alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects attempts to add, modify, or delete Windows Credential Guard related registry keys or values via command line too. Logsource: windows / process_creation. Rule: title: Windows Credential Guard Registry Tampering Via CommandLine id: c17d47b7-dcd6-4109-87eb-d1817bd4cbc9 related: - id: 73921b9c-cafd-4446-b0c6-fdb0ace42bc0 type: similar - id: d645ef86-2396-48a1-a2b6-b629ca3f57ff type: similar status: experimental description: 'Detects attempts to add, modify, or delete Windows Credential Guard related registry keys or values via command line tools such as Reg.exe or PowerShell. Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Adversaries may disable Credential Guard to gain access to sensitive credentials stored in the system, such as NTLM hashes and Kerberos tickets, which can be used for lateral movement and privilege escalation. The rule matches suspicious command lines that target DeviceGuard or LSA registry paths and manipulate keys like EnableVirtualizationBasedSecurity, RequirePlatformSecurityFeatures, or LsaCfgFlags. Such activity may indicate an attempt to disable or tamper with Credential Guard, potentially exposing sensitive credentials for misuse. ' references: - https://woshub.com/disable-credential-guard-windows/ - https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-deviceguard author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-12-26 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - \reg.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll - reg.exe selection_cli: CommandLine|contains: - 'add ' - 'New-ItemProperty ' - 'Set-ItemProperty ' - 'si ' - 'delete ' - 'del ' - 'Remove-ItemProperty ' - 'rp ' selection_key_base: CommandLine|contains: - \Control\DeviceGuard - \Control\LSA - Software\Policies\Microsoft\Windows\DeviceGuard selection_key_specific: CommandLine|contains: - EnableVirtualizationBasedSecurity - RequirePlatformSecurityFeatures - LsaCfgFlags condition: all of selection_* falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_credential_guard_registry_tampering/info.yml
Sigma rule: Detects registry persistence technique using the GlobalFlags and SilentProcessExit keys. Logsource: windows / registry_set. Rule: title: Potential Persistence Via GlobalFlags id: 36803969-5421-41ec-b92f-8500f79c23b0 related: - id: c81fe886-cac0-4913-a511-2822d72ff505 type: obsolete status: test description: Detects registry persistence technique using the GlobalFlags and SilentProcessExit keys references: - https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/ - https://www.deepinstinct.com/2021/02/16/lsass-memory-dumps-are-stealthier-than-ever-before-part-2/ author: Karneades, Jonhnathan Ribeiro, Florian Roth date: 2018-04-11 modified: 2023-06-05 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.012 - car.2013-01-002 logsource: category: registry_set product: windows detection: selection_global_flag: TargetObject|contains|all: - \Microsoft\Windows NT\CurrentVersion\ - \Image File Execution Options\ - \GlobalFlag selection_silent_process: TargetObject|contains|all: - \Microsoft\Windows NT\CurrentVersion\ - \SilentProcessExit\ TargetObject|contains: - \ReportingMode - \MonitorProcess condition: 1 of selection_* falsepositives: - Unknown level: high
Sigma rule: Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping o. Logsource: zeek / dce_rpc. Rule: title: MITRE BZAR Indicators for Execution id: b640c0b8-87f8-4daa-aef8-95a24261dd1d status: test description: Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE references: - https://github.com/mitre-attack/bzar#indicators-for-attck-execution author: '@neu5ron, SOC Prime' date: 2020-03-19 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1047 - attack.t1053.002 - attack.t1569.002 logsource: product: zeek service: dce_rpc detection: op1: endpoint: JobAdd operation: atsvc op2: endpoint: ITaskSchedulerService operation: SchRpcEnableTask op3: endpoint: ITaskSchedulerService operation: SchRpcRegisterTask op4: endpoint: ITaskSchedulerService operation: SchRpcRun op5: endpoint: IWbemServices operation: ExecMethod op6: endpoint: IWbemServices operation: ExecMethodAsync op7: endpoint: svcctl operation: CreateServiceA op8: endpoint: svcctl operation: CreateServiceW op9: endpoint: svcctl operation: StartServiceA op10: endpoint: svcctl operation: StartServiceW condition: 1 of op* falsepositives: - Windows administrator tasks or troubleshooting - Windows management scripts or software level: medium
Sigma rule: Rule to detect the Hybrid Connection Manager service installation.. Logsource: windows / security. Rule: title: HybridConnectionManager Service Installation id: 0ee4d8a5-4e67-4faf-acfa-62a78457d1f2 status: test description: Rule to detect the Hybrid Connection Manager service installation. references: - https://twitter.com/Cyb3rWard0g/status/1381642789369286662 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2021-04-12 modified: 2022-10-09 tags: - attack.persistence - attack.t1554 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: selection: EventID: 4697 ServiceName: HybridConnectionManager ServiceFileName|contains: HybridConnectionManager condition: selection falsepositives: - Legitimate use of Hybrid Connection Manager via Azure function apps. level: high
Sigma rule: Detects creation of files which are the results of executing the built-in reconnaissance script "C:\Windows\System32\gat. Logsource: windows / file_event. Rule: title: GatherNetworkInfo.VBS Reconnaissance Script Output id: f92a6f1e-a512-4a15-9735-da09e78d7273 related: - id: 575dce0c-8139-4e30-9295-1ee75969f7fe type: similar - id: 07aa184a-870d-413d-893a-157f317f6f58 type: similar status: test description: Detects creation of files which are the results of executing the built-in reconnaissance script "C:\Windows\System32\gatherNetworkInfo.vbs". references: - https://posts.slayerlabs.com/living-off-the-land/#gathernetworkinfovbs - https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-08 tags: - attack.discovery logsource: product: windows category: file_event detection: selection: TargetFilename|startswith: C:\Windows\System32\config TargetFilename|endswith: - \Hotfixinfo.txt - \netiostate.txt - \sysportslog.txt - \VmSwitchLog.evtx condition: selection falsepositives: - Unknown level: medium
Sigma rule: Detects execution of ntdsutil.exe to perform different actions such as restoring snapshots...etc.. Logsource: windows / process_creation. Rule: title: Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe) id: a58353df-af43-4753-bad0-cd83ef35eef5 related: - id: 2afafd61-6aae-4df4-baed-139fa1f4c345 type: derived status: test description: Detects execution of ntdsutil.exe to perform different actions such as restoring snapshots...etc. references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731620(v=ws.11) - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/espionage-asia-governments author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-14 tags: - attack.credential-access - attack.t1003.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \ntdsutil.exe - OriginalFileName: ntdsutil.exe selection_cli: - CommandLine|contains|all: - snapshot - 'mount ' - CommandLine|contains|all: - ac - ' i' - ' ntds' condition: all of selection_* falsepositives: - Legitimate usage to restore snapshots - Legitimate admin activity level: medium
Sigma rule: Detects wscript/cscript/mshta executions of scripts located in user directories. Logsource: windows / process_creation. Rule: title: Potential Dropper Script Execution Via WScript/CScript/MSHTA id: cea72823-df4d-4567-950c-0b579eaf0846 related: - id: 1e33157c-53b1-41ad-bbcc-780b80b58288 type: similar status: test description: Detects wscript/cscript/mshta executions of scripts located in user directories references: - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/ - https://redcanary.com/blog/gootloader/ - https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/ author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems), Dave Johnson date: 2019-01-16 modified: 2026-02-17 tags: - attack.execution - attack.t1059.005 - attack.t1059.007 logsource: category: process_creation product: windows detection: selection_exec: Image|endswith: - \wscript.exe - \cscript.exe - \mshta.exe selection_paths: CommandLine|contains: - :\Perflogs\ - :\Temp\ - :\Tmp\ - :\Users\Public\ - :\Windows\Temp\ - \AppData\Local\Temp\ - \AppData\Roaming\Temp\ - \Start Menu\Programs\Startup\ - \Temporary Internet - \Windows\Temp - '%LocalAppData%\Temp\' - '%TEMP%' - '%TMP%' selection_ext: CommandLine|contains: - .hta - .js - .jse - .vba - .vbe - .vbs - .wsf - .wsh condition: all of selection_* falsepositives: - Some installers might generate a similar behavior. An initial baseline is required level: medium
Sigma rule: Detects the execution of "BitLockerToGo.EXE". BitLocker To Go is BitLocker Drive Encryption on removable data drives. Th. Logsource: windows / process_creation. Rule: title: BitLockerTogo.EXE Execution id: 7f2376f9-42ee-4dfc-9360-fecff9a88fc8 status: test description: 'Detects the execution of "BitLockerToGo.EXE". BitLocker To Go is BitLocker Drive Encryption on removable data drives. This feature includes the encryption of, USB flash drives, SD cards, External hard disk drives, Other drives that are formatted by using the NTFS, FAT16, FAT32, or exFAT file system. This is a rarely used application and usage of it at all is worth investigating. Malware such as Lumma stealer has been seen using this process as a target for process hollowing. ' references: - https://tria.ge/240521-ynezpagf56/behavioral1 - https://any.run/report/6eea2773c1b4b5c6fb7c142933e220c96f9a4ec89055bf0cf54accdcde7df535/a407f006-ee45-420d-b576-f259094df091 - https://bazaar.abuse.ch/sample/8c75f8e94486f5bbf461505823f5779f328c5b37f1387c18791e0c21f3fdd576/ - https://bazaar.abuse.ch/sample/64e6605496919cd76554915cbed88e56fdec10dec6523918a631754664b8c8d3/ author: Josh Nickels, mttaggart date: 2024-07-11 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: Image|endswith: \BitLockerToGo.exe condition: selection falsepositives: - Legitimate usage of BitLockerToGo.exe to encrypt portable devices. level: low
Sigma rule: Detects WmiPrvSE spawning a process. Logsource: windows / process_creation. Rule: title: WmiPrvSE Spawned A Process id: d21374ff-f574-44a7-9998-4a8c8bf33d7d related: - id: 8a582fe2-0882-4b89-a82a-da6b2dc32937 type: similar - id: 692f0bec-83ba-4d04-af7e-e884a96059b6 type: similar status: stable description: Detects WmiPrvSE spawning a process references: - https://threathunterplaybook.com/hunts/windows/190815-RemoteServiceInstallation/notebook.html author: Roberto Rodriguez @Cyb3rWard0g date: 2019-08-15 modified: 2023-03-23 tags: - attack.execution - attack.t1047 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \WmiPrvSe.exe filter_logonid: LogonId: - '0x3e7' - 'null' filter_system_user: User|contains: - AUTHORI - AUTORI filter_wmiprvse: Image|endswith: \WmiPrvSE.exe filter_werfault: Image|endswith: \WerFault.exe filter_null: LogonId: null condition: selection and not 1 of filter_* falsepositives: - False positives are expected (e.g. in environments where WinRM is used legitimately) level: medium
Sigma rule: Detect malicious GPO modifications can be used to implement many other malicious behaviors.. Logsource: windows / ps_script. Rule: title: Modify Group Policy Settings - ScriptBlockLogging id: b7216a7d-687e-4c8d-82b1-3080b2ad961f related: - id: ada4b0c4-758b-46ac-9033-9004613a150d type: similar status: test description: Detect malicious GPO modifications can be used to implement many other malicious behaviors. references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1484.001/T1484.001.md author: frack113 date: 2022-08-19 tags: - attack.privilege-escalation - attack.defense-impairment - attack.t1484.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_path: ScriptBlockText|contains: \SOFTWARE\Policies\Microsoft\Windows\System selection_key: ScriptBlockText|contains: - GroupPolicyRefreshTimeDC - GroupPolicyRefreshTimeOffsetDC - GroupPolicyRefreshTime - GroupPolicyRefreshTimeOffset - EnableSmartScreen - ShellSmartScreenLevel condition: all of selection_* falsepositives: - Legitimate use level: medium
Sigma rule: Detects the use of the 'setcap' utility to set the 'setgid' capability (cap_setgid) on a binary file. This capability al. Logsource: linux / process_creation. Rule: title: Linux Setgid Capability Set on a Binary via Setcap Utility id: 3a716279-c18c-4488-83be-f9ececbfb9fc status: experimental description: 'Detects the use of the ''setcap'' utility to set the ''setgid'' capability (cap_setgid) on a binary file. This capability allows a non privileged process to make arbitrary manipulations of group IDs (GIDs), including setting its current GID to a value that would otherwise be restricted (i.e. GID 0, the root group). This behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed. ' references: - https://man7.org/linux/man-pages/man8/setcap.8.html - https://dfir.ch/posts/linux_capabilities/ - https://juggernaut-sec.com/capabilities/#cap_setgid author: Luc Génaux date: 2026-01-24 tags: - attack.privilege-escalation - attack.persistence - attack.t1548 - attack.t1554 logsource: product: linux category: process_creation detection: selection: Image|endswith: /setcap CommandLine|contains: cap_setgid condition: selection falsepositives: - Unknown level: low
Sigma rule: Detects suspicious children spawned via the Windows Terminal application which could be a sign of persistence via Window. Logsource: windows / process_creation. Rule: title: Suspicious WindowsTerminal Child Processes id: 8de89e52-f6e1-4b5b-afd1-41ecfa300d48 status: test description: Detects suspicious children spawned via the Windows Terminal application which could be a sign of persistence via WindowsTerminal (see references section) references: - https://persistence-info.github.io/Data/windowsterminalprofile.html - https://twitter.com/nas_bench/status/1550836225652686848 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-25 modified: 2023-02-14 tags: - attack.execution - attack.persistence logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \WindowsTerminal.exe - \wt.exe selection_susp: - Image|endswith: - \rundll32.exe - \regsvr32.exe - \certutil.exe - \cscript.exe - \wscript.exe - \csc.exe - Image|contains: - C:\Users\Public\ - \Downloads\ - \Desktop\ - \AppData\Local\Temp\ - \Windows\TEMP\ - CommandLine|contains: - ' iex ' - ' icm' - Invoke- - 'Import-Module ' - 'ipmo ' - DownloadString( - ' /c ' - ' /k ' - ' /r ' filter_builtin_visual_studio_shell: CommandLine|contains|all: - Import-Module - Microsoft.VisualStudio.DevShell.dll - Enter-VsDevShell filter_open_settings: CommandLine|contains|all: - \AppData\Local\Packages\Microsoft.WindowsTerminal_ - \LocalState\settings.json filter_vsdevcmd: CommandLine|contains|all: - C:\Program Files\Microsoft Visual Studio\ - \Common7\Tools\VsDevCmd.bat condition: all of selection_* and not 1 of filter_* falsepositives: - Other legitimate "Windows Terminal" profiles level: medium
Sigma rule: Detects suspicious commandline flags used by PsExec and PAExec to escalate a command line to LOCAL_SYSTEM rights. Logsource: windows / process_creation. Rule: title: PsExec/PAExec Escalation to LOCAL SYSTEM id: 8834e2f7-6b4b-4f09-8906-d2276470ee23 related: - id: 207b0396-3689-42d9-8399-4222658efc99 type: similar status: test description: Detects suspicious commandline flags used by PsExec and PAExec to escalate a command line to LOCAL_SYSTEM rights references: - https://learn.microsoft.com/en-us/sysinternals/downloads/psexec - https://www.poweradmin.com/paexec/ - https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-11-23 modified: 2024-03-05 tags: - attack.resource-development - attack.t1587.001 logsource: category: process_creation product: windows detection: selection_sys: CommandLine|contains|windash: - ' -s cmd' - ' -s -i cmd' - ' -i -s cmd' - ' -s pwsh' - ' -s -i pwsh' - ' -i -s pwsh' - ' -s powershell' - ' -s -i powershell' - ' -i -s powershell' selection_other: CommandLine|contains: - psexec - paexec - accepteula condition: all of selection_* falsepositives: - Admins that use PsExec or PAExec to escalate to the SYSTEM account for maintenance purposes (rare) - Users that debug Microsoft Intune issues using the commands mentioned in the official documentation; see https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension level: high
Sigma rule: Detects the execution of whoami.exe with suspicious parent processes.. Logsource: windows / process_creation. Rule: title: Whoami.EXE Execution Anomaly id: 8de1cbe8-d6f5-496d-8237-5f44a721c7a0 status: test description: Detects the execution of whoami.exe with suspicious parent processes. references: - https://brica.de/alerts/alert/public/1247926/agent-tesla-keylogger-delivered-inside-a-power-iso-daa-archive/ - https://app.any.run/tasks/7eaba74e-c1ea-400f-9c17-5e30eee89906/ - https://www.youtube.com/watch?v=DsJ9ByX84o4&t=6s author: Florian Roth (Nextron Systems) date: 2021-08-12 modified: 2025-03-06 tags: - attack.discovery - attack.t1033 - car.2016-03-001 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \whoami.exe - OriginalFileName: whoami.exe filter_main_known_parents: ParentImage|endswith: - \cmd.exe - \powershell_ise.exe - \powershell.exe - \pwsh.exe filter_optional_ms_monitoring_agent: ParentImage|endswith: :\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe filter_main_parent_null: ParentImage: null filter_main_parent_empty: ParentImage: - '' - '-' condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Admin activity - Scripts and administrative tools used in the monitored environment - Monitoring activity level: medium
Sigma rule: Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.. Logsource: windows / security. Rule: title: Startup/Logon Script Added to Group Policy Object id: 123e4e6d-b123-48f8-b261-7214938acaf0 status: test description: 'Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects. ' references: - https://www.elastic.co/guide/en/security/current/startup-logon-script-added-to-group-policy-object.html author: Elastic, Josh Nickels, Marius Rothenbücher date: 2024-09-06 tags: - attack.persistence - attack.privilege-escalation - attack.defense-impairment - attack.t1484.001 - attack.t1547 logsource: product: windows service: security definition: The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure detection: selection_eventid: EventID: - 5136 - 5145 selection_attributes_main: AttributeLDAPDisplayName: - gPCMachineExtensionNames - gPCUserExtensionNames AttributeValue|contains: 42B5FAAE-6536-11D2-AE5A-0000F87571E3 selection_attributes_optional: AttributeValue|contains: - 40B6664F-4972-11D1-A7CA-0000F87571E3 - 40B66650-4972-11D1-A7CA-0000F87571E3 selection_share: ShareName|endswith: \SYSVOL RelativeTargetName|endswith: - \scripts.ini - \psscripts.ini AccessList|contains: '%%4417' condition: selection_eventid and (all of selection_attributes_* or selection_share) falsepositives: - Legitimate execution by system administrators. level: medium
Sigma rule: Detects potentially suspicious child processes of "aspnet_compiler.exe".. Logsource: windows / process_creation. Rule: title: Suspicious Child Process of AspNetCompiler id: 9ccba514-7cb6-4c5c-b377-700758f2f120 related: - id: 4c7f49ee-2638-43bb-b85b-ce676c30b260 type: similar - id: 9f50fe98-fe5c-4a2d-86c7-fad7f63ed622 type: similar - id: a01b8329-5953-4f73-ae2d-aa01e1f35f00 type: similar status: test description: Detects potentially suspicious child processes of "aspnet_compiler.exe". references: - https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/ - https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-14 tags: - attack.execution - attack.stealth - attack.t1127 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \aspnet_compiler.exe selection_child: - Image|endswith: - \calc.exe - \notepad.exe - Image|contains: - \Users\Public\ - \AppData\Local\Temp\ - \AppData\Local\Roaming\ - :\Temp\ - :\Windows\Temp\ - :\Windows\System32\Tasks\ - :\Windows\Tasks\ condition: all of selection_* falsepositives: - Unknown level: high
Sigma rule: Detects potential persistence behavior using the windows telemetry registry key. Windows telemetry makes use of the bina. Logsource: windows / registry_set. Rule: title: Potential Registry Persistence Attempt Via Windows Telemetry id: 73a883d0-0348-4be4-a8d8-51031c2564f8 related: - id: 4e8d5fd3-c959-441f-a941-f73d0cdcdca5 type: obsolete status: test description: 'Detects potential persistence behavior using the windows telemetry registry key. Windows telemetry makes use of the binary CompatTelRunner.exe to run a variety of commands and perform the actual telemetry collections. This binary was created to be easily extensible, and to that end, it relies on the registry to instruct on which commands to run. The problem is, it will run any arbitrary command without restriction of location or type. ' references: - https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence/ author: Lednyov Alexey, oscd.community, Sreeman date: 2020-10-16 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053.005 logsource: category: registry_set product: windows definition: 'Requirements: Sysmon config that monitors \SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController subkey of the HKLM hives' detection: selection: TargetObject|contains: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController\ TargetObject|endswith: \Command Details|contains: - .bat - .bin - .cmd - .dat - .dll - .exe - .hta - .jar - .js - .msi - .ps - .sh - .vb filter_main_generic: Details|contains: - \system32\CompatTelRunner.exe - \system32\DeviceCensus.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high