<group name="windows,sysmon,">
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112101" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1546.011,technique_name=Application Shimming$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1546</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112102" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1547.002,technique_name=Authentication Package$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1547</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112103" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1547.001,technique_name=Registry Run Keys / Start Folder$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1547</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112104" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1037,technique_name=Boot or Logon Initialization Scripts$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1037</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112105" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1547.004,technique_name=Winlogon Helper DLL$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1547</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112106" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1546.001,technique_name=Change Default File Association$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1546</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112107" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1548.002,technique_name=Bypass User Access Control$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1548</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112108" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1546.015,technique_name=Component Object Model Hijacking$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1546</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112109" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1003.002,technique_name=Security Account Manager$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1003</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112110" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1098,technique_name=Account Manipulation$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1098</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112111" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1546.010,technique_name=Appinit DLLs$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1546</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112112" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1562.006,technique_name=Impair Defenses - Indicator Blocking$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1562</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112113" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1015,technique_name=Accessibility Features$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1015</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112114" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1562.002,technique_name=Disable Windows Event Logging$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1562</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112115" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1546.012,technique_name=Image File Execution Options Injection$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1546</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112116" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1546.007,technique_name=Netsh Helper DLL$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1546</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112117" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1137.006,technique_name=Office Add-ins$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1137</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112118" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1137.004,technique_name=Outlook Home Page$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1137</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112119" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1021.001,technique_name=Remote Desktop Protocol$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1021</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112120" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1053,technique_name=Scheduled Task$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1053</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112121" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1547.005,technique_name=Security Support Provider$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1547</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112122" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1543,technique_name=Service Creation$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1543</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112123" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1553.003,technique_name=SIP and Trust Provider Hijacking$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1553</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112124" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1569.002,technique_name=Service Execution$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1569</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112125" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1105,technique_name=Ingress Tool Transfer$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1105</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112126" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1033,technique_name=System Owner/User Discovery$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1033</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112127" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1057,technique_name=Process Discovery$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1057</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112128" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1089,technique_name=Disabling Security Tools$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1089</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112129" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1547.003,technique_name=Time Providers$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1547</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112130" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1218,technique_name=Signed Binary Proxy Execution$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1218</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112131" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1546.009,technique_name=AppCert DLLs$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1546</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112132" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1125,technique_name=Video Capture$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1125</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112133" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1123,technique_name=Audio Capture$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1123</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112134" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1005,technique_name=Data from Local System$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1005</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112135" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1056.001,technique_name=Input Capture - Keylogging$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1056</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112136" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1003,technique_name=Credential Dumping$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1003</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112137" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1547.010,technique_name=Boot or Logon Autostart Execution - Port Monitors$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1547</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112138" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1130,technique_name=Install Root Certificate$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1130</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112139" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1210,technique_name=Exploitation of Remote Services$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1210</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112140" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1047,technique_name=Windows Management Instrumentation$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1047</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
  <!-- Sysmon - Event 13: PsExec Detection -->
<rule id="112141" level="13">
<if_sid>61615</if_sid>
<field name="win.eventdata.TargetObject">\\\\PsExec\\\\EulaAccepted$</field>
<description>Sysmon - Event 13: RegistryEvent PsExec EulaAccepted Detected</description>
<mitre>
<id>T1047</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112142" level="3">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1112,technique_name=Modify Registry$</field>
<description>Sysmon - Event 13: RegistryEvent (Value Modified) by $(win.eventdata.image)</description>
<mitre>
<id>T1112</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: RegistryEvent by $(win.eventdata.image) -->
<rule id="112143" level="3">
<if_sid>61615</if_sid>
<description>Sysmon - Event 13: RegistryEvent by $(win.eventdata.image)</description>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
<!--T1548.002 added amine-->
<rule id="112144" level="10">
  <field name="win.eventdata.TargetObject" type="pcre2">(?i)mscfile\\\\shell\\\\open\\\\command</field>
  <description>T1548.002: Bypass UAC via mscfile EventViewer hijack</description>
  <mitre>
    <id>T1548.002</id>
  </mitre>
</rule>
<rule id="112145" level="10">
  <field name="win.eventdata.TargetObject">mscfile</field>
  <description>T1548.002: Bypass UAC via mscfile EventViewer hijack (test rule)</description>
  <mitre>
    <id>T1548.002</id>
  </mitre>
</rule>
<rule id="112146" level="10">
  <field name="win.eventdata.TargetObject" type="pcre2">(?i)HKLM\\System\\CurrentControlSet\\Control\\Lsa\\Notification Packages</field>
  <description>T1556.002 - Password Filter DLL Registration detected: Modification of LSA Notification Packages registry key.</description>
  <mitre>
    <id>T1556.002</id>
  </mitre>
  <group>credential_access, registry, windows, sysmon</group>
</rule>
<rule id="112147" level="10">
  <field name="win.eventdata.TargetObject" type="pcre2">(?i)HKLM\\\\System\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\Authentication Packages</field>
  <description>T1556.002 - Password Filter DLL Registration detected: Modification of LSA Authentication Packages registry key.</description>
  <mitre>
    <id>T1556.002</id>
  </mitre>
  <group>credential_access, registry, windows, sysmon</group>
</rule>
  <rule id="112148" level="10">
  <if_sid>61615</if_sid>
  <field name="win.eventdata.targetObject" type="pcre2">(?i)^HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\SpecialAccounts\\\\Userlist\\\\[^\\]+$</field>
    <description>Suspicious registry modification detected: Hiding user accounts via Userlist key (T1564.002 - Hidden Users)</description>
    <mitre>
      <id>T1564.002</id>
    </mitre>
    <options>no_full_log</options>
    <group>sysmon_event_13,</group>
  </rule>
<rule id="112149" level="10">
  <if_sid>61615</if_sid>
  <field name="win.eventdata.targetObject" type="pcre2">(?i)^HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\Audit\\\\ProcessCreationIncludeCmdLine_Enabled$</field>
  <field name="win.eventdata.details" type="pcre2">(?i)DWORD\s*\(0x0+\)</field>
  <description>Suspicious registry modification detected: Disabling command line auditing (T1562.003 - Impair Command History Logging) via $(win.eventdata.targetObject) with value $(win.eventdata.details).</description>
  <mitre>
    <id>T1562.003</id>
  </mitre>
  <options>no_full_log</options>
  <group>sysmon_event_13,</group>
</rule>
<rule id="112150" level="10">
  <if_sid>61615</if_sid>
  <field name="win.eventdata.targetObject" type="pcre2">(?i)HKLM\\\\System\\\\CurrentControlSet\\\\Services\\\\[^\\\\]+\\\\ImagePath</field>
  <field name="win.eventdata.details" type="pcre2">(?i)C:\\\\Program Files\\\\[^"]+</field>
  <description>T1574.009 - Path Interception by Unquoted Service Path in Registry (ImagePath points to Program Files without quotes)</description>
  <mitre>
    <id>T1574.009</id>
  </mitre>
  <options>no_full_log</options>
  <group>sysmon_event_13,</group>
</rule>
<rule id="112151" level="10">
  <if_sid>61615</if_sid> 
  <field name="win.eventdata.targetObject" type="pcre2">(?i)HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\\\\(AppInit_DLLs|RequireSignedAppInit_DLLs)</field>
  <description>T1546.010 - Event Triggered Execution: AppInit DLLs Registry Modification</description>
  <mitre>
    <id>T1546.010</id>
  </mitre>
  <options>no_full_log</options>
  <group>sysmon_event_13,</group>
</rule>
<rule id="112152" level="10">
  <if_sid>61615</if_sid>
  <field name="win.eventdata.eventType" type="pcre2">(?i)^SetValue$</field>
  <field name="win.eventdata.targetObject" type="pcre2">(?i)HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\[^\\\\]+\\\\ImagePath</field>
  <field name="win.eventdata.image" type="pcre2">(?i)(powershell\.exe|reg\.exe|cmd\.exe|sc\.exe)$</field>
  <description>T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness (Service ImagePath modified by $(win.eventdata.image))</description>
  <mitre>
    <id>T1574.011</id>
  </mitre>
  <group>sysmon_event_13</group>
</rule>
<rule id="112153" level="10">
  <if_sid>61615</if_sid> 
  <field name="win.eventdata.targetObject" type="pcre2">(?i)Software\\\\Microsoft\\\\Terminal Server Client\\\\Default\\\\Addins</field>
  <field name="win.eventdata.details" type="pcre2">(?i)\.dll</field>
  <description>T1547 - RDP Addins DLL Injection detected. Registry key: $(win.eventdata.targetObject), DLL: $(win.eventdata.details)</description>
  <mitre>
    <id>T1547</id>
  </mitre>
  <group>sysmon_event_13</group>
</rule>
  <rule id="112154" level="10">
    <if_sid>61615</if_sid> 
    <field name="win.eventdata.targetObject" type="pcre2">(?i)^HKLM\\\\SOFTWARE\\\\Microsoft\\\\Active Setup\\\\Installed Components\\\\.*\\\\StubPath$</field>
    <description>T1547.014 - Active Setup StubPath persistence detected (Registry modification under Installed Components)</description>
    <mitre>
      <id>T1547.014</id>
    </mitre>
  </rule>
  <rule id="112155" level="10">
    <if_sid>61615</if_sid>
    <field name="win.eventdata.targetObject" type="pcre2">(?i)HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\[^\\\\]+\\\\(ImagePath|ServiceDll|Type|Start)</field>
    <description>T1543.003 - Windows Service Configuration Modification via Registry (ImagePath, ServiceDll, Type, Start)</description>
    <mitre>
      <id>T1543.003</id>
    </mitre>
  </rule>
<rule id="112156" level="10">
  <if_sid>61615</if_sid>
  <field name="win.eventdata.eventType" type="pcre2">(?i)^SetValue$</field>
  <field name="win.eventdata.targetObject" type="pcre2">(?i)Software\\\\Microsoft\\\\Office\\\\.*\\\\Outlook\\\\Security\\\\Level</field>
  <field name="win.eventdata.details" type="pcre2">(?i)DWORD \(0x00000001\)</field>
  <description>T1137 - Outlook Macro Security Level Persistence detected via Registry SetValue (Target: $(win.eventdata.targetObject))</description>
  <mitre>
    <id>T1137</id>
  </mitre>
</rule>
<rule id="112157" level="10">
  <if_sid>61615</if_sid>
  <field name="win.eventdata.targetObject" type="pcre2">(?i)HKLM\\\\System\\\\CurrentControlSet\\\\Control\\\\Print\\\\Environments\\\\Windows x64\\\\Print Processors\\\\[^\\\\]+\\\\Driver</field>
  <description>T1547.012 - Print Processor Registry Key Persistence (TargetObject: $(win.eventdata.targetObject))</description>
  <mitre>
    <id>T1547.012</id>
  </mitre>
</rule>
<!-- Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image) -->
<rule id="112158" level="10">
  <if_sid>61615</if_sid>
  <field name="win.eventdata.RuleName">^technique_id=T1546,technique_name=Registry Value Set \(Persistence Mechanisms\)$</field>
  <description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
  <mitre>
    <id>T1546</id>
  </mitre>
  <options>no_full_log</options>
  <group>sysmon_event_13,</group>
</rule>

<rule id="112159" level="10">
  <if_sid>61615</if_sid>
  <field name="win.eventdata.RuleName">^technique_id=T1036.004,technique_name=Masqueraded Service Description Written$</field>
  <description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
  <mitre>
    <id>T1036</id>
  </mitre>
  <options>no_full_log</options>
  <group>sysmon_event_13,</group>
</rule>

<rule id="112160" level="10">
  <if_sid>61615</if_sid>
  <field name="win.eventdata.RuleName">^technique_id=T1090.001,technique_name=PortProxy Registry Modification$</field>
  <description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
  <mitre>
    <id>T1090</id>
  </mitre>
  <options>no_full_log</options>
  <group>sysmon_event_13,</group>
</rule>

<rule id="112161" level="10">
  <if_sid>61615</if_sid>
  <field name="win.eventdata.RuleName">^technique_id=T1547.008,technique_name=LSASS Persistence Cleanup$</field>
  <description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
  <mitre>
    <id>T1547</id>
  </mitre>
  <options>no_full_log</options>
  <group>sysmon_event_13,</group>
</rule>

<rule id="112162" level="10">
  <if_sid>61615</if_sid>
  <field name="win.eventdata.RuleName">^technique_id=T1547.002,technique_name=Add Custom Authentication Package DLL$</field>
  <description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
  <mitre>
    <id>T1547</id>
  </mitre>
  <options>no_full_log</options>
  <group>sysmon_event_13,</group>
</rule>

<rule id="112163" level="10">
  <if_sid>61615</if_sid>
  <field name="win.eventdata.RuleName">^technique_id=T1546.001,technique_name=Set AutodialDLL$</field>
  <description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
  <mitre>
    <id>T1546</id>
  </mitre>
  <options>no_full_log</options>
  <group>sysmon_event_13,</group>
</rule>

<rule id="112164" level="10">
  <if_sid>61615</if_sid>
  <field name="win.eventdata.RuleName">^technique_id=T1546.002,technique_name=AutoRun Command Processor$</field>
  <description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
  <mitre>
    <id>T1546</id>
  </mitre>
  <options>no_full_log</options>
  <group>sysmon_event_13,</group>
</rule>

<rule id="112165" level="10">
  <if_sid>61615</if_sid>
  <field name="win.eventdata.RuleName">^technique_id=T1546.005,technique_name=WER Debugger$</field>
  <description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
  <mitre>
    <id>T1546</id>
  </mitre>
  <options>no_full_log</options>
  <group>sysmon_event_13,</group>
</rule>

<rule id="112166" level="10">
  <if_sid>61615</if_sid>
  <field name="win.eventdata.RuleName">^technique_id=T1546.006,technique_name=MSTSC ClxDllPath$</field>
  <description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
  <mitre>
    <id>T1546</id>
  </mitre>
  <options>no_full_log</options>
  <group>sysmon_event_13,</group>
</rule>

<rule id="112167" level="10">
  <if_sid>61615</if_sid>
  <field name="win.eventdata.RuleName">^technique_id=T1546.007,technique_name=Terminal Server AddIns$</field>
  <description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
  <mitre>
    <id>T1546</id>
  </mitre>
  <options>no_full_log</options>
  <group>sysmon_event_13,</group>
</rule>

<rule id="112168" level="10">
  <if_sid>61615</if_sid>
  <field name="win.eventdata.RuleName">^technique_id=T1546.009,technique_name=Word STARTUP-PATH$</field>
  <description>Sysmon - Event 13: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
  <mitre>
    <id>T1546</id>
  </mitre>
  <options>no_full_log</options>
  <group>sysmon_event_13,</group>
</rule>

</group>
