tags": [
@@ -63726,9 +64122,9 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/KevTheHermit/status/1410203844064301056",
-          "https://github.com/afwu/PrintNightmare",
           "https://github.com/hhlxf/PrintNightmare",
+          "https://github.com/afwu/PrintNightmare",
+          "https://twitter.com/KevTheHermit/status/1410203844064301056",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/smbclient/security/win_smbclient_security_susp_failed_guest_logon.yml"
         ],
         "tags": [
@@ -64009,8 +64405,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://web.archive.org/web/20160727113019/https://answers.microsoft.com/en-us/protect/forum/mse-protect_scanning/microsoft-antimalware-has-removed-history-of/f15af6c9-01a9-4065-8c6c-3f2bdc7de45e",
           "https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus",
+          "https://web.archive.org/web/20160727113019/https://answers.microsoft.com/en-us/protect/forum/mse-protect_scanning/microsoft-antimalware-has-removed-history-of/f15af6c9-01a9-4065-8c6c-3f2bdc7de45e",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/windefend/win_defender_history_delete.yml"
         ],
         "tags": [
@@ -64066,9 +64462,9 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5010",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md",
           "https://craigclouditpro.wordpress.com/2020/03/04/hunting-malicious-windows-defender-activity/",
+          "https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5010",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/windefend/win_defender_malware_and_pua_scan_disabled.yml"
         ],
         "tags": [
@@ -64167,8 +64563,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5101",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md",
+          "https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5101",
           "https://craigclouditpro.wordpress.com/2020/03/04/hunting-malicious-windows-defender-activity/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/windefend/win_defender_antimalware_platform_expired.yml"
         ],
@@ -64202,8 +64598,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://gist.github.com/nasbench/33732d6705cbdc712fae356f07666346",
           "https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/",
+          "https://gist.github.com/nasbench/33732d6705cbdc712fae356f07666346",
           "Internal Research",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/windefend/win_defender_real_time_protection_errors.yml"
         ],
@@ -64305,8 +64701,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/windows-server/identity/software-restriction-policies/software-restriction-policies",
           "https://github.com/nasbench/EVTX-ETW-Resources/blob/7a806a148b3d9d381193d4a80356016e6e8b1ee8/ETWEventsList/CSV/Windows11/22H2/W11_22H2_Pro_20220920_22621.382/Providers/Microsoft-Windows-AppXDeployment-Server.csv",
+          "https://learn.microsoft.com/en-us/windows-server/identity/software-restriction-policies/software-restriction-policies",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/application/microsoft_windows_software_restriction_policies/win_software_restriction_policies_block.yml"
         ],
         "tags": [
@@ -64340,9 +64736,9 @@
         "logsource.product": "windows",
         "refs": [
           "https://www.virustotal.com/gui/file/13828b390d5f58b002e808c2c4f02fdd920e236cc8015480fa33b6c1a9300e31",
+          "https://www.virustotal.com/gui/file/5092b2672b4cb87a8dd1c2e6047b487b95995ad8ed5e9fc217f46b8bfb1b8c01",
           "https://www.virustotal.com/gui/file/15b57c1b68cd6ce3c161042e0f3be9f32d78151fe95461eedc59a79fc222c7ed",
           "https://www.nextron-systems.com/?s=antivirus",
-          "https://www.virustotal.com/gui/file/5092b2672b4cb87a8dd1c2e6047b487b95995ad8ed5e9fc217f46b8bfb1b8c01",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/application/Other/win_av_relevant_match.yml"
         ],
         "tags": [
@@ -64417,9 +64813,9 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
+          "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55",
           "https://github.com/deepinstinct/Lsass-Shtinkering",
           "https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf",
-          "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/application/application_error/win_werfault_susp_lsass_credential_dump.yml"
         ],
         "tags": [
@@ -64494,8 +64890,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj574207(v=ws.11)",
           "https://twitter.com/mgreen27/status/1558223256704122882",
+          "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj574207(v=ws.11)",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/application/esent/win_esent_ntdsutil_abuse.yml"
         ],
         "tags": [
@@ -64528,8 +64924,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj574207(v=ws.11)",
           "https://twitter.com/mgreen27/status/1558223256704122882",
+          "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj574207(v=ws.11)",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/application/esent/win_esent_ntdsutil_abuse_susp_location.yml"
         ],
         "tags": [
@@ -64552,9 +64948,9 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/DidierStevens/status/1217533958096924676",
           "https://www.youtube.com/watch?v=ebmW42YYveI",
           "https://nullsec.us/windows-event-log-audit-cve/",
+          "https://twitter.com/DidierStevens/status/1217533958096924676",
           "https://twitter.com/FlemmingRiis/status/1217147415482060800",
           "https://twitter.com/VM_vivisector/status/1217190929330655232",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/application/microsoft-windows_audit_cve/win_audit_cve.yml"
@@ -64635,8 +65031,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/",
           "https://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/",
+          "https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/application/mssqlserver/win_mssql_xp_cmdshell_change.yml"
         ],
         "tags": [
@@ -64659,8 +65055,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-procoption-transact-sql?view=sql-server-ver16",
           "https://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/",
+          "https://learn.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-procoption-transact-sql?view=sql-server-ver16",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/application/mssqlserver/win_mssql_sp_procoption_set.yml"
         ],
         "tags": [
@@ -64706,9 +65102,9 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/sql/t-sql/statements/alter-server-audit-transact-sql?view=sql-server-ver16",
           "https://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/",
           "https://learn.microsoft.com/en-us/sql/t-sql/statements/drop-server-audit-transact-sql?view=sql-server-ver16",
+          "https://learn.microsoft.com/en-us/sql/t-sql/statements/alter-server-audit-transact-sql?view=sql-server-ver16",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/application/mssqlserver/win_mssql_disable_audit_settings.yml"
         ],
         "tags": [
@@ -64731,8 +65127,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/",
           "https://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/",
+          "https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/application/mssqlserver/win_mssql_xp_cmdshell_audit_log.yml"
         ],
         "tags": [
@@ -64953,8 +65349,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100",
           "https://technet.microsoft.com/en-us/library/cc742154(v=ws.11).aspx",
+          "https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/application/microsoft_windows_backup/win_susp_backup_delete.yml"
         ],
         "tags": [
@@ -65053,11 +65449,12 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
+          "https://medium.com/falconforce/falconfriday-detecting-active-directory-data-collection-0xff21-c22d1a57494c",
           "https://github.com/fox-it/BloodHound.py/blob/d65eb614831cd30f26028ccb072f5e77ca287e0b/bloodhound/ad/domain.py#L427",
-          "https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/hunting-for-reconnaissance-activities-using-ldap-search-filters/ba-p/824726",
           "https://github.com/BloodHoundAD/SharpHound3/blob/7d96b991b1887ff50349ce59c80980bc0d95c86a/SharpHound3/LdapBuilder.cs",
           "https://github.com/PowerShellMafia/PowerSploit/blob/d943001a7defb5e0d1657085a77a0e78609be58f/Recon/PowerView.ps1",
-          "https://medium.com/falconforce/falconfriday-detecting-active-directory-data-collection-0xff21-c22d1a57494c",
+          "https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/hunting-for-reconnaissance-activities-using-ldap-search-filters/ba-p/824726",
+          "https://ipurple.team/2024/07/15/sharphound-detection/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/ldap/win_ldap_recon.yml"
         ],
         "tags": [
@@ -65106,8 +65503,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://www.techrepublic.com/article/how-to-track-down-usb-flash-drive-usage-in-windows-10s-event-viewer/",
           "https://df-stream.com/2014/01/the-windows-7-event-log-and-usb-device/",
+          "https://www.techrepublic.com/article/how-to-track-down-usb-flash-drive-usage-in-windows-10s-event-viewer/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/driverframeworks/win_usb_device_plugged.yml"
         ],
         "tags": [
@@ -65572,9 +65969,9 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/fortra/impacket/blob/edef71f17bc1240f9f8c957bbda98662951ac3ec/examples/smbexec.py#L60",
           "https://github.com/fortra/impacket/blob/33058eb2fde6976ea62e04bc7d6b629d64d44712/examples/smbexec.py#L286-L296",
           "https://blog.ropnop.com/using-credentials-to-own-windows-boxes-part-2-psexec-and-services/",
+          "https://github.com/fortra/impacket/blob/edef71f17bc1240f9f8c957bbda98662951ac3ec/examples/smbexec.py#L60",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/system/service_control_manager/win_system_hack_smbexec.yml"
         ],
         "tags": [
@@ -65903,8 +66300,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md",
           "https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/system/service_control_manager/win_system_defender_disabled.yml"
         ],
         "tags": [
@@ -66077,9 +66474,9 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/",
-          "https://www.crowdstrike.com/blog/getting-the-bacon-from-cobalt-strike-beacon/",
           "https://www.sans.org/webcasts/119395",
+          "https://www.crowdstrike.com/blog/getting-the-bacon-from-cobalt-strike-beacon/",
+          "https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/system/service_control_manager/win_system_cobaltstrike_service_installs.yml"
         ],
         "tags": [
@@ -66658,8 +67055,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/",
           "https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment",
+          "https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/system/service_control_manager/win_system_meterpreter_or_cobaltstrike_getsystem_service_installation.yml"
         ],
         "tags": [
@@ -66864,8 +67261,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/BishopFox/sliver/blob/79f2d48fcdfc2bee4713b78d431ea4b27f733f30/client/command/commands.go#L1231",
           "https://www.microsoft.com/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/",
+          "https://github.com/BishopFox/sliver/blob/79f2d48fcdfc2bee4713b78d431ea4b27f733f30/client/command/commands.go#L1231",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/system/service_control_manager/win_system_service_install_sliver.yml"
         ],
         "tags": [
@@ -66949,8 +67346,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://www.jpcert.or.jp/english/pub/sr/ir_research.html",
           "https://jpcertcc.github.io/ToolAnalysisResultSheet",
+          "https://www.jpcert.or.jp/english/pub/sr/ir_research.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/system/service_control_manager/win_system_service_install_sysinternals_psexec.yml"
         ],
         "tags": [
@@ -67026,9 +67423,9 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/wdormann/status/1347958161609809921",
-          "https://twitter.com/jonasLyk/status/1347900440000811010",
           "https://www.bleepingcomputer.com/news/security/windows-10-bug-corrupts-your-hard-drive-on-seeing-this-files-icon/",
+          "https://twitter.com/jonasLyk/status/1347900440000811010",
+          "https://twitter.com/wdormann/status/1347958161609809921",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/system/ntfs/win_system_ntfs_vuln_exploit.yml"
         ],
         "tags": [
@@ -67094,8 +67491,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/Ekultek/BlueKeep",
           "https://github.com/zerosum0x0/CVE-2019-0708",
+          "https://github.com/Ekultek/BlueKeep",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/system/termdd/win_system_rdp_potential_cve_2019_0708.yml"
         ],
         "tags": [
@@ -67129,9 +67526,9 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx",
-          "https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx",
           "https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html",
+          "https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx",
+          "https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/system/microsoft_windows_dhcp_server/win_system_susp_dhcp_config.yml"
         ],
         "tags": [
@@ -67164,9 +67561,9 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx",
-          "https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx",
           "https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html",
+          "https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx",
+          "https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/system/microsoft_windows_dhcp_server/win_system_susp_dhcp_config_failed.yml"
         ],
         "tags": [
@@ -67279,8 +67676,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd348773(v=ws.10)",
           "https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/kdc-event-16-27-des-encryption-disabled",
+          "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd348773(v=ws.10)",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/system/microsoft_windows_kerberos_key_distribution_center/win_system_kdcsvc_tgs_no_suitable_encryption_key_found.yml"
         ],
         "tags": [
@@ -67347,8 +67744,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/deviouspolack/status/832535435960209408",
           "https://www.hybrid-analysis.com/sample/027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745?environmentId=100",
+          "https://twitter.com/deviouspolack/status/832535435960209408",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/system/microsoft_windows_eventlog/win_system_eventlog_cleared.yml"
         ],
         "tags": [
@@ -67383,8 +67780,8 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/deviouspolack/status/832535435960209408",
           "https://www.hybrid-analysis.com/sample/027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745?environmentId=100",
+          "https://twitter.com/deviouspolack/status/832535435960209408",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/system/microsoft_windows_eventlog/win_system_susp_eventlog_cleared.yml"
         ],
         "tags": [
@@ -67535,11 +67932,11 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://winaero.com/enable-openssh-server-windows-10/",
           "https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0008-Lateral%20Movement/T1021.004-Remote%20Service%20SSH",
           "https://virtualizationreview.com/articles/2020/05/21/ssh-server-on-windows-10.aspx",
-          "https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse",
           "https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16",
+          "https://winaero.com/enable-openssh-server-windows-10/",
+          "https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/openssh/win_sshd_openssh_server_listening_on_socket.yml"
         ],
         "tags": [
@@ -67652,6 +68049,29 @@
       "uuid": "0d18728b-f5bf-4381-9dcf-915539fff6c2",
       "value": "Suspicious Cobalt Strike DNS Beaconing - DNS Client"
     },
+    {
+      "description": "Detects DNS queries for subdomains related to \"Put.io\" sharing website.",
+      "meta": {
+        "author": "Omar Khaled (@beacon_exe)",
+        "creation_date": "2024-08-23",
+        "falsepositive": [
+          "Legitimate DNS queries and usage of Put.io"
+        ],
+        "filename": "win_dns_client_put_io.yml",
+        "level": "medium",
+        "logsource.category": "No established category",
+        "logsource.product": "windows",
+        "refs": [
+          "https://darkatlas.io/blog/medusa-ransomware-group-opsec-failure",
+          "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/dns_client/win_dns_client_put_io.yml"
+        ],
+        "tags": [
+          "attack.command-and-control"
+        ]
+      },
+      "uuid": "8b69fd42-9dad-4674-abef-7fdef43ef92a",
+      "value": "DNS Query To Put.io - DNS Client"
+    },
     {
       "description": "Detects DNS resolution of an .onion address related to Tor routing networks",
       "meta": {
@@ -67844,9 +68264,9 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/",
           "https://forensicitguy.github.io/analyzing-magnitude-magniber-appx/",
           "https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/",
+          "https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_mal_appx_names.yml"
         ],
         "tags": [
@@ -67893,10 +68313,10 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/",
-          "Internal Research",
           "https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/",
           "https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting",
+          "https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/",
+          "Internal Research",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_uncommon_package_locations.yml"
         ],
         "tags": [
@@ -67919,10 +68339,10 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/",
-          "Internal Research",
           "https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/",
           "https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting",
+          "https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/",
+          "Internal Research",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_susp_appx_package_installation.yml"
         ],
         "tags": [
@@ -67945,10 +68365,10 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/",
-          "Internal Research",
           "https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/",
           "https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting",
+          "https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/",
+          "Internal Research",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_susp_package_locations.yml"
         ],
         "tags": [
@@ -67959,7 +68379,7 @@
       "value": "Suspicious AppX Package Locations"
     },
     {
-      "description": "Detects an appx package added the pipeline of the \"to be processed\" packages which is downloaded from a suspicious domain",
+      "description": "Detects an appx package added to the pipeline of the \"to be processed\" packages which was downloaded from a suspicious domain.\n",
       "meta": {
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "creation_date": "2023-01-11",
@@ -67971,10 +68391,10 @@
         "logsource.category": "No established category",
         "logsource.product": "windows",
         "refs": [
-          "https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/",
-          "Internal Research",
           "https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/",
           "https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting",
+          "https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/",
+          "Internal Research",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_susp_domains.yml"
         ],
         "tags": [
@@ -68224,8 +68644,8 @@
         "logsource.category": "image_load",
         "logsource.product": "windows",
         "refs": [
-          "https://strontic.github.io/xcyclopedia/library/DeviceEnroller.exe-24BEF0D6B0ECED36BB41831759FDE18D.html",
           "https://mobile.twitter.com/0gtweet/status/1564131230941122561",
+          "https://strontic.github.io/xcyclopedia/library/DeviceEnroller.exe-24BEF0D6B0ECED36BB41831759FDE18D.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_side_load_shell_chrome_api.yml"
         ],
         "tags": [
@@ -68268,11 +68688,11 @@
         "logsource.category": "image_load",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/XForceIR/SideLoadHunter/blob/cc7ef2e5d8908279b0c4cee4e8b6f85f7b8eed52/SideLoads/README.md",
-          "https://hijacklibs.net/",
           "https://blog.cyble.com/2022/07/21/qakbot-resurfaces-with-new-playbook/",
           "https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/",
           "https://blog.cyble.com/2022/07/27/targeted-attacks-being-carried-out-via-dll-sideloading/",
+          "https://hijacklibs.net/",
+          "https://github.com/XForceIR/SideLoadHunter/blob/cc7ef2e5d8908279b0c4cee4e8b6f85f7b8eed52/SideLoads/README.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_side_load_from_non_system_location.yml"
         ],
         "tags": [
@@ -68524,9 +68944,9 @@
         "logsource.category": "image_load",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/oulusoyum/status/1191329746069655553",
-          "https://lolbas-project.github.io/lolbas/Binaries/Tttracer/",
           "https://twitter.com/mattifestation/status/1196390321783025666",
+          "https://lolbas-project.github.io/lolbas/Binaries/Tttracer/",
+          "https://twitter.com/oulusoyum/status/1191329746069655553",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_dll_tttracer_module_load.yml"
         ],
         "tags": [
@@ -68766,12 +69186,12 @@
         "logsource.category": "image_load",
         "logsource.product": "windows",
         "refs": [
-          "https://clement.notin.org/blog/2020/09/12/CVE-2020-7315-McAfee-Agent-DLL-injection/",
+          "https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992",
           "http://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html",
           "https://decoded.avast.io/martinchlumecky/png-steganography/",
-          "https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992",
-          "https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/",
+          "https://clement.notin.org/blog/2020/09/12/CVE-2020-7315-McAfee-Agent-DLL-injection/",
           "https://github.com/Wh04m1001/SysmonEoP",
+          "https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_side_load_non_existent_dlls.yml"
         ],
         "tags": [
@@ -68815,10 +69235,10 @@
         "logsource.category": "image_load",
         "logsource.product": "windows",
         "refs": [
+          "https://www.crowdstrike.com/blog/windows-restart-manager-part-1/",
+          "https://www.crowdstrike.com/blog/windows-restart-manager-part-2/",
           "https://taiwan.postsen.com/business/88601/Hamas-hackers-use-data-destruction-software-BiBi-which-consumes-a-lot-of-processor-resources-to-wipe-Windows-computer-data--iThome.html",
           "https://web.archive.org/web/20231221193106/https://www.swascan.com/cactus-ransomware-malware-analysis/",
-          "https://www.crowdstrike.com/blog/windows-restart-manager-part-2/",
-          "https://www.crowdstrike.com/blog/windows-restart-manager-part-1/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_dll_rstrtmgr_uncommon_load.yml"
         ],
         "tags": [
@@ -68926,10 +69346,10 @@
         "logsource.category": "image_load",
         "logsource.product": "windows",
         "refs": [
-          "https://thewover.github.io/Introducing-Donut/",
-          "https://web.archive.org/web/20221026202428/https://gist.github.com/code-scrap/d7f152ffcdb3e0b02f7f394f5187f008",
           "https://github.com/tyranid/DotNetToJScript",
           "https://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html",
+          "https://web.archive.org/web/20221026202428/https://gist.github.com/code-scrap/d7f152ffcdb3e0b02f7f394f5187f008",
+          "https://thewover.github.io/Introducing-Donut/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_susp_script_dotnet_clr_dll_load.yml"
         ],
         "tags": [
@@ -68963,8 +69383,8 @@
         "logsource.category": "image_load",
         "logsource.product": "windows",
         "refs": [
-          "https://research.checkpoint.com/2023/malware-spotlight-camaro-dragons-tinynote-backdoor/",
           "https://www.qurium.org/alerts/targeted-malware-against-crph/",
+          "https://research.checkpoint.com/2023/malware-spotlight-camaro-dragons-tinynote-backdoor/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_side_load_smadhook.yml"
         ],
         "tags": [
@@ -69225,8 +69645,8 @@
         "logsource.category": "image_load",
         "logsource.product": "windows",
         "refs": [
-          "http://www.windowexe.com/bbs/board.php?q=jsschhlp-exe-c-program-files-common-files-justsystem-jsschhlp-jsschhlp",
           "https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/",
+          "http://www.windowexe.com/bbs/board.php?q=jsschhlp-exe-c-program-files-common-files-justsystem-jsschhlp-jsschhlp",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_side_load_jsschhlp.yml"
         ],
         "tags": [
@@ -69270,10 +69690,10 @@
         "logsource.product": "windows",
         "refs": [
           "https://bazaar.abuse.ch/sample/5cb9876681f78d3ee8a01a5aaa5d38b05ec81edc48b09e3865b75c49a2187831/",
-          "https://twitter.com/Max_Mal_/status/1775222576639291859",
           "https://csirt-cti.net/2024/02/01/stately-taurus-continued-new-information-on-cyberespionage-attacks-against-myanmar-military-junta/",
-          "https://thehackernews.com/2024/03/two-chinese-apt-groups-ramp-up-cyber.html",
           "https://twitter.com/DTCERT/status/1712785426895839339",
+          "https://thehackernews.com/2024/03/two-chinese-apt-groups-ramp-up-cyber.html",
+          "https://twitter.com/Max_Mal_/status/1775222576639291859",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_side_load_keyscrambler.yml"
         ],
         "tags": [
@@ -69315,10 +69735,10 @@
         "logsource.category": "image_load",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/bohops/WSMan-WinRM",
-          "https://bohops.com/2020/05/12/ws-management-com-another-approach-for-winrm-lateral-movement/",
           "https://learn.microsoft.com/en-us/windows/win32/winrm/windows-remote-management-architecture",
+          "https://github.com/bohops/WSMan-WinRM",
           "https://twitter.com/chadtilbury/status/1275851297770610688",
+          "https://bohops.com/2020/05/12/ws-management-com-another-approach-for-winrm-lateral-movement/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_wsman_provider_image_load.yml"
         ],
         "tags": [
@@ -69436,8 +69856,8 @@
         "logsource.category": "image_load",
         "logsource.product": "windows",
         "refs": [
-          "https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related/",
           "https://twitter.com/WhichbufferArda/status/1658829954182774784",
+          "https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related/",
           "https://securelist.com/apt-luminousmoth/103332/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_side_load_wwlib.yml"
         ],
@@ -69629,7 +70049,7 @@
       "value": "Third Party Software DLL Sideloading"
     },
     {
-      "description": "Detect usage of DLL \"coregen.exe\" (Microsoft CoreCLR Native Image Generator) binary to sideload arbitrary DLLs.",
+      "description": "Detect usage of the \"coregen.exe\" (Microsoft CoreCLR Native Image Generator) binary to sideload arbitrary DLLs.",
       "meta": {
         "author": "frack113",
         "creation_date": "2022-12-31",
@@ -69839,8 +70259,8 @@
         "logsource.category": "image_load",
         "logsource.product": "windows",
         "refs": [
-          "https://www.hexacorn.com/blog/2024/01/06/1-little-known-secret-of-fondue-exe/",
           "https://www.hexacorn.com/blog/2024/01/01/1-little-known-secret-of-hdwwiz-exe/",
+          "https://www.hexacorn.com/blog/2024/01/06/1-little-known-secret-of-fondue-exe/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_side_load_cpl_from_non_system_location.yml"
         ],
         "tags": [
@@ -70018,8 +70438,8 @@
         "logsource.category": "image_load",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/ly4k/SpoolFool",
           "https://github.com/hhlxf/PrintNightmare",
+          "https://github.com/ly4k/SpoolFool",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_spoolsv_dll_load.yml"
         ],
         "tags": [
@@ -70099,9 +70519,9 @@
         "logsource.category": "image_load",
         "logsource.product": "windows",
         "refs": [
-          "https://www.elastic.co/security-labs/Hunting-for-Suspicious-Windows-Libraries-for-Execution-and-Evasion",
           "https://unit42.paloaltonetworks.com/unsigned-dlls/?web_view=true",
           "https://akhere.hashnode.dev/hunting-unsigned-dlls-using-kql",
+          "https://www.elastic.co/security-labs/Hunting-for-Suspicious-Windows-Libraries-for-Execution-and-Evasion",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_susp_unsigned_dll.yml"
         ],
         "tags": [
@@ -70228,9 +70648,9 @@
         "logsource.category": "image_load",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/StopMalvertisin/status/1648604148848549888",
           "https://twitter.com/t3ft3lb/status/1656194831830401024",
           "https://www.roboform.com/",
+          "https://twitter.com/StopMalvertisin/status/1648604148848549888",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_side_load_robform.yml"
         ],
         "tags": [
@@ -70314,10 +70734,10 @@
         "logsource.category": "image_load",
         "logsource.product": "windows",
         "refs": [
+          "https://securitydatasets.com/notebooks/atomic/windows/credential_access/SDWIN-201020013208.html",
+          "https://learn.microsoft.com/en-us/windows/win32/api/wincred/nf-wincred-creduipromptforcredentialsa",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.002/T1056.002.md#atomic-test-2---powershell---prompt-user-for-password",
           "https://github.com/S12cybersecurity/RDPCredentialStealer",
-          "https://learn.microsoft.com/en-us/windows/win32/api/wincred/nf-wincred-creduipromptforcredentialsa",
-          "https://securitydatasets.com/notebooks/atomic/windows/credential_access/SDWIN-201020013208.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_dll_credui_uncommon_process_load.yml"
         ],
         "tags": [
@@ -70494,8 +70914,8 @@
         "logsource.category": "image_load",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/rbmaslen/status/1321859647091970051",
           "https://twitter.com/tifkin_/status/1321916444557365248",
+          "https://twitter.com/rbmaslen/status/1321859647091970051",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_dll_pcre_dotnet_dll_load.yml"
         ],
         "tags": [
@@ -70825,10 +71245,10 @@
         "logsource.category": "image_load",
         "logsource.product": "windows",
         "refs": [
+          "https://www.crowdstrike.com/blog/windows-restart-manager-part-1/",
+          "https://www.crowdstrike.com/blog/windows-restart-manager-part-2/",
           "https://taiwan.postsen.com/business/88601/Hamas-hackers-use-data-destruction-software-BiBi-which-consumes-a-lot-of-processor-resources-to-wipe-Windows-computer-data--iThome.html",
           "https://web.archive.org/web/20231221193106/https://www.swascan.com/cactus-ransomware-malware-analysis/",
-          "https://www.crowdstrike.com/blog/windows-restart-manager-part-2/",
-          "https://www.crowdstrike.com/blog/windows-restart-manager-part-1/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_dll_rstrtmgr_suspicious_load.yml"
         ],
         "tags": [
@@ -70956,8 +71376,8 @@
         "logsource.category": "image_load",
         "logsource.product": "windows",
         "refs": [
-          "https://wazuh.com/blog/detecting-xll-files-used-for-dropping-fin7-jssloader-with-wazuh/",
           "https://www.mandiant.com/resources/blog/lnk-between-browsers",
+          "https://wazuh.com/blog/detecting-xll-files-used-for-dropping-fin7-jssloader-with-wazuh/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_office_excel_xll_susp_load.yml"
         ],
         "tags": [
@@ -71311,8 +71731,8 @@
         "logsource.category": "image_load",
         "logsource.product": "windows",
         "refs": [
-          "https://blogs.blackberry.com/en/2022/12/mustang-panda-uses-the-russian-ukrainian-war-to-attack-europe-and-asia-pacific-targets",
           "https://app.any.run/tasks/6d8cabb0-dcda-44b6-8050-28d6ce281687/",
+          "https://blogs.blackberry.com/en/2022/12/mustang-panda-uses-the-russian-ukrainian-war-to-attack-europe-and-asia-pacific-targets",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_side_load_classicexplorer32.yml"
         ],
         "tags": [
@@ -71607,9 +72027,9 @@
         "logsource.category": "ps_classic_start",
         "logsource.product": "windows",
         "refs": [
-          "https://nmap.org/ncat/",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1095/T1095.md",
           "https://github.com/besimorhino/powercat",
+          "https://nmap.org/ncat/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_classic/posh_pc_powercat.yml"
         ],
         "tags": [
@@ -71743,8 +72163,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://github.com/bohops/WSMan-WinRM",
-          "https://bohops.com/2020/05/12/ws-management-com-another-approach-for-winrm-lateral-movement/",
           "https://twitter.com/chadtilbury/status/1275851297770610688",
+          "https://bohops.com/2020/05/12/ws-management-com-another-approach-for-winrm-lateral-movement/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_classic/posh_pc_wsman_com_provider_no_powershell.yml"
         ],
         "tags": [
@@ -72365,8 +72785,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.4",
-          "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.4",
           "https://adsecurity.org/?p=2604",
+          "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.4",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_set_policies_to_unsecure_level.yml"
         ],
         "tags": [
@@ -72400,10 +72820,10 @@
         "logsource.product": "windows",
         "refs": [
           "http://woshub.com/manage-windows-firewall-powershell/",
-          "https://web.archive.org/web/20230929023836/http://powershellhelp.space/commands/set-netfirewallrule-psv5.php",
-          "https://www.tutorialspoint.com/how-to-get-windows-firewall-profile-settings-using-powershell",
           "https://learn.microsoft.com/en-us/powershell/module/netsecurity/set-netfirewallprofile?view=windowsserver2022-ps",
+          "https://www.tutorialspoint.com/how-to-get-windows-firewall-profile-settings-using-powershell",
           "https://www.elastic.co/guide/en/security/current/windows-firewall-disabled-via-powershell.html",
+          "https://web.archive.org/web/20230929023836/http://powershellhelp.space/commands/set-netfirewallrule-psv5.php",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_windows_firewall_profile_disabled.yml"
         ],
         "tags": [
@@ -72572,8 +72992,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://github.com/samratashok/ADModule",
-          "https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-enumeration-with-ad-module-without-rsat-or-admin-privileges",
           "https://twitter.com/cyb3rops/status/1617108657166061568?s=20",
+          "https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-enumeration-with-ad-module-without-rsat-or-admin-privileges",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_active_directory_module_dll_import.yml"
         ],
         "tags": [
@@ -72674,8 +73094,8 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.001/src/Get-Keystrokes.ps1",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.001/src/Get-Keystrokes.ps1",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_keylogging.yml"
         ],
         "tags": [
@@ -72775,8 +73195,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html",
-          "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-112a",
           "https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps",
+          "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-112a",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_export_certificate.yml"
         ],
         "tags": [
@@ -72899,8 +73319,8 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-8.0",
           "https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-8.0",
+          "https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-8.0",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_susp_download.yml"
         ],
         "tags": [
@@ -73031,24 +73451,24 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/calebstewart/CVE-2021-1675",
-          "https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1",
-          "https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries",
           "https://github.com/samratashok/nishang",
-          "https://adsecurity.org/?p=2921",
-          "https://github.com/BloodHoundAD/BloodHound/blob/0927441f67161cc6dc08a53c63ceb8e333f55874/Collectors/AzureHound.ps1",
-          "https://github.com/HarmJ0y/DAMP",
-          "https://github.com/DarkCoderSc/PowerRunAsSystem/",
-          "https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/",
-          "https://github.com/adrecon/ADRecon",
-          "https://github.com/Kevin-Robertson/Powermad",
-          "https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1",
-          "https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1",
-          "https://bloodhound.readthedocs.io/en/latest/data-collection/azurehound.html",
           "https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/",
-          "https://github.com/adrecon/AzureADRecon",
+          "https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1",
+          "https://github.com/BloodHoundAD/BloodHound/blob/0927441f67161cc6dc08a53c63ceb8e333f55874/Collectors/AzureHound.ps1",
+          "https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1",
           "https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1",
+          "https://github.com/Kevin-Robertson/Powermad",
+          "https://github.com/calebstewart/CVE-2021-1675",
+          "https://github.com/adrecon/ADRecon",
+          "https://adsecurity.org/?p=2921",
+          "https://github.com/DarkCoderSc/PowerRunAsSystem/",
           "https://github.com/besimorhino/powercat",
+          "https://github.com/adrecon/AzureADRecon",
+          "https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1",
+          "https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/",
+          "https://github.com/HarmJ0y/DAMP",
+          "https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries",
+          "https://bloodhound.readthedocs.io/en/latest/data-collection/azurehound.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_malicious_commandlets.yml"
         ],
         "tags": [
@@ -73138,8 +73558,8 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1201/T1201.md#atomic-test-9---enumerate-active-directory-password-policy-with-get-addefaultdomainpasswordpolicy",
           "https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-addefaultdomainpasswordpolicy?view=windowsserver2022-ps",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1201/T1201.md#atomic-test-9---enumerate-active-directory-password-policy-with-get-addefaultdomainpasswordpolicy",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_susp_get_addefaultdomainpasswordpolicy.yml"
         ],
         "tags": [
@@ -73347,8 +73767,8 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
-          "https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319",
           "https://github.com/sense-of-security/ADRecon/blob/11881a24e9c8b207f31b56846809ce1fb189bcc9/ADRecon.ps1",
+          "https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_adrecon_execution.yml"
         ],
         "tags": [
@@ -73604,8 +74024,8 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.localaccounts/?view=powershell-5.1",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1098/T1098.md#atomic-test-1---admin-account-manipulate",
+          "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.localaccounts/?view=powershell-5.1",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_localuser.yml"
         ],
         "tags": [
@@ -73705,9 +74125,9 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
-          "https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html",
-          "https://blog.harmj0y.net/redteaming/from-kekeo-to-rubeus",
           "https://github.com/GhostPack/Rubeus",
+          "https://blog.harmj0y.net/redteaming/from-kekeo-to-rubeus",
+          "https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_hktl_rubeus.yml"
         ],
         "tags": [
@@ -74035,8 +74455,8 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.002/T1021.002.md#atomic-test-2---map-admin-share-powershell",
           "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/new-psdrive?view=powershell-7.2",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.002/T1021.002.md#atomic-test-2---map-admin-share-powershell",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_susp_new_psdrive.yml"
         ],
         "tags": [
@@ -74069,8 +74489,8 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
-          "https://www.pwndefend.com/2021/02/15/retrieving-passwords-from-veeam-backup-servers/",
           "https://labs.withsecure.com/publications/fin7-target-veeam-servers",
+          "https://www.pwndefend.com/2021/02/15/retrieving-passwords-from-veeam-backup-servers/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_veeam_credential_dumping_script.yml"
         ],
         "tags": [
@@ -74193,8 +74613,8 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1048/T1048.md#atomic-test-3---dnsexfiltration-doh",
           "https://github.com/Arno0x/DNSExfiltrator",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1048/T1048.md#atomic-test-3---dnsexfiltration-doh",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_invoke_dnsexfiltration.yml"
         ],
         "tags": [
@@ -74227,8 +74647,8 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
-          "https://blog.jourdant.me/post/3-ways-to-download-files-with-powershell",
           "https://4sysops.com/archives/use-powershell-to-download-a-file-with-http-https-and-ftp/",
+          "https://blog.jourdant.me/post/3-ways-to-download-files-with-powershell",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_web_request_cmd_and_cmdlets.yml"
         ],
         "tags": [
@@ -74294,8 +74714,8 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
-          "https://t.co/ezOTGy1a1G",
           "https://twitter.com/JohnLaTwC/status/850381440629981184",
+          "https://t.co/ezOTGy1a1G",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_prompt_credentials.yml"
         ],
         "tags": [
@@ -74483,8 +74903,8 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
-          "http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html",
           "https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/",
+          "http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_user_discovery_get_aduser.yml"
         ],
         "tags": [
@@ -74517,10 +74937,10 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
-          "https://youtu.be/5mqid-7zp8k?t=2481",
+          "https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1",
           "https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/",
           "https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html",
-          "https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1",
+          "https://youtu.be/5mqid-7zp8k?t=2481",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_mailboxexport_share.yml"
         ],
         "tags": [
@@ -74618,8 +75038,8 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.003/T1546.003.md",
           "https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/data/module_source/persistence/Persistence.psm1#L545",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.003/T1546.003.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_wmi_persistence.yml"
         ],
         "tags": [
@@ -74768,8 +75188,8 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/forgottentq/powershell/blob/9e616363d497143dc955c4fdce68e5c18d28a6cb/captureWindows-Endpoint.ps1#L13",
           "https://github.com/0xsyr0/Awesome-Cybersecurity-Handbooks/blob/7b8935fe4c82cb64d61343de1a8b2e38dd968534/handbooks/10_post_exploitation.md",
+          "https://github.com/forgottentq/powershell/blob/9e616363d497143dc955c4fdce68e5c18d28a6cb/captureWindows-Endpoint.ps1#L13",
           "https://github.com/redcanaryco/atomic-red-team/blob/5f866ca4517e837c4ea576e7309d0891e78080a8/atomics/T1040/T1040.md#atomic-test-16---powershell-network-sniffing",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_packet_capture.yml"
         ],
@@ -74838,9 +75258,9 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
+          "https://github.com/nccgroup/redsnarf/blob/35949b30106ae543dc6f2bc3f1be10c6d9a8d40e/redsnarf.py",
           "https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/",
           "https://github.com/S3cur3Th1sSh1t/Creds/blob/eac23d67f7f90c7fc8e3130587d86158c22aa398/PowershellScripts/jaws-enum.ps1",
-          "https://github.com/nccgroup/redsnarf/blob/35949b30106ae543dc6f2bc3f1be10c6d9a8d40e/redsnarf.py",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_wmi_unquoted_service_search.yml"
         ],
         "tags": [
@@ -74873,8 +75293,8 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/harleyQu1nn/AggressorScripts",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518/T1518.md",
+          "https://github.com/harleyQu1nn/AggressorScripts",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_software_discovery.yml"
         ],
         "tags": [
@@ -75063,10 +75483,10 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
+          "https://github.com/hlldz/Phant0m/blob/30c2935d8cf4aafda17ee2fab7cd0c4aa9a607c2/old/Invoke-Phant0m.ps1",
+          "https://gist.github.com/MHaggis/0dbe00ad401daa7137c81c99c268cfb7",
           "https://posts.specterops.io/entering-a-covenant-net-command-and-control-e11038bcf462",
           "https://github.com/PowerShellMafia/PowerSploit/blob/d943001a7defb5e0d1657085a77a0e78609be58f/CodeExecution/Invoke-ReflectivePEInjection.ps1",
-          "https://gist.github.com/MHaggis/0dbe00ad401daa7137c81c99c268cfb7",
-          "https://github.com/hlldz/Phant0m/blob/30c2935d8cf4aafda17ee2fab7cd0c4aa9a607c2/old/Invoke-Phant0m.ps1",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_susp_keywords.yml"
         ],
         "tags": [
@@ -75211,8 +75631,8 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1571/T1571.md#atomic-test-1---testing-usage-of-uncommonly-used-port-with-powershell",
           "https://learn.microsoft.com/en-us/powershell/module/nettcpip/test-netconnection?view=windowsserver2022-ps",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1571/T1571.md#atomic-test-1---testing-usage-of-uncommonly-used-port-with-powershell",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_test_netconnection.yml"
         ],
         "tags": [
@@ -75331,9 +75751,9 @@
         "logsource.product": "windows",
         "refs": [
           "https://adsecurity.org/?p=2277",
-          "https://powersploit.readthedocs.io/en/stable/Recon/README",
-          "https://github.com/PowerShellMafia/PowerSploit/tree/master/Recon",
           "https://thedfirreport.com/2020/10/08/ryuks-return",
+          "https://github.com/PowerShellMafia/PowerSploit/tree/master/Recon",
+          "https://powersploit.readthedocs.io/en/stable/Recon/README",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_powerview_malicious_commandlets.yml"
         ],
         "tags": [
@@ -75399,8 +75819,8 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/dotnet/api/microsoft.hpc.scheduler.store.cx509enrollmentwebclassfactoryclass?view=hpc-sdk-5.1.6115",
           "https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=41",
+          "https://learn.microsoft.com/en-us/dotnet/api/microsoft.hpc.scheduler.store.cx509enrollmentwebclassfactoryclass?view=hpc-sdk-5.1.6115",
           "https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=42",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_x509enrollment.yml"
         ],
@@ -75534,9 +75954,9 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md",
-          "https://github.com/redcanaryco/atomic-red-team/blob/02cb591f75064ffe1e0df9ac3ed5972a2e491c97/atomics/T1087.002/T1087.002.md",
           "https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-adcomputer",
+          "https://github.com/redcanaryco/atomic-red-team/blob/02cb591f75064ffe1e0df9ac3ed5972a2e491c97/atomics/T1087.002/T1087.002.md",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_get_adcomputer.yml"
         ],
         "tags": [
@@ -75577,8 +75997,8 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
-          "https://www.offensive-security.com/metasploit-unleashed/timestomp/",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.006/T1070.006.md",
+          "https://www.offensive-security.com/metasploit-unleashed/timestomp/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_timestomp.yml"
         ],
         "tags": [
@@ -75611,8 +76031,8 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1&viewFallbackFrom=powershell-7",
           "https://attack.mitre.org/datasources/DS0005/",
+          "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1&viewFallbackFrom=powershell-7",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_create_volume_shadow_copy.yml"
         ],
         "tags": [
@@ -75678,11 +76098,11 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
+          "https://reconshell.com/winpwn-tool-for-internal-windows-pentesting-and-ad-security/",
+          "https://github.com/redcanaryco/atomic-red-team/blob/4d6c4e8e23d465af7a2388620cfe3f8c76e16cf0/atomics/T1082/T1082.md",
           "https://grep.app/search?q=winpwn&filter[repo][0]=redcanaryco/atomic-red-team",
           "https://www.publicnow.com/view/EB87DB49C654D9B63995FAD4C9DE3D3CC4F6C3ED?1671634841",
           "https://github.com/S3cur3Th1sSh1t/WinPwn",
-          "https://github.com/redcanaryco/atomic-red-team/blob/4d6c4e8e23d465af7a2388620cfe3f8c76e16cf0/atomics/T1082/T1082.md",
-          "https://reconshell.com/winpwn-tool-for-internal-windows-pentesting-and-ad-security/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_hktl_winpwn.yml"
         ],
         "tags": [
@@ -75775,8 +76195,8 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
-          "https://www.virustotal.com/gui/file/af1c82237b6e5a3a7cdbad82cc498d298c67845d92971bada450023d1335e267/content",
           "https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse?tabs=powershell",
+          "https://www.virustotal.com/gui/file/af1c82237b6e5a3a7cdbad82cc498d298c67845d92971bada450023d1335e267/content",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_add_windows_capability.yml"
         ],
         "tags": [
@@ -75799,9 +76219,9 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
+          "https://stefanos.cloud/blog/kb/how-to-clear-the-powershell-command-history/",
           "https://www.shellhacks.com/clear-history-powershell/",
           "https://community.sophos.com/sophos-labs/b/blog/posts/powershell-command-history-forensics",
-          "https://stefanos.cloud/blog/kb/how-to-clear-the-powershell-command-history/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_clearing_windows_console_history.yml"
         ],
         "tags": [
@@ -75877,8 +76297,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf",
-          "http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html",
           "https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/",
+          "http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_computer_discovery_get_adcomputer.yml"
         ],
         "tags": [
@@ -76069,8 +76489,8 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/NathanMcNulty/status/1569497348841287681",
           "https://learn.microsoft.com/en-us/powershell/module/dnsclient/add-dnsclientnrptrule?view=windowsserver2022-ps",
+          "https://twitter.com/NathanMcNulty/status/1569497348841287681",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_add_dnsclient_rule.yml"
         ],
         "tags": [
@@ -76179,8 +76599,8 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/windows/msix/package/unsigned-package",
           "https://twitter.com/WindowsDocs/status/1620078135080325122",
+          "https://learn.microsoft.com/en-us/windows/msix/package/unsigned-package",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_install_unsigned_appx_packages.yml"
         ],
         "tags": [
@@ -76204,8 +76624,8 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/nas_bench/status/1537919885031772161",
           "https://lolbas-project.github.io/lolbas/Binaries/Msdt/",
+          "https://twitter.com/nas_bench/status/1537919885031772161",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_susp_follina_execution.yml"
         ],
         "tags": [
@@ -76381,8 +76801,8 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.005/T1053.005.md#atomic-test-6---wmi-invoke-cimmethod-scheduled-task",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.005/T1053.005.md#atomic-test-4---powershell-cmdlet-scheduled-task",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.005/T1053.005.md#atomic-test-6---wmi-invoke-cimmethod-scheduled-task",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_cmdlet_scheduled_task.yml"
         ],
         "tags": [
@@ -76415,9 +76835,9 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/oroneequalsone/status/1568432028361830402",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.001/T1070.001.md",
           "https://eqllib.readthedocs.io/en/latest/analytics/5b223758-07d6-4100-9e11-238cfdd0fe97.html",
+          "https://twitter.com/oroneequalsone/status/1568432028361830402",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_susp_clear_eventlog.yml"
         ],
         "tags": [
@@ -76519,8 +76939,8 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/windows/win32/projfs/enabling-windows-projected-file-system",
           "https://learn.microsoft.com/en-us/windows/wsl/install-on-server",
+          "https://learn.microsoft.com/en-us/windows/win32/projfs/enabling-windows-projected-file-system",
           "https://learn.microsoft.com/en-us/powershell/module/dism/enable-windowsoptionalfeature?view=windowsserver2022-ps",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_enable_susp_windows_optional_feature.yml"
         ],
@@ -76611,8 +77031,8 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1615/T1615.md",
           "https://learn.microsoft.com/en-us/powershell/module/grouppolicy/get-gpo?view=windowsserver2022-ps",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1615/T1615.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_susp_get_gpo.yml"
         ],
         "tags": [
@@ -76779,8 +77199,8 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1497.001/T1497.001.md",
           "https://techgenix.com/malicious-powershell-scripts-evade-detection/",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1497.001/T1497.001.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_detect_vm_env.yml"
         ],
         "tags": [
@@ -76855,8 +77275,8 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/Gerenios/AADInternals",
           "https://o365blog.com/aadinternals/",
+          "https://github.com/Gerenios/AADInternals",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_aadinternals_cmdlets_execution.yml"
         ],
         "tags": [
@@ -77115,9 +77535,9 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
-          "https://www.trendmicro.com/en_id/research/22/e/uncovering-a-kingminer-botnet-attack-using-trend-micro-managed-x.html",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.001/T1059.001.md#atomic-test-7---powershell-msxml-com-object---with-prompt",
           "https://learn.microsoft.com/en-us/previous-versions/windows/desktop/ms766431(v=vs.85)",
+          "https://www.trendmicro.com/en_id/research/22/e/uncovering-a-kingminer-botnet-attack-using-trend-micro-managed-x.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_msxml_com.yml"
         ],
         "tags": [
@@ -77291,8 +77711,8 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/Start-Process?view=powershell-5.1&viewFallbackFrom=powershell-7",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1036.003/T1036.003.md",
+          "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/Start-Process?view=powershell-5.1&viewFallbackFrom=powershell-7",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_susp_start_process.yml"
         ],
         "tags": [
@@ -77325,9 +77745,9 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
+          "https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2022-ps",
           "https://bidouillesecurity.com/disable-windows-defender-in-powershell/",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md",
-          "https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2022-ps",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_tamper_windows_defender_set_mp.yml"
         ],
         "tags": [
@@ -77393,10 +77813,10 @@
         "logsource.category": "ps_script",
         "logsource.product": "windows",
         "refs": [
-          "https://www.virustotal.com/gui/file/d4486b63512755316625230e0c9c81655093be93876e0d80732e7eeaf7d83476/content",
-          "https://www.virustotal.com/gui/file/720a7ee9f2178c70501d7e3f4bcc28a4f456e200486dbd401b25af6da3b4da62/content",
           "https://learn.microsoft.com/en-us/dotnet/api/system.windows.input.keyboard.iskeydown?view=windowsdesktop-7.0",
           "https://twitter.com/ScumBots/status/1610626724257046529",
+          "https://www.virustotal.com/gui/file/d4486b63512755316625230e0c9c81655093be93876e0d80732e7eeaf7d83476/content",
+          "https://www.virustotal.com/gui/file/720a7ee9f2178c70501d7e3f4bcc28a4f456e200486dbd401b25af6da3b4da62/content",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_susp_keylogger_activity.yml"
         ],
         "tags": [
@@ -77639,8 +78059,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1048.003/T1048.003.md#atomic-test-5---exfiltration-over-alternative-protocol---smtp",
-          "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/send-mailmessage?view=powershell-7.4",
           "https://www.ietf.org/rfc/rfc2821.txt",
+          "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/send-mailmessage?view=powershell-7.4",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_send_mailmessage.yml"
         ],
         "tags": [
@@ -77933,8 +78353,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://github.com/samratashok/ADModule",
-          "https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-enumeration-with-ad-module-without-rsat-or-admin-privileges",
           "https://twitter.com/cyb3rops/status/1617108657166061568?s=20",
+          "https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-enumeration-with-ad-module-without-rsat-or-admin-privileges",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_module/posh_pm_active_directory_module_dll_import.yml"
         ],
         "tags": [
@@ -78110,8 +78530,8 @@
         "logsource.category": "ps_module",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/Hackplayers/evil-winrm/blob/7514b055d67ec19836e95c05bd63e7cc47c4c2aa/evil-winrm.rb",
           "https://github.com/search?q=repo%3AHackplayers%2Fevil-winrm++shell.run%28&type=code",
+          "https://github.com/Hackplayers/evil-winrm/blob/7514b055d67ec19836e95c05bd63e7cc47c4c2aa/evil-winrm.rb",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_module/posh_pm_hktl_evil_winrm_execution.yml"
         ],
         "tags": [
@@ -78209,8 +78629,8 @@
         "logsource.category": "ps_module",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/OTRF/detection-hackathon-apt29/issues/8",
           "https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/4.A.3_09F29912-8E93-461E-9E89-3F06F6763383.md",
+          "https://github.com/OTRF/detection-hackathon-apt29/issues/8",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_module/posh_pm_decompress_commands.yml"
         ],
         "tags": [
@@ -78276,23 +78696,23 @@
         "logsource.category": "ps_module",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1",
-          "https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries",
           "https://github.com/nettitude/Invoke-PowerThIEf",
-          "https://github.com/samratashok/nishang",
-          "https://github.com/S3cur3Th1sSh1t/WinPwn",
-          "https://github.com/HarmJ0y/DAMP",
-          "https://github.com/DarkCoderSc/PowerRunAsSystem/",
-          "https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/",
           "https://github.com/CsEnox/EventViewer-UACBypass",
-          "https://github.com/NetSPI/PowerUpSQL",
-          "https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1",
           "https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1",
-          "https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1",
           "https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/",
-          "https://github.com/AlsidOfficial/WSUSpendu/",
+          "https://github.com/samratashok/nishang",
+          "https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1",
+          "https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1",
           "https://github.com/PowerShellMafia/PowerSploit",
+          "https://github.com/DarkCoderSc/PowerRunAsSystem/",
           "https://github.com/besimorhino/powercat",
+          "https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1",
+          "https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/",
+          "https://github.com/HarmJ0y/DAMP",
+          "https://github.com/NetSPI/PowerUpSQL",
+          "https://github.com/AlsidOfficial/WSUSpendu/",
+          "https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries",
+          "https://github.com/S3cur3Th1sSh1t/WinPwn",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_module/posh_pm_exploit_scripts.yml"
         ],
         "tags": [
@@ -78325,8 +78745,8 @@
         "logsource.category": "ps_module",
         "logsource.product": "windows",
         "refs": [
-          "https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/",
           "https://github.com/MichaelGrafnetter/DSInternals/blob/7ba59c12ee9a1cb430d7dc186a3366842dd612c8/Documentation/PowerShell/Get-ADDBAccount.md",
+          "https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_module/posh_pm_get_addbaccount.yml"
         ],
         "tags": [
@@ -78435,24 +78855,24 @@
         "logsource.category": "ps_module",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/calebstewart/CVE-2021-1675",
-          "https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1",
-          "https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries",
           "https://github.com/samratashok/nishang",
-          "https://adsecurity.org/?p=2921",
-          "https://github.com/BloodHoundAD/BloodHound/blob/0927441f67161cc6dc08a53c63ceb8e333f55874/Collectors/AzureHound.ps1",
-          "https://github.com/HarmJ0y/DAMP",
-          "https://github.com/DarkCoderSc/PowerRunAsSystem/",
-          "https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/",
-          "https://github.com/adrecon/ADRecon",
-          "https://github.com/Kevin-Robertson/Powermad",
-          "https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1",
-          "https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1",
-          "https://bloodhound.readthedocs.io/en/latest/data-collection/azurehound.html",
           "https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/",
-          "https://github.com/adrecon/AzureADRecon",
+          "https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1",
+          "https://github.com/BloodHoundAD/BloodHound/blob/0927441f67161cc6dc08a53c63ceb8e333f55874/Collectors/AzureHound.ps1",
+          "https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1",
           "https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1",
+          "https://github.com/Kevin-Robertson/Powermad",
+          "https://github.com/calebstewart/CVE-2021-1675",
+          "https://github.com/adrecon/ADRecon",
+          "https://adsecurity.org/?p=2921",
+          "https://github.com/DarkCoderSc/PowerRunAsSystem/",
           "https://github.com/besimorhino/powercat",
+          "https://github.com/adrecon/AzureADRecon",
+          "https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1",
+          "https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/",
+          "https://github.com/HarmJ0y/DAMP",
+          "https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries",
+          "https://bloodhound.readthedocs.io/en/latest/data-collection/azurehound.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_module/posh_pm_malicious_commandlets.yml"
         ],
         "tags": [
@@ -78542,8 +78962,8 @@
         "logsource.category": "ps_module",
         "logsource.product": "windows",
         "refs": [
-          "https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-8.0",
           "https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-8.0",
+          "https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-8.0",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_module/posh_pm_susp_download.yml"
         ],
         "tags": [
@@ -79063,8 +79483,8 @@
         "logsource.category": "create_stream_hash",
         "logsource.product": "windows",
         "refs": [
-          "https://fabian-voith.de/2020/06/25/sysmon-v11-1-reads-alternate-data-streams/",
           "https://twitter.com/cyb3rops/status/1659175181695287297",
+          "https://fabian-voith.de/2020/06/25/sysmon-v11-1-reads-alternate-data-streams/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/create_stream_hash/create_stream_hash_zip_tld_download.yml"
         ],
         "tags": [
@@ -79108,7 +79528,7 @@
         }
       ],
       "uuid": "ae02ed70-11aa-4a22-b397-c0d0e8f6ea99",
-      "value": "Unusual File Download From File Sharing Websites"
+      "value": "Unusual File Download From File Sharing Websites - File Stream"
     },
     {
       "description": "Detects the creation of a named file stream with the imphash of a well-known hack tool",
@@ -79124,16 +79544,16 @@
         "logsource.product": "windows",
         "refs": [
           "https://www.tarasco.org/security/pwdump_7/",
-          "https://github.com/outflanknl/Dumpert",
-          "https://github.com/ohpe/juicy-potato",
-          "https://github.com/topotam/PetitPotam",
-          "https://github.com/gentilkiwi/mimikatz",
-          "https://github.com/xuanxuan0/DripLoader",
-          "https://github.com/fortra/nanodump",
-          "https://github.com/hfiref0x/UACME",
-          "https://github.com/antonioCoco/RoguePotato",
-          "https://github.com/wavestone-cdt/EDRSandblast",
           "https://github.com/codewhitesec/HandleKatz",
+          "https://github.com/antonioCoco/RoguePotato",
+          "https://github.com/outflanknl/Dumpert",
+          "https://github.com/gentilkiwi/mimikatz",
+          "https://github.com/ohpe/juicy-potato",
+          "https://github.com/fortra/nanodump",
+          "https://github.com/wavestone-cdt/EDRSandblast",
+          "https://github.com/hfiref0x/UACME",
+          "https://github.com/topotam/PetitPotam",
+          "https://github.com/xuanxuan0/DripLoader",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/create_stream_hash/create_stream_hash_hktl_generic_download.yml"
         ],
         "tags": [
@@ -79249,8 +79669,8 @@
         "logsource.category": "create_stream_hash",
         "logsource.product": "windows",
         "refs": [
-          "https://lolbas-project.github.io/lolbas/Binaries/Regedit/",
           "https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f",
+          "https://lolbas-project.github.io/lolbas/Binaries/Regedit/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/create_stream_hash/create_stream_hash_regedit_export_to_ads.yml"
         ],
         "tags": [
@@ -79305,7 +79725,7 @@
         }
       ],
       "uuid": "52182dfb-afb7-41db-b4bc-5336cb29b464",
-      "value": "Suspicious File Download From File Sharing Websites"
+      "value": "Suspicious File Download From File Sharing Websites -  File Stream"
     },
     {
       "description": "Detects the download of suspicious file type from URLs with IP",
@@ -79320,8 +79740,8 @@
         "logsource.category": "create_stream_hash",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/trustedsec/SysmonCommunityGuide/blob/adcdfee20999f422b974c8d4149bf4c361237db7/chapters/file-stream-creation-hash.md",
           "https://labs.withsecure.com/publications/detecting-onenote-abuse",
+          "https://github.com/trustedsec/SysmonCommunityGuide/blob/adcdfee20999f422b974c8d4149bf4c361237db7/chapters/file-stream-creation-hash.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/create_stream_hash/create_stream_hash_susp_ip_domains.yml"
         ],
         "tags": [
@@ -79355,8 +79775,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://github.com/codewhitesec/SysmonEnte/blob/main/screens/1.png",
-          "https://github.com/codewhitesec/SysmonEnte/",
           "https://codewhitesec.blogspot.com/2022/09/attacks-on-sysmon-revisited-sysmonente.html",
+          "https://github.com/codewhitesec/SysmonEnte/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_access/proc_access_win_hktl_sysmonente.yml"
         ],
         "tags": [
@@ -79434,8 +79854,8 @@
         "logsource.category": "process_access",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/skelsec/pypykatz",
           "https://twitter.com/bh4b3sh/status/1303674603819081728",
+          "https://github.com/skelsec/pypykatz",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_access/proc_access_win_lsass_python_based_tool.yml"
         ],
         "tags": [
@@ -79470,8 +79890,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://research.splunk.com/endpoint/windows_possible_credential_dumping/",
-          "https://web.archive.org/web/20230329170326/https://blog.menasec.net/2019/02/threat-hunting-21-procdump-or-taskmgr.html",
           "https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html",
+          "https://web.archive.org/web/20230329170326/https://blog.menasec.net/2019/02/threat-hunting-21-procdump-or-taskmgr.html",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.001/T1003.001.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_access/proc_access_win_lsass_memdump.yml"
         ],
@@ -79539,8 +79959,8 @@
         "logsource.category": "process_access",
         "logsource.product": "windows",
         "refs": [
-          "https://gist.github.com/hfiref0x/de9c83966623236f5ebf8d9ae2407611",
           "https://www.snip2code.com/Snippet/4397378/UAC-bypass-using-EditionUpgradeManager-C/",
+          "https://gist.github.com/hfiref0x/de9c83966623236f5ebf8d9ae2407611",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_access/proc_access_win_uac_bypass_editionupgrademanagerobj.yml"
         ],
         "tags": [
@@ -79678,9 +80098,9 @@
         "logsource.category": "process_access",
         "logsource.product": "windows",
         "refs": [
+          "https://github.com/elastic/detection-rules/blob/2bc1795f3d7bcc3946452eb4f07ae799a756d94e/rules/windows/credential_access_lsass_handle_via_malseclogon.toml",
           "https://twitter.com/SBousseaden/status/1541920424635912196",
           "https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-3.html",
-          "https://github.com/elastic/detection-rules/blob/2bc1795f3d7bcc3946452eb4f07ae799a756d94e/rules/windows/credential_access_lsass_handle_via_malseclogon.toml",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_access/proc_access_win_lsass_seclogon_access.yml"
         ],
         "tags": [
@@ -79713,8 +80133,8 @@
         "logsource.category": "process_access",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/_xpn_/status/1491557187168178176",
           "https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dump-credentials-from-lsass-process-without-mimikatz",
+          "https://twitter.com/_xpn_/status/1491557187168178176",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_access/proc_access_win_lsass_dump_keyword_image.yml"
         ],
         "tags": [
@@ -79951,8 +80371,8 @@
         "logsource.category": "process_access",
         "logsource.product": "windows",
         "refs": [
-          "https://twitter.com/shantanukhande/status/1229348874298388484",
           "https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/",
+          "https://twitter.com/shantanukhande/status/1229348874298388484",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_access/proc_access_win_lsass_dump_comsvcs_dll.yml"
         ],
         "tags": [
@@ -80018,8 +80438,8 @@
         "logsource.product": "windows",
         "refs": [
           "https://twitter.com/mrd0x/status/1460597833917251595",
-          "https://twitter.com/_xpn_/status/1491557187168178176",
           "https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dump-credentials-from-lsass-process-without-mimikatz",
+          "https://twitter.com/_xpn_/status/1491557187168178176",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_access/proc_access_win_lsass_whitelisted_process_names.yml"
         ],
         "tags": [
@@ -80055,8 +80475,8 @@
         "refs": [
           "https://learn.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights",
           "https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment",
-          "https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow",
           "https://web.archive.org/web/20230420013146/http://security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL_notes.pdf",
+          "https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow",
           "https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_access/proc_access_win_lsass_susp_access_flag.yml"
         ],
@@ -80091,8 +80511,8 @@
         "logsource.category": "process_access",
         "logsource.product": "windows",
         "refs": [
-          "https://github.com/boku7/spawn",
           "https://github.com/boku7/injectAmsiBypass",
+          "https://github.com/boku7/spawn",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_access/proc_access_win_hktl_cobaltstrike_bof_injection_pattern.yml"
         ],
         "tags": [
@@ -80406,10 +80826,10 @@
         "logsource.category": "No established category",
         "logsource.product": "zeek",
         "refs": [
-          "https://msrc.microsoft.com/update-guide/vulnerability/ADV210003",
-          "https://vx-underground.org/archive/Symantec/windows-vista-network-attack-07-en.pdf",
           "https://threatpost.com/microsoft-petitpotam-poc/168163/",
           "https://github.com/topotam/PetitPotam/blob/d83ac8f2dd34654628c17490f99106eb128e7d1e/PetitPotam/PetitPotam.cpp",
+          "https://msrc.microsoft.com/update-guide/vulnerability/ADV210003",
+          "https://vx-underground.org/archive/Symantec/windows-vista-network-attack-07-en.pdf",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_potential_petit_potam_efs_rpc_call.yml"
         ],
         "tags": [
@@ -80449,8 +80869,8 @@
         "logsource.category": "No established category",
         "logsource.product": "zeek",
         "refs": [
-          "https://github.com/Maka8ka/NGLite",
           "https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/",
+          "https://github.com/Maka8ka/NGLite",
           "https://github.com/nknorg/nkn-sdk-go",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dns_nkn.yml"
         ],
@@ -80696,12 +81116,12 @@
         "logsource.category": "No established category",
         "logsource.product": "zeek",
         "refs": [
-          "https://www.crowdstrike.com/blog/cve-2021-1678-printer-spooler-relay-security-advisory/",
           "https://github.com/zeek/zeek/blob/691b099de13649d6576c7b9d637f8213ff818832/scripts/base/protocols/dce-rpc/consts.zeek",
-          "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-par/93d1915d-4d9f-4ceb-90a7-e8f2a59adc29",
-          "https://old.zeek.org/zeekweek2019/slides/bzar.pdf",
           "https://github.com/corelight/CVE-2021-1675",
           "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527",
+          "https://www.crowdstrike.com/blog/cve-2021-1678-printer-spooler-relay-security-advisory/",
+          "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-par/93d1915d-4d9f-4ceb-90a7-e8f2a59adc29",
+          "https://old.zeek.org/zeekweek2019/slides/bzar.pdf",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_printnightmare_print_driver_install.yml"
         ],
         "tags": [
@@ -80889,8 +81309,8 @@
         "logsource.product": "zeek",
         "refs": [
           "https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1",
-          "https://twitter.com/_dirkjan/status/1309214379003588608",
           "https://dirkjanm.io/a-different-way-of-abusing-zerologon/",
+          "https://twitter.com/_dirkjan/status/1309214379003588608",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_smb_spoolss_named_pipe.yml"
         ],
         "tags": [
@@ -81017,9 +81437,9 @@
         "logsource.category": "No established category",
         "logsource.product": "cisco",
         "refs": [
-          "https://www.cisco.com/E-Learning/bulk/public/tac/cim/cib/using_cisco_ios_software/cmdrefs/show_startup-config.htm",
           "https://blog.router-switch.com/2013/11/show-running-config/",
           "https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/config-mgmt/configuration/15-sy/config-mgmt-15-sy-book/cm-config-diff.html",
+          "https://www.cisco.com/E-Learning/bulk/public/tac/cim/cib/using_cisco_ios_software/cmdrefs/show_startup-config.htm",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/network/cisco/aaa/cisco_cli_collect_data.yml"
         ],
         "tags": [
@@ -81838,10 +82258,10 @@
         "logsource.category": "dns",
         "logsource.product": "No established product",
         "refs": [
-          "https://researchcenter.paloaltonetworks.com/2018/03/unit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users/",
-          "https://core.telegram.org/bots/faq",
           "https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/",
+          "https://researchcenter.paloaltonetworks.com/2018/03/unit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users/",
           "https://blog.malwarebytes.com/threat-analysis/2016/11/telecrypt-the-ransomware-abusing-telegram-api-defeated/",
+          "https://core.telegram.org/bots/faq",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/network/dns/net_dns_susp_telegram_api.yml"
         ],
         "tags": [
@@ -81970,9 +82390,9 @@
         "logsource.category": "firewall",
         "logsource.product": "No established product",
         "refs": [
-          "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf",
           "https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf",
           "https://www.cisecurity.org/controls/cis-controls-list/",
+          "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/network/firewall/net_firewall_cleartext_protocols.yml"
         ],
         "tags": [
@@ -82063,10 +82483,10 @@
         "logsource.category": "proxy",
         "logsource.product": "No established product",
         "refs": [
-          "https://github.com/yeyintminthuhtut/Malleable-C2-Profiles-Collection/",
           "https://github.com/rsmudge/Malleable-C2-Profiles/blob/26323784672913923d20c5a638c6ca79459e8529/normal/ocsp.profile",
-          "https://github.com/rsmudge/Malleable-C2-Profiles/blob/26323784672913923d20c5a638c6ca79459e8529/normal/amazon.profile",
           "https://www.hybrid-analysis.com/sample/ee5eca8648e45e2fea9dac0d920ef1a1792d8690c41ee7f20343de1927cc88b9?environmentId=100",
+          "https://github.com/yeyintminthuhtut/Malleable-C2-Profiles-Collection/",
+          "https://github.com/rsmudge/Malleable-C2-Profiles/blob/26323784672913923d20c5a638c6ca79459e8529/normal/amazon.profile",
           "https://github.com/rsmudge/Malleable-C2-Profiles/blob/26323784672913923d20c5a638c6ca79459e8529/normal/onedrive_getonly.profile",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/web/proxy_generic/proxy_hktl_cobalt_strike_malleable_c2_requests.yml"
         ],
@@ -82101,9 +82521,9 @@
         "logsource.category": "proxy",
         "logsource.product": "No established product",
         "refs": [
+          "https://www.trellix.com/en-us/about/newsroom/stories/research/beyond-file-search-a-novel-method.html",
           "https://dear-territory-023.notion.site/WebDav-Share-Testing-e4950fa0c00149c3aa430d779b9b1d0f?pvs=4",
           "https://micahbabinski.medium.com/search-ms-webdav-and-chill-99c5b23ac462",
-          "https://www.trellix.com/en-us/about/newsroom/stories/research/beyond-file-search-a-novel-method.html",
           "https://www.trendmicro.com/en_no/research/24/b/cve202421412-water-hydra-targets-traders-with-windows-defender-s.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/web/proxy_generic/proxy_webdav_external_execution.yml"
         ],
@@ -82179,10 +82599,10 @@
         "logsource.category": "proxy",
         "logsource.product": "No established product",
         "refs": [
-          "https://krebsonsecurity.com/2018/06/bad-men-at-work-please-dont-click/",
           "https://promos.mcafee.com/en-US/PDF/MTMW_Report.pdf",
           "https://www.symantec.com/connect/blogs/shady-tld-research-gdn-and-our-2016-wrap",
           "https://www.spamhaus.org/statistics/tlds/",
+          "https://krebsonsecurity.com/2018/06/bad-men-at-work-please-dont-click/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/web/proxy_generic/proxy_download_susp_tlds_blacklist.yml"
         ],
         "tags": [
@@ -82343,14 +82763,14 @@
         "logsource.category": "proxy",
         "logsource.product": "No established product",
         "refs": [
-          "http://www.botopedia.org/search?searchword=scan&searchphrase=all",
-          "https://www.bluecoat.com/en-gb/security-blog/2015-05-05/know-your-agents",
-          "https://pbs.twimg.com/media/FtYbfsDXoAQ1Y8M?format=jpg&name=large",
-          "https://twitter.com/crep1x/status/1635034100213112833",
-          "https://perishablepress.com/blacklist/ua-2013.txt",
           "http://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-user_agents.rules",
-          "https://networkraptor.blogspot.com/2015/01/user-agent-strings.html",
+          "https://twitter.com/crep1x/status/1635034100213112833",
           "https://twitter.com/kladblokje_88/status/1614673320124743681?s=12&t=joEpeVa5d58aHYNGA_To7Q",
+          "https://pbs.twimg.com/media/FtYbfsDXoAQ1Y8M?format=jpg&name=large",
+          "https://networkraptor.blogspot.com/2015/01/user-agent-strings.html",
+          "https://perishablepress.com/blacklist/ua-2013.txt",
+          "https://www.bluecoat.com/en-gb/security-blog/2015-05-05/know-your-agents",
+          "http://www.botopedia.org/search?searchword=scan&searchphrase=all",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/web/proxy_generic/proxy_ua_malware.yml"
         ],
         "tags": [
@@ -82383,8 +82803,8 @@
         "logsource.category": "proxy",
         "logsource.product": "No established product",
         "refs": [
-          "https://github.com/xmrig/xmrig/blob/427b6516e0550200c17ca28675118f0fffcc323f/src/version.h",
           "https://github.com/xmrig/xmrig/blob/da22b3e6c45825f3ac1f208255126cb8585cd4fc/src/base/kernel/Platform_win.cpp#L65",
+          "https://github.com/xmrig/xmrig/blob/427b6516e0550200c17ca28675118f0fffcc323f/src/version.h",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/web/proxy_generic/proxy_ua_cryptominer.yml"
         ],
         "tags": [
@@ -82417,8 +82837,8 @@
         "logsource.category": "proxy",
         "logsource.product": "No established product",
         "refs": [
-          "https://blogs.jpcert.or.jp/en/2022/07/yamabot.html",
           "https://deviceatlas.com/blog/list-of-user-agent-strings#desktop",
+          "https://blogs.jpcert.or.jp/en/2022/07/yamabot.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/web/proxy_generic/proxy_ua_susp_base64.yml"
         ],
         "tags": [
@@ -82520,9 +82940,9 @@
         "logsource.category": "proxy",
         "logsource.product": "No established product",
         "refs": [
+          "https://blog.talosintelligence.com/ipfs-abuse/",
           "https://github.com/Cisco-Talos/IOCs/tree/80caca039988252fbb3f27a2e89c2f2917f582e0/2022/11",
           "https://isc.sans.edu/diary/IPFS%20phishing%20and%20the%20need%20for%20correctly%20set%20HTTP%20security%20headers/29638",
-          "https://blog.talosintelligence.com/ipfs-abuse/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/web/proxy_generic/proxy_susp_ipfs_cred_harvest.yml"
         ],
         "tags": [
@@ -82605,9 +83025,9 @@
         "logsource.category": "proxy",
         "logsource.product": "No established product",
         "refs": [
+          "https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.util.html#module-f5.bigip.tm.util.bash",
           "https://community.f5.com/t5/technical-forum/icontrolrest-11-5-execute-bash-command/td-p/203029",
           "https://community.f5.com/t5/technical-forum/running-bash-commands-via-rest-api/td-p/272516",
-          "https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.util.html#module-f5.bigip.tm.util.bash",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/web/proxy_generic/proxy_f5_tm_utility_bash_api_request.yml"
         ],
         "tags": [
@@ -82877,8 +83297,8 @@
         "logsource.category": "proxy",
         "logsource.product": "No established product",
         "refs": [
-          "https://github.com/fastly/waf_testbed/blob/8bfc406551f3045e418cbaad7596cff8da331dfc/templates/default/scanners-user-agents.data.erb",
           "http://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-user_agents.rules",
+          "https://github.com/fastly/waf_testbed/blob/8bfc406551f3045e418cbaad7596cff8da331dfc/templates/default/scanners-user-agents.data.erb",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/web/proxy_generic/proxy_ua_hacktool.yml"
         ],
         "tags": [
@@ -83054,8 +83474,8 @@
         "logsource.product": "No established product",
         "refs": [
           "https://researchcenter.paloaltonetworks.com/2018/03/unit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users/",
-          "https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/",
           "https://blog.malwarebytes.com/threat-analysis/2016/11/telecrypt-the-ransomware-abusing-telegram-api-defeated/",
+          "https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/web/proxy_generic/proxy_telegram_api.yml"
         ],
         "tags": [
@@ -83097,8 +83517,8 @@
         "logsource.category": "No established category",
         "logsource.product": "No established product",
         "refs": [
-          "https://www.x41-dsec.de/lab/advisories/x41-2021-002-nginx-resolver-copy/",
           "https://docs.nginx.com/nginx/admin-guide/monitoring/debugging/#enabling-core-dumps",
+          "https://www.x41-dsec.de/lab/advisories/x41-2021-002-nginx-resolver-copy/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/web/product/nginx/web_nginx_core_dump.yml"
         ],
         "tags": [
@@ -83240,11 +83660,11 @@
         "logsource.category": "webserver",
         "logsource.product": "No established product",
         "refs": [
-          "https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/",
-          "https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/",
           "https://github.com/httpvoid/writeups/blob/62d3751945289d088ccfdf4d0ffbf61598a2cd7d/Confluence-RCE.md",
-          "https://medium.com/geekculture/text4shell-exploit-walkthrough-ebc02a01f035",
           "https://twitter.com/httpvoid0x2f/status/1532924261035384832",
+          "https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/",
+          "https://medium.com/geekculture/text4shell-exploit-walkthrough-ebc02a01f035",
+          "https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/web/webserver_generic/web_java_payload_in_access_logs.yml"
         ],
         "tags": [
@@ -83313,8 +83733,8 @@
         "logsource.category": "webserver",
         "logsource.product": "No established product",
         "refs": [
-          "https://web.archive.org/web/20231015205935/https://githubmemory.com/repo/FunctFan/JNDIExploit",
           "https://github.com/pimps/JNDI-Exploit-Kit",
+          "https://web.archive.org/web/20231015205935/https://githubmemory.com/repo/FunctFan/JNDIExploit",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/web/webserver_generic/web_jndi_exploit.yml"
         ],
         "tags": [
@@ -83383,8 +83803,8 @@
         "logsource.category": "webserver",
         "logsource.product": "No established product",
         "refs": [
-          "https://github.com/lanmaster53/recon-ng/blob/9e907dfe09fce2997f0301d746796408e01a60b7/recon/core/base.py#L92",
           "https://github.com/xmendez/wfuzz/blob/1b695ee9a87d66a7d7bf6cae70d60a33fae51541/docs/user/basicusage.rst",
+          "https://github.com/lanmaster53/recon-ng/blob/9e907dfe09fce2997f0301d746796408e01a60b7/recon/core/base.py#L92",
           "https://github.com/wpscanteam/wpscan/blob/196fbab5b1ce3870a43515153d4f07878a89d410/lib/wpscan/browser.rb",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/web/webserver_generic/web_susp_useragents.yml"
         ],
@@ -83453,9 +83873,9 @@
         "logsource.category": "webserver",
         "logsource.product": "No established product",
         "refs": [
+          "https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.util.html#module-f5.bigip.tm.util.bash",
           "https://community.f5.com/t5/technical-forum/icontrolrest-11-5-execute-bash-command/td-p/203029",
           "https://community.f5.com/t5/technical-forum/running-bash-commands-via-rest-api/td-p/272516",
-          "https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.util.html#module-f5.bigip.tm.util.bash",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/web/webserver_generic/web_f5_tm_utility_bash_api_request.yml"
         ],
         "tags": [
@@ -83489,8 +83909,8 @@
         "logsource.category": "webserver",
         "logsource.product": "No established product",
         "refs": [
-          "https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/",
           "https://bad-jubies.github.io/RCE-NOW-WHAT/",
+          "https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/web/webserver_generic/web_win_webshells_in_access_logs.yml"
         ],
         "tags": [
@@ -83525,11 +83945,11 @@
         "logsource.category": "webserver",
         "logsource.product": "No established product",
         "refs": [
-          "https://brightsec.com/blog/sql-injection-payloads/",
           "https://www.acunetix.com/blog/articles/exploiting-sql-injection-example/",
-          "https://book.hacktricks.xyz/pentesting-web/sql-injection/mysql-injection",
+          "https://brightsec.com/blog/sql-injection-payloads/",
           "https://www.acunetix.com/blog/articles/using-logs-to-investigate-a-web-application-attack/",
           "https://github.com/payloadbox/sql-injection-payload-list",
+          "https://book.hacktricks.xyz/pentesting-web/sql-injection/mysql-injection",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/web/webserver_generic/web_sql_injection_in_access_logs.yml"
         ],
         "tags": [
@@ -83631,8 +84051,8 @@
         "logsource.category": "webserver",
         "logsource.product": "No established product",
         "refs": [
-          "https://github.com/projectdiscovery/nuclei-templates/blob/9d2889356eebba661c8407038e430759dfd4ec31/fuzzing/iis-shortname.yaml",
           "https://github.com/lijiejie/IIS_shortname_Scanner",
+          "https://github.com/projectdiscovery/nuclei-templates/blob/9d2889356eebba661c8407038e430759dfd4ec31/fuzzing/iis-shortname.yaml",
           "https://www.exploit-db.com/exploits/19525",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/web/webserver_generic/web_iis_tilt_shortname_scan.yml"
         ],
@@ -83699,8 +84119,8 @@
         "logsource.category": "application",
         "logsource.product": "jvm",
         "refs": [
-          "https://secariolabs.com/research/analysing-and-reproducing-poc-for-log4j-2-15-0",
           "https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs",
+          "https://secariolabs.com/research/analysing-and-reproducing-poc-for-log4j-2-15-0",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/application/jvm/java_jndi_injection_exploitation_attempt.yml"
         ],
         "tags": [
@@ -83766,8 +84186,8 @@
         "logsource.category": "application",
         "logsource.product": "jvm",
         "refs": [
-          "https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing",
           "https://rules.sonarsource.com/java/RSPEC-2755",
+          "https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing",
           "https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/application/jvm/java_xxe_exploitation_attempt.yml"
         ],
@@ -83869,8 +84289,8 @@
         "logsource.category": "application",
         "logsource.product": "spring",
         "refs": [
-          "https://owasp.org/www-community/vulnerabilities/Expression_Language_Injection",
           "https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs",
+          "https://owasp.org/www-community/vulnerabilities/Expression_Language_Injection",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/application/spring/spring_spel_injection.yml"
         ],
         "tags": [
@@ -83936,10 +84356,10 @@
         "logsource.category": "application",
         "logsource.product": "ruby_on_rails",
         "refs": [
-          "https://stackoverflow.com/questions/25892194/does-rails-come-with-a-not-authorized-exception",
-          "http://edgeguides.rubyonrails.org/security.html",
-          "http://guides.rubyonrails.org/action_controller_overview.html",
           "https://github.com/rails/rails/blob/cd08e6bcc4cd8948fe01e0be1ea0c7ca60373a25/actionpack/lib/action_dispatch/middleware/exception_wrapper.rb",
+          "http://edgeguides.rubyonrails.org/security.html",
+          "https://stackoverflow.com/questions/25892194/does-rails-come-with-a-not-authorized-exception",
+          "http://guides.rubyonrails.org/action_controller_overview.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/application/ruby/appframework_ruby_on_rails_exceptions.yml"
         ],
         "tags": [
@@ -83973,8 +84393,8 @@
         "logsource.category": "application",
         "logsource.product": "velocity",
         "refs": [
-          "https://antgarsil.github.io/posts/velocity/",
           "https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs",
+          "https://antgarsil.github.io/posts/velocity/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/application/velocity/velocity_ssti_injection.yml"
         ],
         "tags": [
@@ -84861,8 +85281,8 @@
         "logsource.category": "No established category",
         "logsource.product": "kubernetes",
         "refs": [
-          "https://commandk.dev/blog/guide-to-audit-k8s-secrets-for-compliance/",
           "https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/",
+          "https://commandk.dev/blog/guide-to-audit-k8s-secrets-for-compliance/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/application/kubernetes/audit/kubernetes_audit_secrets_modified_or_deleted.yml"
         ],
         "tags": [
@@ -84918,8 +85338,8 @@
         "logsource.category": "No established category",
         "logsource.product": "kubernetes",
         "refs": [
-          "https://medium.com/@seifeddinerajhi/kubernetes-rbac-privilege-escalation-exploits-and-mitigations-26c07629eeab",
           "https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/",
+          "https://medium.com/@seifeddinerajhi/kubernetes-rbac-privilege-escalation-exploits-and-mitigations-26c07629eeab",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/application/kubernetes/audit/kubernetes_audit_rolebinding_modification.yml"
         ],
         "tags": [
@@ -84975,8 +85395,8 @@
         "logsource.category": "No established category",
         "logsource.product": "kubernetes",
         "refs": [
-          "https://security.padok.fr/en/blog/kubernetes-webhook-attackers",
           "https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/",
+          "https://security.padok.fr/en/blog/kubernetes-webhook-attackers",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/application/kubernetes/audit/kubernetes_audit_change_admission_controller.yml"
         ],
         "tags": [
@@ -85026,8 +85446,8 @@
         "logsource.category": "No established category",
         "logsource.product": "kubernetes",
         "refs": [
-          "https://www.datadoghq.com/blog/monitor-kubernetes-audit-logs/#monitor-api-authentication-issues",
           "https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/",
+          "https://www.datadoghq.com/blog/monitor-kubernetes-audit-logs/#monitor-api-authentication-issues",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/application/kubernetes/audit/kubernetes_audit_unauthorized_unauthenticated_actions.yml"
         ],
         "tags": [
@@ -85051,8 +85471,8 @@
         "logsource.category": "No established category",
         "logsource.product": "kubernetes",
         "refs": [
-          "https://www.redhat.com/en/blog/protecting-kubernetes-against-mitre-attck-persistence#technique-33-kubernetes-cronjob",
           "https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/",
+          "https://www.redhat.com/en/blog/protecting-kubernetes-against-mitre-attck-persistence#technique-33-kubernetes-cronjob",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/application/kubernetes/audit/kubernetes_audit_cronjob_modification.yml"
         ],
         "tags": [
@@ -85149,8 +85569,8 @@
         "logsource.category": "application",
         "logsource.product": "kubernetes",
         "refs": [
-          "https://blog.appsecco.com/kubernetes-namespace-breakout-using-insecure-host-path-volume-part-1-b382f2a6e216",
           "https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Writable%20hostPath%20mount/",
+          "https://blog.appsecco.com/kubernetes-namespace-breakout-using-insecure-host-path-volume-part-1-b382f2a6e216",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/application/kubernetes/audit/kubernetes_audit_hostpath_mount.yml"
         ],
         "tags": [
@@ -85214,10 +85634,10 @@
         "logsource.category": "application",
         "logsource.product": "kubernetes",
         "refs": [
-          "https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Privileged%20container/",
           "https://www.elastic.co/guide/en/security/current/kubernetes-container-created-with-excessive-linux-capabilities.html",
           "https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-kubernetes.html#privilegeescalation-kubernetes-privilegedcontainer",
           "https://www.elastic.co/guide/en/security/current/kubernetes-pod-created-with-hostnetwork.html",
+          "https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Privileged%20container/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/application/kubernetes/audit/kubernetes_audit_privileged_pod_creation.yml"
         ],
         "tags": [
@@ -85281,8 +85701,8 @@
         "logsource.category": "application",
         "logsource.product": "kubernetes",
         "refs": [
-          "https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Sidecar%20Injection/",
           "https://kubernetes.io/docs/tasks/manage-kubernetes-objects/update-api-object-kubectl-patch",
+          "https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Sidecar%20Injection/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/application/kubernetes/audit/kubernetes_audit_sidecar_injection.yml"
         ],
         "tags": [
@@ -85338,10 +85758,10 @@
         "logsource.category": "application",
         "logsource.product": "rpc_firewall",
         "refs": [
-          "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931",
           "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/",
-          "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md",
           "https://github.com/zeronetworks/rpcfirewall",
+          "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md",
+          "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/application/rpc_firewall/rpc_firewall_sasec_recon.yml"
         ],
         "tags": [
@@ -85364,10 +85784,10 @@
         "logsource.category": "application",
         "logsource.product": "rpc_firewall",
         "refs": [
+          "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36942",
+          "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-EFSR.md",
           "https://github.com/zeronetworks/rpcfirewall",
           "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/",
-          "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-EFSR.md",
-          "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36942",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/application/rpc_firewall/rpc_firewall_efs_abuse.yml"
         ],
         "tags": [
@@ -85433,10 +85853,10 @@
         "logsource.category": "application",
         "logsource.product": "rpc_firewall",
         "refs": [
-          "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931",
           "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/",
-          "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md",
           "https://github.com/zeronetworks/rpcfirewall",
+          "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md",
+          "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/application/rpc_firewall/rpc_firewall_atsvc_lateral_movement.yml"
         ],
         "tags": [
@@ -85477,10 +85897,10 @@
         "logsource.category": "application",
         "logsource.product": "rpc_firewall",
         "refs": [
-          "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931",
           "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/",
-          "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md",
           "https://github.com/zeronetworks/rpcfirewall",
+          "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md",
+          "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/application/rpc_firewall/rpc_firewall_itaskschedulerservice_lateral_movement.yml"
         ],
         "tags": [
@@ -85521,9 +85941,9 @@
         "logsource.category": "application",
         "logsource.product": "rpc_firewall",
         "refs": [
-          "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/",
           "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-wkst/55118c55-2122-4ef9-8664-0c1ff9e168f3",
           "https://github.com/zeronetworks/rpcfirewall",
+          "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/",
           "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-WKST.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/application/rpc_firewall/rpc_firewall_sharphound_recon_account.yml"
         ],
@@ -85557,12 +85977,12 @@
         "logsource.category": "application",
         "logsource.product": "rpc_firewall",
         "refs": [
-          "https://github.com/zeronetworks/rpcfirewall",
-          "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/",
-          "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pan/e44d984c-07d3-414c-8ffc-f8c8ad8512a8",
-          "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/d42db7d5-f141-4466-8f47-0a4be14e2fc1",
           "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-RPRN-PAR.md",
+          "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/d42db7d5-f141-4466-8f47-0a4be14e2fc1",
+          "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/",
+          "https://github.com/zeronetworks/rpcfirewall",
           "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527",
+          "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pan/e44d984c-07d3-414c-8ffc-f8c8ad8512a8",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/application/rpc_firewall/rpc_firewall_printing_lateral_movement.yml"
         ],
         "tags": [
@@ -85585,10 +86005,10 @@
         "logsource.category": "application",
         "logsource.product": "rpc_firewall",
         "refs": [
-          "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931",
           "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/",
-          "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md",
           "https://github.com/zeronetworks/rpcfirewall",
+          "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md",
+          "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/application/rpc_firewall/rpc_firewall_sasec_lateral_movement.yml"
         ],
         "tags": [
@@ -85630,8 +86050,8 @@
         "logsource.product": "rpc_firewall",
         "refs": [
           "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/accf23b0-0f57-441c-9185-43041f1b0ee9",
-          "https://github.com/zeronetworks/rpcfirewall",
           "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/",
+          "https://github.com/zeronetworks/rpcfirewall",
           "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-SCMR.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/application/rpc_firewall/rpc_firewall_remote_service_lateral_movement.yml"
         ],
@@ -85665,9 +86085,9 @@
         "logsource.category": "application",
         "logsource.product": "rpc_firewall",
         "refs": [
-          "https://github.com/zeronetworks/rpcfirewall",
-          "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/",
           "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-drsr/f977faaa-673e-4f66-b9bf-48c640241d47?redirectedfrom=MSDN",
+          "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/",
+          "https://github.com/zeronetworks/rpcfirewall",
           "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-DRSR.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/application/rpc_firewall/rpc_firewall_dcsync_attack.yml"
         ],
@@ -85701,10 +86121,10 @@
         "logsource.category": "application",
         "logsource.product": "rpc_firewall",
         "refs": [
-          "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931",
           "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/",
-          "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md",
           "https://github.com/zeronetworks/rpcfirewall",
+          "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md",
+          "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/application/rpc_firewall/rpc_firewall_itaskschedulerservice_recon.yml"
         ],
         "tags": [
@@ -85727,10 +86147,10 @@
         "logsource.category": "application",
         "logsource.product": "rpc_firewall",
         "refs": [
-          "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-RRP.md",
-          "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/",
-          "https://github.com/zeronetworks/rpcfirewall",
           "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/0fa3191d-bb79-490a-81bd-54c2601b7a78",
+          "https://github.com/zeronetworks/rpcfirewall",
+          "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/",
+          "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-RRP.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/application/rpc_firewall/rpc_firewall_remote_registry_lateral_movement.yml"
         ],
         "tags": [
@@ -85763,10 +86183,10 @@
         "logsource.category": "application",
         "logsource.product": "rpc_firewall",
         "refs": [
-          "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931",
           "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/",
-          "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md",
           "https://github.com/zeronetworks/rpcfirewall",
+          "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md",
+          "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/application/rpc_firewall/rpc_firewall_atsvc_recon.yml"
         ],
         "tags": [
@@ -85789,10 +86209,10 @@
         "logsource.category": "application",
         "logsource.product": "rpc_firewall",
         "refs": [
-          "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-RRP.md",
-          "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/",
-          "https://github.com/zeronetworks/rpcfirewall",
           "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/0fa3191d-bb79-490a-81bd-54c2601b7a78",
+          "https://github.com/zeronetworks/rpcfirewall",
+          "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/",
+          "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-RRP.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/application/rpc_firewall/rpc_firewall_remote_registry_recon.yml"
         ],
         "tags": [
@@ -85816,9 +86236,9 @@
         "logsource.product": "rpc_firewall",
         "refs": [
           "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/accf23b0-0f57-441c-9185-43041f1b0ee9",
-          "https://github.com/zeronetworks/rpcfirewall",
           "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/",
           "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-SRVS.md",
+          "https://github.com/zeronetworks/rpcfirewall",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/application/rpc_firewall/rpc_firewall_remote_server_service_abuse.yml"
         ],
         "tags": [
@@ -85841,10 +86261,10 @@
         "logsource.category": "application",
         "logsource.product": "rpc_firewall",
         "refs": [
-          "https://github.com/zeronetworks/rpcfirewall",
+          "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-SRVS.md",
           "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/",
           "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/02b1f559-fda2-4ba3-94c2-806eb2777183",
-          "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-SRVS.md",
+          "https://github.com/zeronetworks/rpcfirewall",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/application/rpc_firewall/rpc_firewall_sharphound_recon_sessions.yml"
         ],
         "tags": [
@@ -85946,8 +86366,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "macos",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/1fed40dc7e48f16ed44dcdd9c73b9222a70cca85/atomics/T1553.001/T1553.001.md",
           "https://www.loobins.io/binaries/xattr/",
+          "https://github.com/redcanaryco/atomic-red-team/blob/1fed40dc7e48f16ed44dcdd9c73b9222a70cca85/atomics/T1553.001/T1553.001.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_xattr_gatekeeper_bypass.yml"
         ],
         "tags": [
@@ -85980,10 +86400,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "macos",
         "refs": [
-          "https://www.virustotal.com/gui/file/05a2adb266ec6c0ba9ed176d87d8530e71e845348c13caf9f60049760c312cd3/behavior",
-          "https://objective-see.org/blog/blog_0x6D.html",
           "https://ss64.com/osx/csrutil.html",
           "https://www.welivesecurity.com/2017/10/20/osx-proton-supply-chain-attack-elmedia/",
+          "https://www.virustotal.com/gui/file/05a2adb266ec6c0ba9ed176d87d8530e71e845348c13caf9f60049760c312cd3/behavior",
+          "https://objective-see.org/blog/blog_0x6D.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_csrutil_disable.yml"
         ],
         "tags": [
@@ -86158,8 +86578,8 @@
         "logsource.product": "macos",
         "refs": [
           "https://www.virustotal.com/gui/file/0373d78db6c3c0f6f6dcc409821bf89e1ad8c165d6f95c5c80ecdce2219627d7/behavior",
-          "https://www.virustotal.com/gui/file/4ffdc72d1ff1ee8228e31691020fc275afd1baee5a985403a71ca8c7bd36e2e4/behavior",
           "https://www.trendmicro.com/en_ph/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html",
+          "https://www.virustotal.com/gui/file/4ffdc72d1ff1ee8228e31691020fc275afd1baee5a985403a71ca8c7bd36e2e4/behavior",
           "https://www.virustotal.com/gui/file/5907d59ec1303cfb5c0a0f4aaca3efc0830707d86c732ba6b9e842b5730b95dc/behavior",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_ioreg_discovery.yml"
         ],
@@ -86193,9 +86613,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "macos",
         "refs": [
+          "https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-c68a1fcbf7a3f80c87225d7fdc031f691e9f3b6a14a36754be00762bfe6eae97",
           "https://malpedia.caad.fkie.fraunhofer.de/details/osx.xcsset",
           "https://www.microsoft.com/security/blog/2022/02/02/the-evolution-of-a-mac-trojan-updateagents-progression/",
-          "https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-c68a1fcbf7a3f80c87225d7fdc031f691e9f3b6a14a36754be00762bfe6eae97",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_wizardupdate_malware_infection.yml"
         ],
         "tags": [
@@ -86252,8 +86672,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "macos",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine",
           "https://www.loobins.io/binaries/tmutil/",
+          "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_tmutil_disable_backup.yml"
         ],
         "tags": [
@@ -86286,9 +86706,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "macos",
         "refs": [
-          "https://github.com/MythicAgents/typhon/",
-          "https://www.zoocoup.org/casper/jamf_cheatsheet.pdf",
           "https://docs.jamf.com/10.30.0/jamf-pro/administrator-guide/Components_Installed_on_Managed_Computers.html",
+          "https://www.zoocoup.org/casper/jamf_cheatsheet.pdf",
+          "https://github.com/MythicAgents/typhon/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_jamf_usage.yml"
         ],
         "tags": [
@@ -86348,9 +86768,9 @@
         "refs": [
           "https://www.welivesecurity.com/2020/07/16/mac-cryptocurrency-trading-application-rebranded-bundled-malware/",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1569.001/T1569.001.md",
-          "https://www.trendmicro.com/en_us/research/18/d/new-macos-backdoor-linked-to-oceanlotus-found.html",
           "https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/",
           "https://www.loobins.io/binaries/launchctl/",
+          "https://www.trendmicro.com/en_us/research/18/d/new-macos-backdoor-linked-to-oceanlotus-found.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_launchctl_execution.yml"
         ],
         "tags": [
@@ -86400,9 +86820,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "macos",
         "refs": [
+          "https://www.sentinelone.com/blog/from-the-front-linesunsigned-macos-orat-malware-gambles-for-the-win/",
           "https://ss64.com/mac/hdiutil.html",
           "https://www.loobins.io/binaries/hdiutil/",
-          "https://www.sentinelone.com/blog/from-the-front-linesunsigned-macos-orat-malware-gambles-for-the-win/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_hdiutil_create.yml"
         ],
         "tags": [
@@ -86494,9 +86914,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "macos",
         "refs": [
+          "https://www.virustotal.com/gui/file/d3fa64f63563fe958b75238742d1e473800cb5f49f5cb79d38d4aa3c93709026/behavior",
           "https://ss64.com/osx/sw_vers.html",
           "https://www.virustotal.com/gui/file/03b71eaceadea05bc0eea5cddecaa05f245126d6b16cfcd0f3ba0442ac58dab3/behavior",
-          "https://www.virustotal.com/gui/file/d3fa64f63563fe958b75238742d1e473800cb5f49f5cb79d38d4aa3c93709026/behavior",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_swvers_discovery.yml"
         ],
         "tags": [
@@ -86529,9 +86949,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "macos",
         "refs": [
-          "https://github.com/MythicAgents/typhon/",
-          "https://www.zoocoup.org/casper/jamf_cheatsheet.pdf",
           "https://docs.jamf.com/10.30.0/jamf-pro/administrator-guide/Components_Installed_on_Managed_Computers.html",
+          "https://www.zoocoup.org/casper/jamf_cheatsheet.pdf",
+          "https://github.com/MythicAgents/typhon/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_jamf_susp_child.yml"
         ],
         "tags": [
@@ -86554,8 +86974,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "macos",
         "refs": [
-          "https://ss64.com/osx/dscl.html",
           "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.003/T1078.003.md#atomic-test-2---create-local-account-with-admin-privileges---macos",
+          "https://ss64.com/osx/dscl.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_dscl_add_user_to_admin_group.yml"
         ],
         "tags": [
@@ -86589,9 +87009,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "macos",
         "refs": [
-          "https://ss64.com/osx/dsenableroot.html",
-          "https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/persistence_enable_root_account.toml",
           "https://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1078.003/T1078.003.md",
+          "https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/persistence_enable_root_account.toml",
+          "https://ss64.com/osx/dsenableroot.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_dsenableroot_enable_root_account.yml"
         ],
         "tags": [
@@ -86707,9 +87127,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "macos",
         "refs": [
-          "https://support.apple.com/guide/security/firmware-password-protection-sec28382c9ca/web",
           "https://github.com/usnistgov/macos_security/blob/932a51f3e819dd3e02ebfcf3ef433cfffafbe28b/rules/os/os_firmware_password_require.yaml",
           "https://www.manpagez.com/man/8/firmwarepasswd/",
+          "https://support.apple.com/guide/security/firmware-password-protection-sec28382c9ca/web",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_susp_macos_firmware_activity.yml"
         ],
         "tags": [
@@ -86732,9 +87152,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "macos",
         "refs": [
+          "https://www.sentinelone.com/blog/from-the-front-linesunsigned-macos-orat-malware-gambles-for-the-win/",
           "https://ss64.com/mac/hdiutil.html",
           "https://www.loobins.io/binaries/hdiutil/",
-          "https://www.sentinelone.com/blog/from-the-front-linesunsigned-macos-orat-malware-gambles-for-the-win/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_hdiutil_mount.yml"
         ],
         "tags": [
@@ -86862,6 +87282,39 @@
       "uuid": "88c0f9d8-30a8-4120-bb6b-ebb54abcf2a0",
       "value": "File Time Attribute Change"
     },
+    {
+      "description": "Detects enumeration of local network configuration",
+      "meta": {
+        "author": "remotephone, oscd.community",
+        "creation_date": "2020-10-06",
+        "falsepositive": [
+          "Legitimate administration activities"
+        ],
+        "filename": "proc_creation_macos_susp_system_network_discovery.yml",
+        "level": "informational",
+        "logsource.category": "process_creation",
+        "logsource.product": "macos",
+        "refs": [
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md",
+          "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_susp_system_network_discovery.yml"
+        ],
+        "tags": [
+          "attack.discovery",
+          "attack.t1016"
+        ]
+      },
+      "related": [
+        {
+          "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "related-to"
+        }
+      ],
+      "uuid": "58800443-f9fc-4d55-ae0c-98a3966dfb97",
+      "value": "System Network Discovery - macOS"
+    },
     {
       "description": "Detects the execution of \"sysctl\" with specific arguments that have been used by threat actors and malware. It provides system hardware information.\nThis process is primarily used to detect and avoid virtualization and analysis environments.\n",
       "meta": {
@@ -86875,13 +87328,13 @@
         "logsource.category": "process_creation",
         "logsource.product": "macos",
         "refs": [
+          "https://objective-see.org/blog/blog_0x1E.html",
+          "https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/",
+          "https://www.virustotal.com/gui/file/b4b1fc65f87b3dcfa35e2dbe8e0a34ad9d8a400bec332025c0a2e200671038aa/behavior",
+          "https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/",
           "https://www.virustotal.com/gui/file/1c547a064494a35d6b5e6b459de183ab2720a22725e082bed6f6629211f7abc1/behavior",
           "https://www.loobins.io/binaries/sysctl/#",
           "https://evasions.checkpoint.com/techniques/macos.html",
-          "https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/",
-          "https://objective-see.org/blog/blog_0x1E.html",
-          "https://www.virustotal.com/gui/file/b4b1fc65f87b3dcfa35e2dbe8e0a34ad9d8a400bec332025c0a2e200671038aa/behavior",
-          "https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_sysctl_discovery.yml"
         ],
         "tags": [
@@ -87059,8 +87512,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "macos",
         "refs": [
-          "https://redcanary.com/blog/applescript/",
           "https://objective-see.org/blog/blog_0x4B.html",
+          "https://redcanary.com/blog/applescript/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_office_susp_child_processes.yml"
         ],
         "tags": [
@@ -87184,8 +87637,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "macos",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.002/T1059.002.md",
           "https://redcanary.com/blog/applescript/",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.002/T1059.002.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_applescript.yml"
         ],
         "tags": [
@@ -87251,10 +87704,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "macos",
         "refs": [
-          "https://www.virustotal.com/gui/file/05a2adb266ec6c0ba9ed176d87d8530e71e845348c13caf9f60049760c312cd3/behavior",
-          "https://objective-see.org/blog/blog_0x6D.html",
           "https://ss64.com/osx/csrutil.html",
           "https://www.welivesecurity.com/2017/10/20/osx-proton-supply-chain-attack-elmedia/",
+          "https://www.virustotal.com/gui/file/05a2adb266ec6c0ba9ed176d87d8530e71e845348c13caf9f60049760c312cd3/behavior",
+          "https://objective-see.org/blog/blog_0x6D.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_csrutil_status.yml"
         ],
         "tags": [
@@ -87320,8 +87773,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "macos",
         "refs": [
-          "https://wojciechregula.blog/post/macos-red-teaming-initial-access-via-applescript-url/",
           "https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-7f541fbc4a4a28a92970e8bf53effea5bd934604429112c920affb457f5b2685",
+          "https://wojciechregula.blog/post/macos-red-teaming-initial-access-via-applescript-url/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_susp_execution_macos_script_editor.yml"
         ],
         "tags": [
@@ -87457,8 +87910,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "macos",
         "refs": [
-          "https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/execution_installer_package_spawned_network_event.toml",
           "https://redcanary.com/blog/clipping-silver-sparrows-wings/",
+          "https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/execution_installer_package_spawned_network_event.toml",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_installer_susp_child_process.yml"
         ],
         "tags": [
@@ -87537,39 +87990,6 @@
       "uuid": "09a910bf-f71f-4737-9c40-88880ba5913d",
       "value": "Potential Base64 Decoded From Images"
     },
-    {
-      "description": "Detects enumeration of local network configuration",
-      "meta": {
-        "author": "remotephone, oscd.community",
-        "creation_date": "2020-10-06",
-        "falsepositive": [
-          "Legitimate administration activities"
-        ],
-        "filename": "proc_creation_macos_system_network_discovery.yml",
-        "level": "informational",
-        "logsource.category": "process_creation",
-        "logsource.product": "macos",
-        "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md",
-          "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_system_network_discovery.yml"
-        ],
-        "tags": [
-          "attack.discovery",
-          "attack.t1016"
-        ]
-      },
-      "related": [
-        {
-          "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
-          "tags": [
-            "estimative-language:likelihood-probability=\"almost-certain\""
-          ],
-          "type": "related-to"
-        }
-      ],
-      "uuid": "58800443-f9fc-4d55-ae0c-98a3966dfb97",
-      "value": "System Network Discovery - macOS"
-    },
     {
       "description": "Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware",
       "meta": {
@@ -87625,8 +88045,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "macos",
         "refs": [
-          "https://malpedia.caad.fkie.fraunhofer.de/details/osx.xcsset",
           "https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-f5deb07688e1a8dec9530bc3071967b2da5c16b482e671812b864c37beb28f08",
+          "https://malpedia.caad.fkie.fraunhofer.de/details/osx.xcsset",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_xcsset_malware_infection.yml"
         ],
         "tags": [
@@ -87733,9 +88153,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "macos",
         "refs": [
-          "https://www.loobins.io/binaries/nscurl/",
           "https://gist.github.com/nasbench/ca6ef95db04ae04ffd1e0b1ce709cadd",
           "https://www.agnosticdev.com/content/how-diagnose-app-transport-security-issues-using-nscurl-and-openssl",
+          "https://www.loobins.io/binaries/nscurl/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_nscurl_usage.yml"
         ],
         "tags": [
@@ -87903,12 +88323,12 @@
         "logsource.category": "process_creation",
         "logsource.product": "macos",
         "refs": [
-          "https://www.trendmicro.com/en_za/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html",
-          "https://gist.github.com/nasbench/9a1ba4bc7094ea1b47bc42bf172961af",
-          "https://objective-see.org/blog/blog_0x62.html",
           "https://www.sentinelone.com/wp-content/uploads/pdf-gen/1630910064/20-common-tools-techniques-used-by-macos-threat-actors-malware.pdf",
           "https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/",
           "https://ss64.com/mac/system_profiler.html",
+          "https://gist.github.com/nasbench/9a1ba4bc7094ea1b47bc42bf172961af",
+          "https://www.trendmicro.com/en_za/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html",
+          "https://objective-see.org/blog/blog_0x62.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_system_profiler_discovery.yml"
         ],
         "tags": [
@@ -87970,6 +88390,66 @@
       "uuid": "9a7a0393-2144-4626-9bf1-7c2f5a7321db",
       "value": "System Network Connections Discovery - MacOs"
     },
+    {
+      "description": "Detects the execution of the \"chflags\" utility with the \"hidden\" flag, in order to hide files on MacOS.\nWhen a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.\n",
+      "meta": {
+        "author": "Omar Khaled (@beacon_exe)",
+        "creation_date": "2024-08-21",
+        "falsepositive": [
+          "Legitimate usage of chflags by administrators and users."
+        ],
+        "filename": "proc_creation_macos_chflags_hidden_flag.yml",
+        "level": "medium",
+        "logsource.category": "process_creation",
+        "logsource.product": "macos",
+        "refs": [
+          "https://ss64.com/mac/chflags.html",
+          "https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/",
+          "https://www.sentinelone.com/labs/apt32-multi-stage-macos-trojan-innovates-on-crimeware-scripting-technique/",
+          "https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf",
+          "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_chflags_hidden_flag.yml"
+        ],
+        "tags": [
+          "attack.defense-evasion",
+          "attack.t1218",
+          "attack.t1564.004",
+          "attack.t1552.001",
+          "attack.t1105"
+        ]
+      },
+      "related": [
+        {
+          "dest-uuid": "457c7820-d331-465a-915e-42f85500ccc4",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "related-to"
+        },
+        {
+          "dest-uuid": "f2857333-11d4-45bf-b064-2c28d8525be5",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "related-to"
+        },
+        {
+          "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "related-to"
+        },
+        {
+          "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "related-to"
+        }
+      ],
+      "uuid": "3b2c1059-ae5f-40b6-b5d4-6106d3ac20fe",
+      "value": "Hidden Flag Set On File/Directory Via Chflags - MacOS"
+    },
     {
       "description": "Detects deletion of local audit logs",
       "meta": {
@@ -88016,8 +88496,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "macos",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine",
           "https://www.loobins.io/binaries/tmutil/",
+          "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_tmutil_delete_backup.yml"
         ],
         "tags": [
@@ -88225,8 +88705,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "macos",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine",
           "https://www.loobins.io/binaries/tmutil/",
+          "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_tmutil_exclude_file_from_backup.yml"
         ],
         "tags": [
@@ -88259,8 +88739,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "macos",
         "refs": [
-          "https://www.manpagez.com/man/8/PlistBuddy/",
           "https://redcanary.com/blog/clipping-silver-sparrows-wings/",
+          "https://www.manpagez.com/man/8/PlistBuddy/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_persistence_via_plistbuddy.yml"
         ],
         "tags": [
@@ -88489,10 +88969,10 @@
         "logsource.category": "No established category",
         "logsource.product": "github",
         "refs": [
-          "https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
+          "https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise",
           "https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#dependabot_alerts-category-actions",
           "https://docs.github.com/en/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization",
-          "https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise",
+          "https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/github/github_disable_high_risk_configuration.yml"
         ],
         "tags": [
@@ -88560,10 +89040,10 @@
         "logsource.category": "No established category",
         "logsource.product": "github",
         "refs": [
-          "https://docs.github.com/en/repositories/creating-and-managing-repositories/transferring-a-repository",
           "https://docs.github.com/en/organizations/managing-organization-settings/transferring-organization-ownership",
-          "https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#migration",
           "https://docs.github.com/en/migrations",
+          "https://docs.github.com/en/repositories/creating-and-managing-repositories/transferring-a-repository",
+          "https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#migration",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/github/github_repo_or_org_transferred.yml"
         ],
         "tags": [
@@ -88744,8 +89224,8 @@
         "logsource.category": "No established category",
         "logsource.product": "github",
         "refs": [
-          "https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#audit-log-actions",
           "https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
+          "https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#audit-log-actions",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/github/github_outside_collaborator_detected.yml"
         ],
         "tags": [
@@ -88797,8 +89277,8 @@
         "logsource.category": "No established category",
         "logsource.product": "github",
         "refs": [
-          "https://docs.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners#about-self-hosted-runners",
           "https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#search-based-on-operation",
+          "https://docs.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners#about-self-hosted-runners",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/github/github_self_hosted_runner_changes_detected.yml"
         ],
         "tags": [
@@ -88853,8 +89333,8 @@
         "logsource.category": "No established category",
         "logsource.product": "okta",
         "refs": [
-          "https://developer.okta.com/docs/reference/api/system-log/",
           "https://developer.okta.com/docs/reference/api/event-types/",
+          "https://developer.okta.com/docs/reference/api/system-log/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/okta/okta_policy_rule_modified_or_deleted.yml"
         ],
         "tags": [
@@ -88877,8 +89357,8 @@
         "logsource.category": "No established category",
         "logsource.product": "okta",
         "refs": [
-          "https://developer.okta.com/docs/reference/api/system-log/",
           "https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection",
+          "https://developer.okta.com/docs/reference/api/system-log/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/okta/okta_identity_provider_created.yml"
         ],
         "tags": [
@@ -88911,8 +89391,8 @@
         "logsource.category": "No established category",
         "logsource.product": "okta",
         "refs": [
-          "https://developer.okta.com/docs/reference/api/system-log/",
           "https://developer.okta.com/docs/reference/api/event-types/",
+          "https://developer.okta.com/docs/reference/api/system-log/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/okta/okta_admin_role_assigned_to_user_or_group.yml"
         ],
         "tags": [
@@ -88945,8 +89425,8 @@
         "logsource.category": "No established category",
         "logsource.product": "okta",
         "refs": [
-          "https://dataconomy.com/2023/10/23/okta-data-breach/",
           "https://blog.cloudflare.com/how-cloudflare-mitigated-yet-another-okta-compromise/",
+          "https://dataconomy.com/2023/10/23/okta-data-breach/",
           "https://www.beyondtrust.com/blog/entry/okta-support-unit-breach",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/okta/okta_admin_activity_from_proxy_query.yml"
         ],
@@ -88993,9 +89473,9 @@
         "logsource.category": "No established category",
         "logsource.product": "okta",
         "refs": [
-          "https://developer.okta.com/docs/reference/api/system-log/",
           "https://www.mitiga.io/blog/how-okta-passwords-can-be-compromised-uncovering-a-risk-to-user-data",
           "https://help.okta.com/en-us/Content/Topics/users-groups-profiles/usgp-create-character-restriction.htm",
+          "https://developer.okta.com/docs/reference/api/system-log/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/okta/okta_password_in_alternateid_field.yml"
         ],
         "tags": [
@@ -89028,8 +89508,8 @@
         "logsource.category": "No established category",
         "logsource.product": "okta",
         "refs": [
-          "https://developer.okta.com/docs/reference/api/system-log/",
           "https://developer.okta.com/docs/reference/api/event-types/",
+          "https://developer.okta.com/docs/reference/api/system-log/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/okta/okta_application_modified_or_deleted.yml"
         ],
         "tags": [
@@ -89052,8 +89532,8 @@
         "logsource.category": "No established category",
         "logsource.product": "okta",
         "refs": [
-          "https://developer.okta.com/docs/reference/api/system-log/",
           "https://developer.okta.com/docs/reference/api/event-types/",
+          "https://developer.okta.com/docs/reference/api/system-log/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/okta/okta_api_token_revoked.yml"
         ],
         "tags": [
@@ -89076,8 +89556,8 @@
         "logsource.category": "No established category",
         "logsource.product": "okta",
         "refs": [
-          "https://developer.okta.com/docs/reference/api/system-log/",
           "https://github.com/okta/workflows-templates/blob/master/workflows/suspicious_activity_reported/readme.md",
+          "https://developer.okta.com/docs/reference/api/system-log/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/okta/okta_suspicious_activity_enduser_report.yml"
         ],
         "tags": [
@@ -89110,9 +89590,9 @@
         "logsource.category": "No established category",
         "logsource.product": "okta",
         "refs": [
-          "https://developer.okta.com/docs/reference/api/system-log/",
           "https://okta.github.io/okta-help/en/prod/Content/Topics/Security/threat-insight/configure-threatinsight-system-log.htm",
           "https://developer.okta.com/docs/reference/api/event-types/",
+          "https://developer.okta.com/docs/reference/api/system-log/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/okta/okta_security_threat_detected.yml"
         ],
         "tags": [
@@ -89135,8 +89615,8 @@
         "logsource.category": "No established category",
         "logsource.product": "okta",
         "refs": [
-          "https://developer.okta.com/docs/reference/api/system-log/",
           "https://developer.okta.com/docs/reference/api/event-types/",
+          "https://developer.okta.com/docs/reference/api/system-log/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/okta/okta_application_sign_on_policy_modified_or_deleted.yml"
         ],
         "tags": [
@@ -89159,8 +89639,8 @@
         "logsource.category": "No established category",
         "logsource.product": "okta",
         "refs": [
-          "https://developer.okta.com/docs/reference/api/system-log/",
           "https://developer.okta.com/docs/reference/api/event-types/",
+          "https://developer.okta.com/docs/reference/api/system-log/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/okta/okta_api_token_created.yml"
         ],
         "tags": [
@@ -89183,8 +89663,8 @@
         "logsource.category": "No established category",
         "logsource.product": "okta",
         "refs": [
-          "https://developer.okta.com/docs/reference/api/system-log/",
           "https://developer.okta.com/docs/reference/api/event-types/",
+          "https://developer.okta.com/docs/reference/api/system-log/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/okta/okta_user_account_locked_out.yml"
         ],
         "tags": [
@@ -89217,8 +89697,8 @@
         "logsource.category": "No established category",
         "logsource.product": "okta",
         "refs": [
-          "https://developer.okta.com/docs/reference/api/system-log/",
           "https://developer.okta.com/docs/reference/api/event-types/",
+          "https://developer.okta.com/docs/reference/api/system-log/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/okta/okta_network_zone_deactivated_or_deleted.yml"
         ],
         "tags": [
@@ -89241,8 +89721,8 @@
         "logsource.category": "No established category",
         "logsource.product": "okta",
         "refs": [
-          "https://developer.okta.com/docs/reference/api/system-log/",
           "https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection",
+          "https://developer.okta.com/docs/reference/api/system-log/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/okta/okta_new_behaviours_admin_console.yml"
         ],
         "tags": [
@@ -89275,9 +89755,9 @@
         "logsource.category": "No established category",
         "logsource.product": "okta",
         "refs": [
-          "https://developer.okta.com/docs/reference/api/system-log/",
-          "https://developer.okta.com/docs/reference/api/event-types/",
           "https://sec.okta.com/fastpassphishingdetection",
+          "https://developer.okta.com/docs/reference/api/event-types/",
+          "https://developer.okta.com/docs/reference/api/system-log/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/okta/okta_fastpass_phishing_detection.yml"
         ],
         "tags": [
@@ -89310,8 +89790,8 @@
         "logsource.category": "No established category",
         "logsource.product": "okta",
         "refs": [
-          "https://developer.okta.com/docs/reference/api/system-log/",
           "https://developer.okta.com/docs/reference/api/event-types/",
+          "https://developer.okta.com/docs/reference/api/system-log/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/okta/okta_admin_role_assignment_created.yml"
         ],
         "tags": [
@@ -89334,8 +89814,8 @@
         "logsource.category": "No established category",
         "logsource.product": "okta",
         "refs": [
-          "https://developer.okta.com/docs/reference/api/system-log/",
           "https://developer.okta.com/docs/reference/api/event-types/",
+          "https://developer.okta.com/docs/reference/api/system-log/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/okta/okta_unauthorized_access_to_app.yml"
         ],
         "tags": [
@@ -89360,8 +89840,8 @@
         "logsource.category": "No established category",
         "logsource.product": "okta",
         "refs": [
-          "https://developer.okta.com/docs/reference/api/system-log/",
           "https://developer.okta.com/docs/reference/api/event-types/",
+          "https://developer.okta.com/docs/reference/api/system-log/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/okta/okta_policy_modified_or_deleted.yml"
         ],
         "tags": [
@@ -89384,8 +89864,8 @@
         "logsource.category": "No established category",
         "logsource.product": "okta",
         "refs": [
-          "https://developer.okta.com/docs/reference/api/system-log/",
           "https://developer.okta.com/docs/reference/api/event-types/",
+          "https://developer.okta.com/docs/reference/api/system-log/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/okta/okta_mfa_reset_or_deactivated.yml"
         ],
         "tags": [
@@ -89420,8 +89900,8 @@
         "logsource.category": "No established category",
         "logsource.product": "okta",
         "refs": [
-          "https://developer.okta.com/docs/reference/api/system-log/",
           "https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection",
+          "https://developer.okta.com/docs/reference/api/system-log/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/okta/okta_user_session_start_via_anonymised_proxy.yml"
         ],
         "tags": [
@@ -89454,8 +89934,8 @@
         "logsource.category": "No established category",
         "logsource.product": "cisco",
         "refs": [
-          "https://help.duo.com/s/article/6327?language=en_US",
           "https://duo.com/docs/adminapi#logs",
+          "https://help.duo.com/s/article/6327?language=en_US",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/cisco/duo/cisco_duo_mfa_bypass_via_bypass_code.yml"
         ],
         "tags": [
@@ -89699,8 +90179,8 @@
         "logsource.category": "No established category",
         "logsource.product": "aws",
         "refs": [
-          "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/",
           "https://docs.aws.amazon.com/glue/latest/webapi/API_CreateDevEndpoint.html",
+          "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_passed_role_to_glue_development_endpoint.yml"
         ],
         "tags": [
@@ -89860,8 +90340,8 @@
         "logsource.category": "No established category",
         "logsource.product": "aws",
         "refs": [
-          "https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateSAMLProvider.html",
           "https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithSAML.html",
+          "https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateSAMLProvider.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_susp_saml_activity.yml"
         ],
         "tags": [
@@ -89920,9 +90400,9 @@
         "logsource.category": "No established category",
         "logsource.product": "aws",
         "refs": [
-          "https://securitycafe.ro/2022/12/14/aws-enumeration-part-ii-practical-enumeration/",
           "https://github.com/Lifka/hacking-resources/blob/c2ae355d381bd0c9f0b32c4ead049f44e5b1573f/cloud-hacking-cheat-sheets.md",
           "https://jamesonhacking.blogspot.com/2020/12/pivoting-to-private-aws-s3-buckets.html",
+          "https://securitycafe.ro/2022/12/14/aws-enumeration-part-ii-practical-enumeration/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_enum_buckets.yml"
         ],
         "tags": [
@@ -90072,9 +90552,9 @@
         "logsource.category": "No established category",
         "logsource.product": "aws",
         "refs": [
-          "https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/integrations/aws/persistence_route_53_domain_transfer_lock_disabled.toml",
           "https://docs.aws.amazon.com/Route53/latest/APIReference/API_Operations_Amazon_Route_53.html",
           "https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_DisableDomainTransferLock.html",
+          "https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/integrations/aws/persistence_route_53_domain_transfer_lock_disabled.toml",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_route_53_domain_transferred_lock_disabled.yml"
         ],
         "tags": [
@@ -90199,8 +90679,8 @@
         "logsource.category": "No established category",
         "logsource.product": "aws",
         "refs": [
-          "https://github.com/elastic/detection-rules/pull/1214",
           "https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html",
+          "https://github.com/elastic/detection-rules/pull/1214",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_sts_assumerole_misuse.yml"
         ],
         "tags": [
@@ -90250,8 +90730,8 @@
         "logsource.category": "No established category",
         "logsource.product": "aws",
         "refs": [
-          "https://docs.aws.amazon.com/singlesignon/latest/userguide/app-enablement.html",
           "https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiamidentitycentersuccessortoawssinglesign-on.html",
+          "https://docs.aws.amazon.com/singlesignon/latest/userguide/app-enablement.html",
           "https://docs.aws.amazon.com/singlesignon/latest/userguide/sso-info-in-cloudtrail.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_sso_idp_change.yml"
         ],
@@ -90460,9 +90940,9 @@
         "logsource.category": "No established category",
         "logsource.product": "aws",
         "refs": [
-          "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-identity-roles.html",
-          "https://www.packetmischief.ca/2023/07/31/amazon-ec2-credential-exfiltration-how-it-happens-and-how-to-mitigate-it/#lifting-credentials-from-imds-this-is-why-we-cant-have-nice-things",
           "https://ermetic.com/blog/aws/aws-ec2-imds-what-you-need-to-know/",
+          "https://www.packetmischief.ca/2023/07/31/amazon-ec2-credential-exfiltration-how-it-happens-and-how-to-mitigate-it/#lifting-credentials-from-imds-this-is-why-we-cant-have-nice-things",
+          "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-identity-roles.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_cloudtrail_imds_malicious_usage.yml"
         ],
         "tags": [
@@ -90546,9 +91026,9 @@
         "logsource.category": "No established category",
         "logsource.product": "aws",
         "refs": [
-          "https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/ecs__backdoor_task_def/main.py",
-          "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html",
           "https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_RegisterTaskDefinition.html",
+          "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html",
+          "https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/ecs__backdoor_task_def/main.py",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_ecs_task_definition_cred_endpoint_query.yml"
         ],
         "tags": [
@@ -90737,13 +91217,13 @@
         "logsource.category": "No established category",
         "logsource.product": "aws",
         "refs": [
-          "https://docs.aws.amazon.com/AmazonS3/latest/API/API_RestoreObject.html",
-          "https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketEncryption.html",
           "https://github.com/elastic/detection-rules/pull/1145/files",
+          "https://docs.aws.amazon.com/AmazonS3/latest/API/API_RestoreObject.html",
           "https://docs.aws.amazon.com/AmazonS3/latest/userguide/setting-repl-config-perm-overview.html",
-          "https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketLogging.html",
-          "https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketWebsite.html",
           "https://docs.aws.amazon.com/AmazonS3/latest/API/API_Operations.html",
+          "https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketWebsite.html",
+          "https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketLogging.html",
+          "https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketEncryption.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_s3_data_management_tampering.yml"
         ],
         "tags": [
@@ -90942,8 +91422,8 @@
         "logsource.category": "No established category",
         "logsource.product": "aws",
         "refs": [
-          "https://github.com/NetSPI/aws_consoler",
           "https://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies/",
+          "https://github.com/NetSPI/aws_consoler",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_console_getsignintoken.yml"
         ],
         "tags": [
@@ -91158,8 +91638,8 @@
         "logsource.product": "gcp",
         "refs": [
           "https://cloud.google.com/access-context-manager/docs/audit-logging",
-          "https://cloud.google.com/logging/docs/reference/audit/auditlog/rest/Shared.Types/AuditLog",
           "https://cloud.google.com/logging/docs/audit/understanding-audit-logs",
+          "https://cloud.google.com/logging/docs/reference/audit/auditlog/rest/Shared.Types/AuditLog",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/audit/gcp_access_policy_deleted.yml"
         ],
         "tags": [
@@ -91386,11 +91866,11 @@
         "logsource.category": "No established category",
         "logsource.product": "gcp",
         "refs": [
-          "https://kubernetes.io/docs/reference/kubernetes-api/authorization-resources/cluster-role-v1/#ClusterRole",
-          "https://github.com/elastic/detection-rules/pull/1267",
           "https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging",
-          "https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control",
+          "https://github.com/elastic/detection-rules/pull/1267",
           "https://kubernetes.io/docs/reference/access-authn-authz/rbac/",
+          "https://kubernetes.io/docs/reference/kubernetes-api/authorization-resources/cluster-role-v1/#ClusterRole",
+          "https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/audit/gcp_kubernetes_rolebinding.yml"
         ],
         "tags": [
@@ -91509,8 +91989,8 @@
         "logsource.product": "gcp",
         "refs": [
           "https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3",
-          "https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-security-settings?hl=en#ALLOW_STRONG_AUTHENTICATION",
           "https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-security-settings#ENFORCE_STRONG_AUTHENTICATION",
+          "https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-security-settings?hl=en#ALLOW_STRONG_AUTHENTICATION",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/gworkspace/gcp_gworkspace_mfa_disabled.yml"
         ],
         "tags": [
@@ -91557,9 +92037,9 @@
         "logsource.category": "No established category",
         "logsource.product": "gcp",
         "refs": [
-          "https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings?hl=en#REMOVE_APPLICATION_FROM_WHITELIST",
           "https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3",
           "https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings?hl=en#REMOVE_APPLICATION",
+          "https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings?hl=en#REMOVE_APPLICATION_FROM_WHITELIST",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/gworkspace/gcp_gworkspace_application_removed.yml"
         ],
         "tags": [
@@ -91582,8 +92062,8 @@
         "logsource.category": "No established category",
         "logsource.product": "gcp",
         "refs": [
-          "https://support.google.com/a/answer/9261439",
           "https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-application-settings",
+          "https://support.google.com/a/answer/9261439",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/gworkspace/gcp_gworkspace_application_access_levels_modified.yml"
         ],
         "tags": [
@@ -91651,8 +92131,8 @@
         "logsource.category": "No established category",
         "logsource.product": "gcp",
         "refs": [
-          "https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3",
           "https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-user-settings#GRANT_ADMIN_PRIVILEGE",
+          "https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/gworkspace/gcp_gworkspace_user_granted_admin_privileges.yml"
         ],
         "tags": [
@@ -91785,8 +92265,8 @@
         "logsource.category": "No established category",
         "logsource.product": "bitbucket",
         "refs": [
-          "https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html",
           "https://confluence.atlassian.com/bitbucketserver/global-permissions-776640369.html",
+          "https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/bitbucket/audit/bitbucket_audit_global_permissions_change_detected.yml"
         ],
         "tags": [
@@ -92126,8 +92606,8 @@
         "logsource.category": "No established category",
         "logsource.product": "bitbucket",
         "refs": [
-          "https://confluence.atlassian.com/bitbucketserver/view-and-configure-the-audit-log-776640417.html",
           "https://confluence.atlassian.com/bitbucketserver/enable-ssh-access-to-git-repositories-776640358.html",
+          "https://confluence.atlassian.com/bitbucketserver/view-and-configure-the-audit-log-776640417.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/bitbucket/audit/bitbucket_audit_user_login_failure_via_ssh_detected.yml"
         ],
         "tags": [
@@ -92251,11 +92731,11 @@
         "logsource.category": "No established category",
         "logsource.product": "m365",
         "refs": [
-          "https://www.sygnia.co/golden-saml-advisory",
           "https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf",
+          "https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html",
           "https://us-cert.cisa.gov/ncas/alerts/aa21-008a",
           "https://o365blog.com/post/aadbackdoor/",
-          "https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html",
+          "https://www.sygnia.co/golden-saml-advisory",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/m365/exchange/microsoft365_new_federated_domain_added_exchange.yml"
         ],
         "tags": [
@@ -92288,8 +92768,8 @@
         "logsource.category": "No established category",
         "logsource.product": "m365",
         "refs": [
-          "https://o365blog.com/post/aadbackdoor/",
           "https://research.splunk.com/cloud/e155876a-6048-11eb-ae93-0242ac130002/",
+          "https://o365blog.com/post/aadbackdoor/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/m365/audit/microsoft365_new_federated_domain_added_audit.yml"
         ],
         "tags": [
@@ -92838,6 +93318,30 @@
       "uuid": "665e2d43-70dc-4ccc-9d27-026c9dd7ed9c",
       "value": "User Removed From Group With CA Policy Modification Access"
     },
+    {
+      "description": "Detects changes to the \"StrongAuthenticationRequirement\" value, where the state is set to \"0\" or \"Disabled\".\nThreat actors were seen disabling multi factor authentication for users in order to maintain or achieve access to the account. Also see in SIM Swap attacks.\n",
+      "meta": {
+        "author": "Harjot Singh (@cyb3rjy0t)",
+        "creation_date": "2024-08-21",
+        "falsepositive": [
+          "Legitimate authorized activity."
+        ],
+        "filename": "azure_user_account_mfa_disable.yml",
+        "level": "medium",
+        "logsource.category": "No established category",
+        "logsource.product": "azure",
+        "refs": [
+          "https://www.sans.org/blog/defending-against-scattered-spider-and-the-com-with-cybercrime-intelligence/",
+          "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/audit_logs/azure_user_account_mfa_disable.yml"
+        ],
+        "tags": [
+          "attack.credential-access",
+          "attack.persistence"
+        ]
+      },
+      "uuid": "b18454c8-0be3-41f7-86bc-9c614611b839",
+      "value": "Multi Factor Authentication Disabled For User Account"
+    },
     {
       "description": "Monitor and alert for users added to device admin roles.",
       "meta": {
@@ -93395,6 +93899,30 @@
       "uuid": "74298991-9fc4-460e-a92e-511aa60baec1",
       "value": "Added Owner To Application"
     },
+    {
+      "description": "Detects changes and updates to the user risk and MFA registration policy.\nAttackers can modified the policies to Bypass MFA, weaken security thresholds, facilitate further attacks, maintain persistence.\n",
+      "meta": {
+        "author": "Harjot Singh (@cyb3rjy0t)",
+        "creation_date": "2024-08-13",
+        "falsepositive": [
+          "Known updates by administrators."
+        ],
+        "filename": "azure_update_risk_and_mfa_registration_policy.yml",
+        "level": "high",
+        "logsource.category": "No established category",
+        "logsource.product": "azure",
+        "refs": [
+          "https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-mfa-policy",
+          "https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities",
+          "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/audit_logs/azure_update_risk_and_mfa_registration_policy.yml"
+        ],
+        "tags": [
+          "attack.persistence"
+        ]
+      },
+      "uuid": "d4c7758e-9417-4f2e-9109-6125d66dabef",
+      "value": "User Risk and MFA Registration Policy Updated"
+    },
     {
       "description": "Detects newly added root certificate authority to an AzureAD tenant to support certificate based authentication.",
       "meta": {
@@ -93443,9 +93971,9 @@
         "logsource.category": "No established category",
         "logsource.product": "azure",
         "refs": [
-          "https://techcommunity.microsoft.com/t5/microsoft-entra-blog/introducing-windows-local-administrator-password-solution-with/ba-p/1942487",
           "https://twitter.com/NathanMcNulty/status/1785051227568632263",
           "https://www.cloudcoffee.ch/microsoft-365/configure-windows-laps-in-microsoft-intune/",
+          "https://techcommunity.microsoft.com/t5/microsoft-entra-blog/introducing-windows-local-administrator-password-solution-with/ba-p/1942487",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/audit_logs/azure_auditlogs_laps_credential_dumping.yml"
         ],
         "tags": [
@@ -94084,8 +94612,8 @@
         "logsource.category": "No established category",
         "logsource.product": "azure",
         "refs": [
-          "https://web.archive.org/web/20230217071802/https://blooteem.com/march-2022",
           "https://www.microsoft.com/en-us/security/blog/2021/10/26/protect-your-business-from-password-sprays-with-microsoft-dart-recommendations/",
+          "https://web.archive.org/web/20230217071802/https://blooteem.com/march-2022",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/signin_logs/azure_ad_suspicious_signin_bypassing_mfa.yml"
         ],
         "tags": [
@@ -94991,8 +95519,8 @@
         "logsource.category": "No established category",
         "logsource.product": "azure",
         "refs": [
-          "https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins",
           "https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#activity-from-anonymous-ip-address",
+          "https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/identity_protection/azure_identity_protection_anonymous_ip_activity.yml"
         ],
         "tags": [
@@ -95028,8 +95556,8 @@
         "logsource.category": "No established category",
         "logsource.product": "azure",
         "refs": [
-          "https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins",
           "https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#token-issuer-anomaly",
+          "https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/identity_protection/azure_identity_protection_token_issuer_anomaly.yml"
         ],
         "tags": [
@@ -95272,8 +95800,8 @@
         "logsource.category": "No established category",
         "logsource.product": "azure",
         "refs": [
-          "https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins",
           "https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#anomalous-user-activity",
+          "https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/identity_protection/azure_identity_protection_anomalous_user.yml"
         ],
         "tags": [
@@ -95306,8 +95834,8 @@
         "logsource.category": "No established category",
         "logsource.product": "azure",
         "refs": [
-          "https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins",
           "https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#suspicious-browser",
+          "https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/identity_protection/azure_identity_protection_suspicious_browser.yml"
         ],
         "tags": [
@@ -95414,9 +95942,9 @@
         "logsource.category": "No established category",
         "logsource.product": "azure",
         "refs": [
+          "https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#azure-ad-threat-intelligence-sign-in",
           "https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins",
           "https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#azure-ad-threat-intelligence-user",
-          "https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#azure-ad-threat-intelligence-sign-in",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/identity_protection/azure_identity_protection_threat_intel.yml"
         ],
         "tags": [
@@ -95588,8 +96116,8 @@
         "logsource.category": "No established category",
         "logsource.product": "azure",
         "refs": [
-          "https://learn.microsoft.com/en-us/graph/api/resources/riskdetection?view=graph-rest-1.0",
           "https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#anonymous-ip-address",
+          "https://learn.microsoft.com/en-us/graph/api/resources/riskdetection?view=graph-rest-1.0",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/identity_protection/azure_identity_protection_anonymous_ip_address.yml"
         ],
         "tags": [
@@ -95685,11 +96213,11 @@
         "logsource.category": "No established category",
         "logsource.product": "azure",
         "refs": [
+          "https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1",
           "https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/",
+          "https://attack.mitre.org/matrices/enterprise/cloud/",
           "https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes",
           "https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/",
-          "https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1",
-          "https://attack.mitre.org/matrices/enterprise/cloud/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_container_registry_created_or_deleted.yml"
         ],
         "tags": [
@@ -95738,11 +96266,11 @@
         "logsource.category": "No established category",
         "logsource.product": "azure",
         "refs": [
+          "https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1",
           "https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/",
+          "https://attack.mitre.org/matrices/enterprise/cloud/",
           "https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes",
           "https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/",
-          "https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1",
-          "https://attack.mitre.org/matrices/enterprise/cloud/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_kubernetes_role_access.yml"
         ],
         "tags": [
@@ -95765,11 +96293,11 @@
         "logsource.category": "No established category",
         "logsource.product": "azure",
         "refs": [
+          "https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1",
           "https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/",
+          "https://attack.mitre.org/matrices/enterprise/cloud/",
           "https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes",
           "https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/",
-          "https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1",
-          "https://attack.mitre.org/matrices/enterprise/cloud/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_kubernetes_secret_or_config_object_access.yml"
         ],
         "tags": [
@@ -96354,11 +96882,11 @@
         "logsource.category": "No established category",
         "logsource.product": "azure",
         "refs": [
+          "https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1",
           "https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/",
+          "https://attack.mitre.org/matrices/enterprise/cloud/",
           "https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes",
           "https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/",
-          "https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1",
-          "https://attack.mitre.org/matrices/enterprise/cloud/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_kubernetes_network_policy_change.yml"
         ],
         "tags": [
@@ -96466,11 +96994,11 @@
         "logsource.category": "No established category",
         "logsource.product": "azure",
         "refs": [
+          "https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1",
           "https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/",
+          "https://attack.mitre.org/matrices/enterprise/cloud/",
           "https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes",
           "https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/",
-          "https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1",
-          "https://attack.mitre.org/matrices/enterprise/cloud/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_kubernetes_rolebinding_modified_or_deleted.yml"
         ],
         "tags": [
@@ -96618,11 +97146,11 @@
         "logsource.category": "No established category",
         "logsource.product": "azure",
         "refs": [
+          "https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1",
           "https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/",
+          "https://attack.mitre.org/matrices/enterprise/cloud/",
           "https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes",
           "https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/",
-          "https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1",
-          "https://attack.mitre.org/matrices/enterprise/cloud/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_kubernetes_service_account_modified_or_deleted.yml"
         ],
         "tags": [
@@ -96656,11 +97184,11 @@
         "logsource.category": "No established category",
         "logsource.product": "azure",
         "refs": [
+          "https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1",
           "https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/",
+          "https://attack.mitre.org/matrices/enterprise/cloud/",
           "https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes",
           "https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/",
-          "https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1",
-          "https://attack.mitre.org/matrices/enterprise/cloud/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_kubernetes_cluster_created_or_deleted.yml"
         ],
         "tags": [
@@ -96940,9 +97468,9 @@
         "logsource.category": "No established category",
         "logsource.product": "azure",
         "refs": [
-          "https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/",
           "https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes",
           "https://kubernetes.io/docs/concepts/workloads/controllers/job/",
+          "https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/",
           "https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_kubernetes_cronjob.yml"
         ],
@@ -96978,8 +97506,8 @@
         "logsource.category": "No established category",
         "logsource.product": "azure",
         "refs": [
-          "https://github.com/elastic/detection-rules/blob/da3852b681cf1a33898b1535892eab1f3a76177a/rules/integrations/azure/defense_evasion_kubernetes_events_deleted.toml",
           "https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes",
+          "https://github.com/elastic/detection-rules/blob/da3852b681cf1a33898b1535892eab1f3a76177a/rules/integrations/azure/defense_evasion_kubernetes_events_deleted.toml",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_kubernetes_events_deleted.yml"
         ],
         "tags": [
@@ -97256,9 +97784,9 @@
         "logsource.category": "No established category",
         "logsource.product": "qualys",
         "refs": [
-          "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf",
           "https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf",
           "https://www.cisecurity.org/controls/cis-controls-list/",
+          "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/compliance/host_without_firewall.yml"
         ],
         "tags": "No established tags"
@@ -97279,10 +97807,10 @@
         "logsource.category": "No established category",
         "logsource.product": "qualys",
         "refs": [
-          "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf",
           "https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf",
-          "https://community.qualys.com/docs/DOC-6406-reporting-toolbox-focused-search-lists",
           "https://www.cisecurity.org/controls/cis-controls-list/",
+          "https://community.qualys.com/docs/DOC-6406-reporting-toolbox-focused-search-lists",
+          "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/compliance/default_credentials_usage.yml"
         ],
         "tags": [
@@ -97305,9 +97833,9 @@
         "logsource.category": "No established category",
         "logsource.product": "No established product",
         "refs": [
-          "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf",
           "https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf",
           "https://www.cisecurity.org/controls/cis-controls-list/",
+          "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/compliance/netflow_cleartext_protocols.yml"
         ],
         "tags": [
@@ -97375,9 +97903,9 @@
         "logsource.category": "antivirus",
         "logsource.product": "No established product",
         "refs": [
+          "https://www.virustotal.com/gui/file/5fcda49ee7f202559a6cbbb34edb65c33c9a1e0bde9fa2af06a6f11b55ded619",
           "https://www.virustotal.com/gui/file/a4edfbd42595d5bddb442c82a02cf0aaa10893c1bf79ea08b9ce576f82749448",
           "https://www.nextron-systems.com/?s=antivirus",
-          "https://www.virustotal.com/gui/file/5fcda49ee7f202559a6cbbb34edb65c33c9a1e0bde9fa2af06a6f11b55ded619",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/category/antivirus/av_password_dumper.yml"
         ],
         "tags": [
@@ -97467,12 +97995,12 @@
         "logsource.category": "antivirus",
         "logsource.product": "No established product",
         "refs": [
-          "https://www.virustotal.com/gui/file/c312c05ddbd227cbb08958876df2b69d0f7c1b09e5689eb9d93c5b357f63eff7",
-          "https://www.virustotal.com/gui/file/554db97ea82f17eba516e6a6fdb9dc04b1d25580a1eb8cb755eeb260ad0bd61d",
-          "https://www.nextron-systems.com/?s=antivirus",
           "https://www.virustotal.com/gui/file/43b0f7872900bd234975a0877744554f4f355dc57505517abd1ef611e1ce6916",
-          "https://www.virustotal.com/gui/file/69fe77dd558e281621418980040e2af89a2547d377d0f2875502005ce22bc95c",
           "https://www.virustotal.com/gui/file/20179093c59bca3acc6ce9a4281e8462f577ffd29fd7bf51cf2a70d106062045",
+          "https://www.virustotal.com/gui/file/69fe77dd558e281621418980040e2af89a2547d377d0f2875502005ce22bc95c",
+          "https://www.nextron-systems.com/?s=antivirus",
+          "https://www.virustotal.com/gui/file/554db97ea82f17eba516e6a6fdb9dc04b1d25580a1eb8cb755eeb260ad0bd61d",
+          "https://www.virustotal.com/gui/file/c312c05ddbd227cbb08958876df2b69d0f7c1b09e5689eb9d93c5b357f63eff7",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/category/antivirus/av_ransomware.yml"
         ],
         "tags": [
@@ -97538,16 +98066,16 @@
         "logsource.category": "antivirus",
         "logsource.product": "No established product",
         "refs": [
-          "https://www.virustotal.com/gui/file/b8702acf32fd651af9f809ed42d15135f842788cd98d81a8e1b154ee2a2b76a2/detection",
-          "https://www.virustotal.com/gui/file/bd1d52289203866645e556e2766a21d2275877fbafa056a76fe0cf884b7f8819/detection",
-          "https://www.nextron-systems.com/?s=antivirus",
-          "https://www.virustotal.com/gui/file/e841675a4b82250c75273ebf0861245f80c6a1c3d5803c2d995d9d3b18d5c4b5/detection",
-          "https://www.virustotal.com/gui/file/b219f7d3c26f8bad7e175934cd5eda4ddb5e3983503e94ff07d39c0666821b7e/detection",
-          "https://www.virustotal.com/gui/file/a80042c61a0372eaa0c2c1e831adf0d13ef09feaf71d1d20b216156269045801/detection",
-          "https://www.virustotal.com/gui/file/7d3cb8a8ff28f82b07f382789247329ad2d7782a72dde9867941f13266310c80/detection",
-          "https://www.virustotal.com/gui/file/308487ed28a3d9abc1fec7ebc812d4b5c07ab025037535421f64c60d3887a3e8/detection",
           "https://www.virustotal.com/gui/file/13ae8bfbc02254b389ab052aba5e1ba169b16a399d9bc4cb7414c4a73cd7dc78/detection",
+          "https://www.virustotal.com/gui/file/bd1d52289203866645e556e2766a21d2275877fbafa056a76fe0cf884b7f8819/detection",
+          "https://www.virustotal.com/gui/file/b8702acf32fd651af9f809ed42d15135f842788cd98d81a8e1b154ee2a2b76a2/detection",
+          "https://www.virustotal.com/gui/file/e841675a4b82250c75273ebf0861245f80c6a1c3d5803c2d995d9d3b18d5c4b5/detection",
+          "https://www.virustotal.com/gui/file/7d3cb8a8ff28f82b07f382789247329ad2d7782a72dde9867941f13266310c80/detection",
           "https://github.com/tennc/webshell",
+          "https://www.nextron-systems.com/?s=antivirus",
+          "https://www.virustotal.com/gui/file/b219f7d3c26f8bad7e175934cd5eda4ddb5e3983503e94ff07d39c0666821b7e/detection",
+          "https://www.virustotal.com/gui/file/308487ed28a3d9abc1fec7ebc812d4b5c07ab025037535421f64c60d3887a3e8/detection",
+          "https://www.virustotal.com/gui/file/a80042c61a0372eaa0c2c1e831adf0d13ef09feaf71d1d20b216156269045801/detection",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/category/antivirus/av_webshell.yml"
         ],
         "tags": [
@@ -97580,10 +98108,10 @@
         "logsource.category": "antivirus",
         "logsource.product": "No established product",
         "refs": [
-          "https://www.virustotal.com/gui/file/8f8daabe1c8ceb5710949283818e16c4aa8059bf2ce345e2f2c90b8692978424",
           "https://www.virustotal.com/gui/file/925b0b28472d4d79b4bf92050e38cc2b8f722691c713fc28743ac38551bc3797",
-          "https://www.nextron-systems.com/?s=antivirus",
+          "https://www.virustotal.com/gui/file/8f8daabe1c8ceb5710949283818e16c4aa8059bf2ce345e2f2c90b8692978424",
           "https://www.virustotal.com/gui/file/d9669f7e3eb3a9cdf6a750eeb2ba303b5ae148a43e36546896f1d1801e912466",
+          "https://www.nextron-systems.com/?s=antivirus",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/category/antivirus/av_exploiting.yml"
         ],
         "tags": [
@@ -97716,10 +98244,10 @@
         "logsource.category": "file_event",
         "logsource.product": "linux",
         "refs": [
-          "https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/",
-          "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection",
-          "https://blogs.jpcert.or.jp/en/2023/05/gobrat.html",
           "https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection",
+          "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection",
+          "https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/",
+          "https://blogs.jpcert.or.jp/en/2023/05/gobrat.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/file_event/file_event_lnx_susp_shell_script_under_profile_directory.yml"
         ],
         "tags": [
@@ -97776,10 +98304,10 @@
         "logsource.category": "file_event",
         "logsource.product": "linux",
         "refs": [
-          "https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/",
-          "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection",
-          "https://blogs.jpcert.or.jp/en/2023/05/gobrat.html",
           "https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection",
+          "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection",
+          "https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/",
+          "https://blogs.jpcert.or.jp/en/2023/05/gobrat.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/file_event/file_event_lnx_wget_download_file_in_tmp_dir.yml"
         ],
         "tags": [
@@ -97902,8 +98430,8 @@
         "logsource.category": "No established category",
         "logsource.product": "linux",
         "refs": [
-          "Self Experience",
           "https://github.com/Neo23x0/auditd/blob/master/audit.rules",
+          "Self Experience",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/auditd/lnx_auditd_auditing_config_change.yml"
         ],
         "tags": [
@@ -97978,10 +98506,10 @@
         "logsource.category": "No established category",
         "logsource.product": "linux",
         "refs": [
-          "https://linux.die.net/man/8/pam_tty_audit",
-          "https://access.redhat.com/articles/4409591#audit-record-types-2",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.001/T1056.001.md",
+          "https://access.redhat.com/articles/4409591#audit-record-types-2",
           "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/sec-configuring_pam_for_auditing",
+          "https://linux.die.net/man/8/pam_tty_audit",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/auditd/lnx_auditd_keylogging_with_pam_d.yml"
         ],
         "tags": [
@@ -98156,10 +98684,10 @@
         "logsource.category": "No established category",
         "logsource.product": "linux",
         "refs": [
-          "https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/",
-          "https://man7.org/linux/man-pages/man8/getcap.8.html",
-          "https://int0x33.medium.com/day-44-linux-capabilities-privilege-escalation-via-openssl-with-selinux-enabled-and-enforced-74d2bec02099",
           "https://mn3m.info/posts/suid-vs-capabilities/",
+          "https://man7.org/linux/man-pages/man8/getcap.8.html",
+          "https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/",
+          "https://int0x33.medium.com/day-44-linux-capabilities-privilege-escalation-via-openssl-with-selinux-enabled-and-enforced-74d2bec02099",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/auditd/lnx_auditd_capabilities_discovery.yml"
         ],
         "tags": [
@@ -98367,8 +98895,8 @@
         "logsource.category": "No established category",
         "logsource.product": "linux",
         "refs": [
-          "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor",
           "https://www.sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/",
+          "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/auditd/lnx_auditd_bpfdoor_port_redirect.yml"
         ],
         "tags": [
@@ -98434,8 +98962,8 @@
         "logsource.category": "No established category",
         "logsource.product": "linux",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md",
           "https://firewalld.org/documentation/man-pages/firewall-cmd.html",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/auditd/lnx_auditd_disable_system_firewall.yml"
         ],
         "tags": [
@@ -98468,8 +98996,8 @@
         "logsource.category": "No established category",
         "logsource.product": "linux",
         "refs": [
-          "https://github.com/Azure/Azure-Sentinel/pull/3059",
           "https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure",
+          "https://github.com/Azure/Azure-Sentinel/pull/3059",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/auditd/lnx_auditd_omigod_scx_runasprovider_executeshellcommand.yml"
         ],
         "tags": [
@@ -98554,8 +99082,8 @@
         "logsource.category": "No established category",
         "logsource.product": "linux",
         "refs": [
-          "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor",
           "https://www.sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/",
+          "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/auditd/lnx_auditd_bpfdoor_file_accessed.yml"
         ],
         "tags": [
@@ -98630,8 +99158,8 @@
         "logsource.category": "No established category",
         "logsource.product": "linux",
         "refs": [
-          "https://gtfobins.github.io/gtfobins/wget/",
           "https://linux.die.net/man/1/wget",
+          "https://gtfobins.github.io/gtfobins/wget/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/auditd/lnx_auditd_data_exfil_wget.yml"
         ],
         "tags": [
@@ -98730,8 +99258,8 @@
         "logsource.category": "No established category",
         "logsource.product": "linux",
         "refs": [
-          "https://linux.die.net/man/1/arecord",
           "https://linuxconfig.org/how-to-test-microphone-with-audio-linux-sound-architecture-alsa",
+          "https://linux.die.net/man/1/arecord",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/auditd/lnx_auditd_audio_capture.yml"
         ],
         "tags": [
@@ -98764,10 +99292,10 @@
         "logsource.category": "No established category",
         "logsource.product": "linux",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1201/T1201.md",
-          "https://superuser.com/questions/150675/how-to-display-password-policy-information-for-a-user-ubuntu",
-          "https://linux.die.net/man/1/chage",
           "https://man7.org/linux/man-pages/man1/passwd.1.html",
+          "https://linux.die.net/man/1/chage",
+          "https://superuser.com/questions/150675/how-to-display-password-policy-information-for-a-user-ubuntu",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1201/T1201.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/auditd/lnx_auditd_password_policy_discovery.yml"
         ],
         "tags": [
@@ -98866,8 +99394,8 @@
         "logsource.category": "No established category",
         "logsource.product": "linux",
         "refs": [
-          "https://blog.aquasec.com/container-security-tnt-container-attack",
           "https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html",
+          "https://blog.aquasec.com/container-security-tnt-container-attack",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/auditd/lnx_auditd_modify_system_firewall.yml"
         ],
         "tags": [
@@ -98900,8 +99428,8 @@
         "logsource.category": "No established category",
         "logsource.product": "linux",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md",
           "https://imagemagick.org/",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md",
           "https://linux.die.net/man/1/import",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/auditd/lnx_auditd_screencapture_import.yml"
         ],
@@ -98935,8 +99463,8 @@
         "logsource.category": "No established category",
         "logsource.product": "linux",
         "refs": [
-          "https://www.youtube.com/watch?v=VmvY5SQm5-Y&ab_channel=M45C07",
           "https://access.redhat.com/articles/4409591#audit-record-types-2",
+          "https://www.youtube.com/watch?v=VmvY5SQm5-Y&ab_channel=M45C07",
           "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/sec-understanding_audit_log_files",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/auditd/lnx_auditd_create_account.yml"
         ],
@@ -99004,9 +99532,9 @@
         "logsource.category": "No established category",
         "logsource.product": "linux",
         "refs": [
-          "https://www.anomali.com/blog/pulling-linux-rabbit-rabbot-malware-out-of-a-hat",
-          "https://objective-see.org/blog/blog_0x68.html",
           "https://web.archive.org/web/20221204161143/https://www.glitch-cat.com/p/green-lambert-and-attack",
+          "https://objective-see.org/blog/blog_0x68.html",
+          "https://www.anomali.com/blog/pulling-linux-rabbit-rabbot-malware-out-of-a-hat",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/auditd/lnx_auditd_unix_shell_configuration_modification.yml"
         ],
         "tags": [
@@ -99434,9 +99962,9 @@
         "logsource.category": "No established category",
         "logsource.product": "linux",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.006/T1547.006.md",
           "https://man7.org/linux/man-pages/man8/kmod.8.html",
           "https://linux.die.net/man/8/insmod",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.006/T1547.006.md",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/auditd/lnx_auditd_load_module_insmod.yml"
         ],
         "tags": [
@@ -99571,8 +100099,8 @@
         "refs": [
           "https://www.virustotal.com/gui/file/beddf70a7bab805f0c0b69ac0989db6755949f9f68525c08cb874988353f78a9/content",
           "https://regex101.com/r/RugQYK/1",
-          "https://intezer.com/wp-content/uploads/2021/09/TeamTNT-Cryptomining-Explosion.pdf",
           "https://www.cadosecurity.com/blog/spinning-yarn-a-new-linux-malware-campaign-targets-docker-apache-hadoop-redis-and-confluence",
+          "https://intezer.com/wp-content/uploads/2021/09/TeamTNT-Cryptomining-Explosion.pdf",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_pnscan_binary_cli_pattern.yml"
         ],
         "tags": [
@@ -99638,8 +100166,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "linux",
         "refs": [
-          "https://dev.to/0xbf/use-mkfifo-to-create-named-pipe-linux-tips-5bbk",
           "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally",
+          "https://dev.to/0xbf/use-mkfifo-to-create-named-pipe-linux-tips-5bbk",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_mkfifo_named_pipe_creation_susp_location.yml"
         ],
         "tags": [
@@ -99720,8 +100248,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "linux",
         "refs": [
-          "https://dev.to/0xbf/use-mkfifo-to-create-named-pipe-linux-tips-5bbk",
           "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally",
+          "https://dev.to/0xbf/use-mkfifo-to-create-named-pipe-linux-tips-5bbk",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_mkfifo_named_pipe_creation.yml"
         ],
         "tags": [
@@ -100026,8 +100554,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "linux",
         "refs": [
-          "https://attack.mitre.org/techniques/T1548/001/",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.001/T1548.001.md",
+          "https://attack.mitre.org/techniques/T1548/001/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_setgid_setuid.yml"
         ],
         "tags": [
@@ -100060,10 +100588,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "linux",
         "refs": [
-          "https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/",
-          "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection",
-          "https://blogs.jpcert.or.jp/en/2023/05/gobrat.html",
           "https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection",
+          "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection",
+          "https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/",
+          "https://blogs.jpcert.or.jp/en/2023/05/gobrat.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_crontab_enumeration.yml"
         ],
         "tags": [
@@ -100129,8 +100657,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "linux",
         "refs": [
-          "https://github.com/Azure/Azure-Sentinel/pull/3059",
           "https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure",
+          "https://github.com/Azure/Azure-Sentinel/pull/3059",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_omigod_scx_runasprovider_executeshellcommand.yml"
         ],
         "tags": [
@@ -100181,9 +100709,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "linux",
         "refs": [
+          "https://github.com/Tib3rius/AutoRecon",
           "https://github.com/projectdiscovery/naabu",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md",
-          "https://github.com/Tib3rius/AutoRecon",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_susp_network_utilities_execution.yml"
         ],
         "tags": [
@@ -100250,8 +100778,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "linux",
         "refs": [
-          "https://github.com/sleventyeleven/linuxprivchecker/",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md",
+          "https://github.com/sleventyeleven/linuxprivchecker/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_susp_history_recon.yml"
         ],
         "tags": [
@@ -100408,10 +100936,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "linux",
         "refs": [
-          "https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/",
-          "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection",
-          "https://blogs.jpcert.or.jp/en/2023/05/gobrat.html",
           "https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection",
+          "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection",
+          "https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/",
+          "https://blogs.jpcert.or.jp/en/2023/05/gobrat.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_grep_os_arch_discovery.yml"
         ],
         "tags": [
@@ -100469,8 +100997,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "linux",
         "refs": [
-          "https://bpftrace.org/",
           "https://embracethered.com/blog/posts/2021/offensive-bpf-bpftrace/",
+          "https://bpftrace.org/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_bpftrace_unsafe_option_usage.yml"
         ],
         "tags": [
@@ -100673,9 +101201,9 @@
         "logsource.product": "linux",
         "refs": [
           "https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/",
+          "https://www.secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware/",
           "https://developer.vmware.com/docs/11743/esxi-7-0-esxcli-command-reference/namespace/esxcli_vm.html",
           "https://www.trendmicro.com/en_us/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html",
-          "https://www.secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_esxcli_vm_discovery.yml"
         ],
         "tags": [
@@ -100750,8 +101278,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "linux",
         "refs": [
-          "https://developer.vmware.com/docs/11743/esxi-7-0-esxcli-command-reference/namespace/esxcli_system.html",
           "https://support.solarwinds.com/SuccessCenter/s/article/Configure-ESXi-Syslog-to-LEM?language=en_US",
+          "https://developer.vmware.com/docs/11743/esxi-7-0-esxcli-command-reference/namespace/esxcli_system.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_esxcli_syslog_config_change.yml"
         ],
         "tags": [
@@ -100792,10 +101320,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "linux",
         "refs": [
-          "https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/",
-          "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection",
-          "https://blogs.jpcert.or.jp/en/2023/05/gobrat.html",
           "https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection",
+          "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection",
+          "https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/",
+          "https://blogs.jpcert.or.jp/en/2023/05/gobrat.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_susp_shell_child_process_from_parent_tmp_folder.yml"
         ],
         "tags": [
@@ -100819,8 +101347,8 @@
         "logsource.product": "linux",
         "refs": [
           "https://github.com/diego-treitos/linux-smart-enumeration",
-          "https://github.com/carlospolop/PEASS-ng",
           "https://github.com/SaiSathvik1/Linux-Privilege-Escalation-Notes",
+          "https://github.com/carlospolop/PEASS-ng",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_capa_discovery.yml"
         ],
         "tags": [
@@ -100877,10 +101405,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "linux",
         "refs": [
-          "https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/",
-          "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection",
-          "https://blogs.jpcert.or.jp/en/2023/05/gobrat.html",
           "https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection",
+          "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection",
+          "https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/",
+          "https://blogs.jpcert.or.jp/en/2023/05/gobrat.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_wget_download_suspicious_directory.yml"
         ],
         "tags": [
@@ -100914,9 +101442,9 @@
         "logsource.product": "linux",
         "refs": [
           "https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/",
+          "https://www.secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware/",
           "https://developer.vmware.com/docs/11743/esxi-7-0-esxcli-command-reference/namespace/esxcli_vm.html",
           "https://www.trendmicro.com/en_us/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html",
-          "https://www.secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_esxcli_vm_kill.yml"
         ],
         "tags": [
@@ -100975,8 +101503,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "linux",
         "refs": [
-          "https://access.redhat.com/security/cve/cve-2019-14287",
           "https://twitter.com/matthieugarin/status/1183970598210412546",
+          "https://access.redhat.com/security/cve/cve-2019-14287",
           "https://www.openwall.com/lists/oss-security/2019/10/14/1",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_sudo_cve_2019_14287.yml"
         ],
@@ -101019,9 +101547,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "linux",
         "refs": [
+          "https://www.cyberciti.biz/tips/linux-iptables-how-to-flush-all-rules.html",
           "https://blogs.blackberry.com/",
           "https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144",
-          "https://www.cyberciti.biz/tips/linux-iptables-how-to-flush-all-rules.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_iptables_flush_ufw.yml"
         ],
         "tags": [
@@ -101088,8 +101616,8 @@
         "logsource.product": "linux",
         "refs": [
           "https://www.helpnetsecurity.com/2023/08/02/aws-instances-attackers-access/",
-          "https://www.mitiga.io/blog/mitiga-security-advisory-abusing-the-ssm-agent-as-a-remote-access-trojan",
           "https://www.bleepingcomputer.com/news/security/amazons-aws-ssm-agent-can-be-used-as-post-exploitation-rat-malware/",
+          "https://www.mitiga.io/blog/mitiga-security-advisory-abusing-the-ssm-agent-as-a-remote-access-trojan",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_ssm_agent_abuse.yml"
         ],
         "tags": [
@@ -101190,10 +101718,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "linux",
         "refs": [
-          "https://linuxize.com/post/how-to-delete-group-in-linux/",
-          "https://www.cybrary.it/blog/0p3n/linux-commands-used-attackers/",
-          "https://linux.die.net/man/8/groupdel",
           "https://www.cyberciti.biz/faq/linux-remove-user-command/",
+          "https://linux.die.net/man/8/groupdel",
+          "https://www.cybrary.it/blog/0p3n/linux-commands-used-attackers/",
+          "https://linuxize.com/post/how-to-delete-group-in-linux/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_groupdel.yml"
         ],
         "tags": [
@@ -101249,10 +101777,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "linux",
         "refs": [
-          "https://linuxize.com/post/how-to-delete-group-in-linux/",
-          "https://www.cybrary.it/blog/0p3n/linux-commands-used-attackers/",
-          "https://linux.die.net/man/8/userdel",
           "https://www.cyberciti.biz/faq/linux-remove-user-command/",
+          "https://linux.die.net/man/8/userdel",
+          "https://www.cybrary.it/blog/0p3n/linux-commands-used-attackers/",
+          "https://linuxize.com/post/how-to-delete-group-in-linux/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_userdel.yml"
         ],
         "tags": [
@@ -101285,10 +101813,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "linux",
         "refs": [
-          "https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/",
-          "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection",
-          "https://blogs.jpcert.or.jp/en/2023/05/gobrat.html",
           "https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection",
+          "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection",
+          "https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/",
+          "https://blogs.jpcert.or.jp/en/2023/05/gobrat.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_nohup_susp_execution.yml"
         ],
         "tags": [
@@ -101379,8 +101907,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "linux",
         "refs": [
-          "https://developer.vmware.com/docs/11743/esxi-7-0-esxcli-command-reference/namespace/esxcli_vsan.html",
           "https://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html",
+          "https://developer.vmware.com/docs/11743/esxi-7-0-esxcli-command-reference/namespace/esxcli_vsan.html",
           "https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_esxcli_vsan_discovery.yml"
         ],
@@ -101422,15 +101950,15 @@
         "logsource.category": "process_creation",
         "logsource.product": "linux",
         "refs": [
-          "https://github.com/Ne0nd0g/merlin",
           "https://github.com/pathtofile/bad-bpf",
-          "https://github.com/Pennyw0rth/NetExec/",
           "https://github.com/HavocFramework/Havoc",
-          "https://github.com/t3l3machus/Villain",
-          "https://github.com/1N3/Sn1per",
-          "https://github.com/carlospolop/PEASS-ng",
-          "https://github.com/Gui774ume/ebpfkit",
           "https://github.com/t3l3machus/hoaxshell",
+          "https://github.com/t3l3machus/Villain",
+          "https://github.com/Pennyw0rth/NetExec/",
+          "https://github.com/Gui774ume/ebpfkit",
+          "https://github.com/carlospolop/PEASS-ng",
+          "https://github.com/1N3/Sn1per",
+          "https://github.com/Ne0nd0g/merlin",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_susp_hktl_execution.yml"
         ],
         "tags": [
@@ -101530,8 +102058,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "linux",
         "refs": [
-          "https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection",
           "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection",
+          "https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection",
           "https://blogs.jpcert.or.jp/en/2023/05/gobrat.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_malware_gobrat_grep_payload_discovery.yml"
         ],
@@ -101623,8 +102151,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "linux",
         "refs": [
-          "https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/",
           "https://developer.vmware.com/docs/11743/esxi-7-0-esxcli-command-reference/namespace/esxcli_network.html",
+          "https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_esxcli_network_discovery.yml"
         ],
         "tags": [
@@ -101859,11 +102387,11 @@
         "logsource.category": "process_creation",
         "logsource.product": "linux",
         "refs": [
-          "https://www.trendmicro.com/en_us/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1105/T1105.md#atomic-test-19---curl-upload-file",
-          "https://curl.se/docs/manpage.html",
-          "https://medium.com/@petehouston/upload-files-with-curl-93064dcccc76",
           "https://twitter.com/d1r4c/status/1279042657508081664",
+          "https://medium.com/@petehouston/upload-files-with-curl-93064dcccc76",
+          "https://www.trendmicro.com/en_us/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html",
+          "https://curl.se/docs/manpage.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_susp_curl_fileupload.yml"
         ],
         "tags": [
@@ -102027,9 +102555,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "linux",
         "refs": [
+          "https://www.computerhope.com/unix/unohup.htm",
           "https://en.wikipedia.org/wiki/Nohup",
           "https://gtfobins.github.io/gtfobins/nohup/",
-          "https://www.computerhope.com/unix/unohup.htm",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_nohup.yml"
         ],
         "tags": [
@@ -102095,8 +102623,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "linux",
         "refs": [
-          "https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html",
           "https://www.cyberciti.biz/faq/how-force-kill-process-linux/",
+          "https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_kill_process.yml"
         ],
         "tags": [
@@ -102162,8 +102690,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "linux",
         "refs": [
-          "https://github.com/Azure/Azure-Sentinel/pull/3059",
           "https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure",
+          "https://github.com/Azure/Azure-Sentinel/pull/3059",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_omigod_scx_runasprovider_executescript.yml"
         ],
         "tags": [
@@ -102257,11 +102785,11 @@
         "logsource.category": "process_creation",
         "logsource.product": "linux",
         "refs": [
-          "https://www.hackingtutorials.org/networking/hacking-netcat-part-2-bind-reverse-shells/",
-          "https://www.revshells.com/",
-          "https://www.infosecademy.com/netcat-reverse-shells/",
           "https://man7.org/linux/man-pages/man1/ncat.1.html",
           "https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet",
+          "https://www.infosecademy.com/netcat-reverse-shells/",
+          "https://www.revshells.com/",
+          "https://www.hackingtutorials.org/networking/hacking-netcat-part-2-bind-reverse-shells/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_netcat_reverse_shell.yml"
         ],
         "tags": [
@@ -102393,8 +102921,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "linux",
         "refs": [
-          "https://github.com/arget13/DDexec",
           "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally",
+          "https://github.com/arget13/DDexec",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_base64_execution.yml"
         ],
         "tags": [
@@ -102493,9 +103021,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "linux",
         "refs": [
-          "https://gtfobins.github.io/gtfobins/rvim/",
           "https://gtfobins.github.io/gtfobins/vim/",
           "https://gtfobins.github.io/gtfobins/vimdiff/",
+          "https://gtfobins.github.io/gtfobins/rvim/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_gtfobin_vim.yml"
         ],
         "tags": [
@@ -102528,10 +103056,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "linux",
         "refs": [
-          "https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/",
-          "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection",
-          "https://blogs.jpcert.or.jp/en/2023/05/gobrat.html",
           "https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection",
+          "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection",
+          "https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/",
+          "https://blogs.jpcert.or.jp/en/2023/05/gobrat.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_susp_shell_script_exec_from_susp_location.yml"
         ],
         "tags": [
@@ -102587,9 +103115,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "linux",
         "refs": [
+          "https://embracethered.com/blog/posts/2021/offensive-bpf-bpftrace/",
           "https://www.kernel.org/doc/html/v5.0/trace/kprobetrace.html",
           "https://bpftrace.org/",
-          "https://embracethered.com/blog/posts/2021/offensive-bpf-bpftrace/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_bpf_kprob_tracing_enabled.yml"
         ],
         "tags": [
@@ -102646,10 +103174,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "linux",
         "refs": [
-          "https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/",
-          "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection",
-          "https://blogs.jpcert.or.jp/en/2023/05/gobrat.html",
           "https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection",
+          "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection",
+          "https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/",
+          "https://blogs.jpcert.or.jp/en/2023/05/gobrat.html",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_susp_execution_tmp_folder.yml"
         ],
         "tags": [
@@ -102682,9 +103210,9 @@
         "logsource.category": "process_creation",
         "logsource.product": "linux",
         "refs": [
+          "https://www.cyberciti.biz/faq/linux-hide-processes-from-other-users/",
           "https://blogs.blackberry.com/",
           "https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144",
-          "https://www.cyberciti.biz/faq/linux-hide-processes-from-other-users/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_mount_hidepid.yml"
         ],
         "tags": [
@@ -102750,8 +103278,8 @@
         "logsource.category": "process_creation",
         "logsource.product": "linux",
         "refs": [
-          "https://github.com/sleventyeleven/linuxprivchecker/",
           "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md",
+          "https://github.com/sleventyeleven/linuxprivchecker/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_susp_history_delete.yml"
         ],
         "tags": [
@@ -102784,10 +103312,10 @@
         "logsource.category": "process_creation",
         "logsource.product": "linux",
         "refs": [
-          "https://www.tutorialspoint.com/how-to-install-a-software-on-linux-using-yum-command",
           "https://linuxhint.com/uninstall_yum_package/",
-          "https://sysdig.com/blog/mitre-defense-evasion-falco",
           "https://linuxhint.com/uninstall-debian-packages/",
+          "https://sysdig.com/blog/mitre-defense-evasion-falco",
+          "https://www.tutorialspoint.com/how-to-install-a-software-on-linux-using-yum-command",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_remove_package.yml"
         ],
         "tags": [
@@ -103071,8 +103599,8 @@
         "logsource.category": "network_connection",
         "logsource.product": "linux",
         "refs": [
-          "https://twitter.com/hakluke/status/1587733971814977537/photo/1",
           "https://ngrok.com/docs/secure-tunnels/tunnels/ssh-reverse-tunnel-agent",
+          "https://twitter.com/hakluke/status/1587733971814977537/photo/1",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/network_connection/net_connection_lnx_ngrok_tunnel.yml"
         ],
         "tags": [
@@ -103205,11 +103733,11 @@
         "logsource.category": "network_connection",
         "logsource.product": "linux",
         "refs": [
-          "https://thehackernews.com/2024/01/systembc-malwares-c2-server-analysis.html",
-          "https://www.mandiant.com/resources/blog/ukraine-and-sandworm-team",
-          "https://www.mandiant.com/resources/blog/triton-actor-ttp-profile-custom-attack-tools-detections",
-          "https://www.elastic.co/guide/en/security/current/potential-non-standard-port-ssh-connection.html",
           "https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors",
+          "https://www.elastic.co/guide/en/security/current/potential-non-standard-port-ssh-connection.html",
+          "https://thehackernews.com/2024/01/systembc-malwares-c2-server-analysis.html",
+          "https://www.mandiant.com/resources/blog/triton-actor-ttp-profile-custom-attack-tools-detections",
+          "https://www.mandiant.com/resources/blog/ukraine-and-sandworm-team",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/network_connection/net_connection_lnx_susp_malware_callback_port.yml"
         ],
         "tags": [
@@ -103425,10 +103953,10 @@
         "logsource.category": "No established category",
         "logsource.product": "linux",
         "refs": [
-          "https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/modules/exploits/multi/http/struts_code_exec_exception_delegator.rb",
-          "https://web.archive.org/web/20170319121015/http://www.threatgeek.com/2017/03/widespread-exploitation-attempts-using-cve-2017-5638.html",
-          "https://artkond.com/2017/03/23/pivoting-guide/",
           "http://pastebin.com/FtygZ1cg",
+          "https://web.archive.org/web/20170319121015/http://www.threatgeek.com/2017/03/widespread-exploitation-attempts-using-cve-2017-5638.html",
+          "https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/modules/exploits/multi/http/struts_code_exec_exception_delegator.rb",
+          "https://artkond.com/2017/03/23/pivoting-guide/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/builtin/lnx_shell_susp_commands.yml"
         ],
         "tags": [
@@ -103661,8 +104189,8 @@
         "logsource.category": "No established category",
         "logsource.product": "linux",
         "refs": [
-          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.003/T1070.003.md",
           "https://www.hackers-arise.com/post/2016/06/20/covering-your-bash-shell-tracks-antiforensics",
+          "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.003/T1070.003.md",
           "https://www.cadosecurity.com/spinning-yarn-a-new-linux-malware-campaign-targets-docker-apache-hadoop-redis-and-confluence/",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/builtin/lnx_shell_clear_cmd_history.yml"
         ],
@@ -103853,8 +104381,8 @@
         "logsource.category": "No established category",
         "logsource.product": "linux",
         "refs": [
-          "https://access.redhat.com/security/cve/cve-2019-14287",
           "https://twitter.com/matthieugarin/status/1183970598210412546",
+          "https://access.redhat.com/security/cve/cve-2019-14287",
           "https://www.openwall.com/lists/oss-security/2019/10/14/1",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/builtin/sudo/lnx_sudo_cve_2019_14287_user.yml"
         ],
@@ -104029,8 +104557,8 @@
         "logsource.category": "No established category",
         "logsource.product": "linux",
         "refs": [
-          "https://github.com/openssh/openssh-portable/blob/c483a5c0fb8e8b8915fad85c5f6113386a4341ca/ssherr.c",
           "https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/sshd_rules.xml",
+          "https://github.com/openssh/openssh-portable/blob/c483a5c0fb8e8b8915fad85c5f6113386a4341ca/ssherr.c",
           "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/builtin/sshd/lnx_sshd_susp_ssh.yml"
         ],
         "tags": [
@@ -104117,5 +104645,5 @@
       "value": "Modifying Crontab"
     }
   ],
-  "version": 20240820
+  "version": 20240902
 }