<group name="windows,sysmon,">
	<rule id="100100" level="3">
		<if_sid>61603</if_sid>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1546</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100101" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1546.008,technique_name=Accessibility Features$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1546</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100102" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1546.011,technique_name=Application Shimming$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1546</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100103" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1197,technique_name=BITS Jobs$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1197</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100104" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1548.002,technique_name=Bypass User Access Control$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1548</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100105" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1027,technique_name=Obfuscated Files or Information$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1027</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100106" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1204,technique_name=User Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1204</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100107" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1054,technique_name=Indicator Blocking$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1054</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100108" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1518.001,technique_name=Security Software Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1518</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100109" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1218.004,technique_name=InstallUtil$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100110" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1218.002,technique_name=rundll32.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100111" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1546.008,technique_name=Windows Error Reporting$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1546</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100112" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1033,technique_name=System Owner/User Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1033</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100113" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1016,technique_name=System Network Configuration Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1016</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100114" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1057,technique_name=Process Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1057</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100115" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1049,technique_name=System Network Connections Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1049</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100116" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1018,technique_name=Remote System Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1018</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100117" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1083,technique_name=File and Directory Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1083</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100118" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1134,technique_name=Access Token Manipulation$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1134</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100119" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1112,technique_name=Modify Registry$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1112</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100120" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1063,technique_name=Security Software Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1063</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100121" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1087,technique_name=Account Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1087</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100122" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1070,technique_name=Indicator Removal on Host$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1070</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100123" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1053,technique_name=Scheduled Task$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1053</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100124" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1117,technique_name=Regsvr32$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1117</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100125" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1047,technique_name=Windows Management Instrumentation$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1047</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100126" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1202,technique_name=Indirect Command Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1202</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100127" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1059,technique_name=Command-Line Interface$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1059</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100128" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1086,technique_name=PowerShell$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1086</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100129" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1073,technique_name=DLL Side-Loading$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1073</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100130" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1500,technique_name=Compile After Delivery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1500</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100131" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1216,technique_name=Signed Script Proxy Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1216</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100132" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1170,technique_name=Mshta$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1170</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100133" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1158,technique_name=Hidden Files and DirectoriesHidden Files and Directories$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1158</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100134" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1053,technique_name=Scheduled Tasks$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1053</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100135" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1218,technique_name=Signed Binary Proxy Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100136" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1031,technique_name=Modify Existing Service$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1031</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100137" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1081,technique_name=Credentials in Files$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1081</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100138" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1222,technique_name=File Permissions Modification$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1222</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100139" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1074,technique_name=Data Staged$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1074</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100140" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1490,technique_name=Inhibit System Recovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1490</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100141" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1088,technique_name=Bypass User Account Control$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1088</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100142" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1127,technique_name=Trusted Developer Utilities$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1127</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100143" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1003,technique_name=Credential Dumping$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1003</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100144" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1127,technique_name=dfsvc.exe Making Network Connections$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1127</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100145" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1103,technique_name=Credential Dumping$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1103</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100146" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1105,technique_name=Remote File Copy with Expand$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1105</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100147" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1105,technique_name=Remote File Copy$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1105</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100148" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=1218,technique_name=Signed Binary Proxy Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100149" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1127,technique_name=Trusted Developer Tools$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1127</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100150" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1118,technique_name=InstallUtil$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1118</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100151" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1127,technique_name=Javascript compilation$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1127</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100152" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1218,technique_name=Proxy Execution of unsigned C# Code$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100153" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1218,technique_name=Signed Binary Proxy Execution" condition="is$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100154" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1217,technique_name=Trusted Script Proxy Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1217</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100155" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1218,technique_name=Trusted Script Proxy Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100156" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1216,technique_name=Trusted Script Proxy Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1216</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100157" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1218,technique_name=Trusted Binary Proxy Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100158" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=1086,technique_name=Powershell$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1086</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100159" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1053,technique_name=Scheduled Task/Job$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1053</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100160" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1218.010,technique_name=Regsvr32$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100161" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1059.003,technique_name=Windows Command Shell$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1059</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100162" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1059.001,technique_name=PowerShell$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1059</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100163" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1218.005,technique_name=Mshta$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100164" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1564.001,technique_name=Hidden Files and DirectoriesHidden Files and Directories$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1564</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100165" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1543.003,technique_name=Windows Service$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1543</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100166" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1552.001,technique_name=Credentials in Files$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1552</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100167" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1078,technique_name=Valid Accounts$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1078</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100168" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1040,technique_name=Network Sniffing$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1040</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100169" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=1482,technique_name=Domain Trust Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1482</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100170" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1482,technique_name=Domain Trust Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1482</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100171" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1127</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100172" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1569.002,technique_name=Service Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1569</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100173" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1096,technique_name=NTFS File Attributes$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1096</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100174" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1105,technique_name=Ingress Tool Transfer$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1105</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100175" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1218.003,technique_name=CMSTP$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100176" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1137,technique_name=Office Application Startup$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1137</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100177" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1218.009,technique_name=Regsvcs/Regasm$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100178" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1007,technique_name=System Service Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1007</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100179" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1089,technique_name=Disabling Security Tools$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1089</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100180" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1005,technique_name=Data from Local System$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1005</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100181" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1098,technique_name=Account Manipulation$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1098</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100182" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1012,technique_name=Query Registry$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1012</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100183" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1036,technique_name=Process Evasion$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1036</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100184" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1036,technique_name=Masquerading$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1036</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100185" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1218.002,technique_name=Control Panel Items$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100186" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1021.006,technique_name=Windows Remote Management$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1021</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100187" level="3">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.ruleName">^technique_id=T1202,technique_name=Remote File Copy$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1202</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100502" level="13">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.image">powershell.exe$|pwsh.exe$</field>
		<field name="win.eventdata.commandLine">ExecutionPolicy Bypass</field>
		<field name="win.eventdata.parentImage" negate="yes">cmd.exe$|explorer.exe$|wazuh-agent.exe$|^C:\\\\Program Files\\\\Windows Defender Advanced Threat Protection\\\\SenseIR.exe$|\\\\Windows\\\\CCM\\\\CcmExec.exe$</field>
		<description>Sysmon - Event 1: PowerShell Execution Policy Bypass detected.</description>
		<mitre>
			<id>T1548</id>
			<id>T1059</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,sysmon_anomaly</group>
	</rule>
	<rule id="100503" level="10">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.image">powershell.exe$|pwsh.exe$</field>
		<field name="win.eventdata.parentImage" negate="yes">cmd.exe$|explorer.exe$|wazuh-agent.exe$</field>
		<description>Sysmon - Event 1: Non Interactive PowerShell Execution detected.</description>
		<mitre>
			<id>T1548</id>
			<id>T1059</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,sysmon_anomaly</group>
	</rule>
	<rule id="100504" level="13">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.image">powershell.exe$|pwsh.exe$</field>
		<field name="win.eventdata.commandLine">Start-BitsTransfer|Invoke-WebRequest|iwr -Uri|WebClient|wget|curl|impacket-smbserver|-urlcache|transfer job</field>
		<description>Sysmon - Event 1: Powershell and Data Transfer detected.</description>
		<mitre>
			<id>T1041</id>
			<id>T1059</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,sysmon_anomaly</group>
	</rule>
	<rule id="100505" level="13">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.image">powershell.exe$|pwsh.exe$</field>
		<field name="win.eventdata.commandLine">ExecutionPolicy Bypass</field>
		<field name="win.eventdata.commandLine">Clear-History</field>
		<description>Sysmon - Event 1: Powershell Clear Command History.</description>
		<mitre>
			<id>T1059</id>
			<id>T1070</id>
			<id>T1548</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,sysmon_anomaly</group>
	</rule>
	<rule id="100506" level="10">
		<if_sid>100105</if_sid>
		<field name="win.eventdata.parentImage">winword\.exe$|excel\.exe$|powerpnt\.exe$|outlook\.exe$|msaccess\.exe$|lync\.exe$|mspub\.exe$|onenote\.exe$</field>
		<description>Possible Follina (CVE-2022-30190) exploitation attempt detected. New process created by a Microsoft Office application.</description>
		<mitre>
			<id>T1203</id>
		</mitre>
	</rule>
	<rule id="100507" level="13">
		<if_sid>100110</if_sid>
		<field name="win.eventdata.parentImage">winword.exe$|excel.exe$|powerpnt.exe$</field>
		<description>Sysmon - Event 1: Process $(win.eventdata.description) - MS RCE Follina Detection.</description>
		<mitre>
			<id>T1204</id>
			<id>T1047</id>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,sysmon_anomaly</group>
	</rule>
	<rule id="100508" level="13">
		<if_sid>100135</if_sid>
		<field name="win.eventdata.parentImage">winword.exe$|excel.exe$|powerpnt.exe$</field>
		<description>Sysmon - Event 1: Process $(win.eventdata.description) - MS RCE Follina Detection.</description>
		<mitre>
			<id>T1204</id>
			<id>T1047</id>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,sysmon_anomaly</group>
	</rule>
	<rule id="100509" level="13">
		<if_sid>100163</if_sid>
		<field name="win.eventdata.parentImage">winword.exe$|excel.exe$|powerpnt.exe$</field>
		<description>Sysmon - Event 1: Process $(win.eventdata.description) - MS RCE Follina Detection.</description>
		<mitre>
			<id>T1204</id>
			<id>T1047</id>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,sysmon_anomaly</group>
	</rule>
	<rule id="100510" level="13">
		<if_sid>100125</if_sid>
		<field name="win.eventdata.commandLine">^cmd.exe /Q /c</field>
		<description>Sysmon - Event 1: Suspicious Activity - Remote Command Line Invoked and Terminated.</description>
		<mitre>
			<id>T1548</id>
			<id>T1059</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,sysmon_anomaly</group>
	</rule>
	<rule id="100511" level="13">
		<if_sid>100112</if_sid>
		<field name="win.eventdata.parentCommandLine">^cmd.exe /Q /c</field>
		<description>Sysmon - Event 1: Suspicious Activity - Command Line Invoked and Terminated.</description>
		<mitre>
			<id>T1548</id>
			<id>T1059</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,sysmon_anomaly</group>
	</rule>
	<rule id="100512" level="13">
		<if_sid>100127</if_sid>
		<field name="win.eventdata.parentCommandLine">^cmd.exe /Q /c powershell.exe</field>
		<description>Sysmon - Event 1: Suspicious Activity - Powershell Command Line Invoked and Terminated.</description>
		<mitre>
			<id>T1548</id>
			<id>T1059</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,sysmon_anomaly</group>
	</rule>
	<rule id="100513" level="13">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.commandLine">cmd.exe /Q /c</field>
		<description>Sysmon - Event 1: Suspicious Activity - Remote Command Line Invoked and Terminated.</description>
		<mitre>
			<id>T1548</id>
			<id>T1059</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,sysmon_anomaly</group>
	</rule>
	<rule id="100514" level="13">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.parentCommandLine">wmiprvse.exe -secured -Embedding$</field>
		<description>Sysmon - Event 1: Suspicious Activity - WMI with -secured Flagged Invoked.</description>
		<mitre>
			<id>T1548</id>
			<id>T1059</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,sysmon_anomaly</group>
	</rule>
	<rule id="100515" level="13">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.commandLine">^powershell.exe -exec bypass</field>
		<description>Sysmon - Event 1: Suspicious Activity - Command with Powershell Exec Bypass detected.</description>
		<mitre>
			<id>T1548</id>
			<id>T1059</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,sysmon_anomaly</group>
	</rule>
	<rule id="100516" level="13">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.parentImage">^C:\\\\Windows\\\\System32\\\\svchost.exe</field>
		<field name="win.eventdata.image">^C:\\\\Windows\\\\System32\\\\winrshost.exe</field>
		<description>Sysmon - Event 1: Suspicious Activity - WinRM Invoked by Svchost.</description>
		<mitre>
			<id>T1548</id>
			<id>T1059</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,sysmon_anomaly</group>
	</rule>
	<rule id="100520" level="15">
		<if_sid>100100</if_sid>
		<field name="win.eventdata.commandLine" type="pcre2">(?i)-k LocalServiceNetworkRestricted -pass</field>
		<description>Lockbit 3.0 Ransomware Launched.</description>
		<mitre>
			<id>T1134</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,windows_sysmon_event1,</group>
	</rule>
	<rule id="100521" level="15">
		<if_sid>100506</if_sid>
		<field name="win.eventdata.originalFileName" type="pcre2">^msdt\.exe$</field>
		<field name="win.eventdata.commandLine" type="pcre2">ms-msdt:(/|-)id.*(PCWDiagnostic|IT_RebrowseForFile|IT_LaunchMethod|SelectProgram)</field>
		<description>Follina (CVE-2022-30190) exploitation attempt detected. MSDT executed with known Follina exploitation pattern.</description>
		<mitre>
			<id>T1203</id>
		</mitre>
	</rule>
	<rule id="100522" level="10">
		<if_group>sysmon_event1</if_group>
		<field name="win.eventdata.commandLine" type="pcre2">(?i)(Invoke-DllInjection|Invoke-WmiCommand|Get-GPPPassword|Get-Keystrokes|Get-VaultCredential|Invoke-CredentialInjection|Invoke-Mimikatz|Invoke-NinjaCopy|Invoke-TokenManipulation|Out-Minidump|VolumeShadowCopyTools|Invoke-ReflectivePEInjection|Get-TimedScreenshot|Invoke-UserHunter|Find-GPOLocation|Invoke-ACLScanner|Invoke-DowngradeAccount|Get-ServiceUnquoted|Get-ServiceFilePermission|Get-ServicePermission|Invoke-ServiceAbuse|Install-ServiceBinary|Get-RegAutoLogon|Get-VulnAutoRun|Get-VulnSchTask|Get-UnattendedInstallFile|Get-WebConfig|Get-ApplicationHost|Get-RegAlwaysInstallElevated|Get-Unconstrained|Add-RegBackdoor|Add-ScrnSaveBackdoor|Gupt-Backdoor|Invoke-ADSBackdoor|Enabled-DuplicateToken|Invoke-PsUaCme|Remove-Update|Check-VM|Get-LSASecret|Get-PassHashes|Show-TargetScreen|Port-Scan|Invoke-PoshRatHttp|Invoke-PowerShellTCP|Invoke-PowerShellWMI|Add-Exfiltration|Add-Persistence|Do-Exfiltration|Start-CaptureServer|Invoke-ShellCode|Get-ChromeDump|Get-ClipboardContents|Get-FoxDump|Get-IndexedItem|Get-Screenshot|Invoke-Inveigh|Invoke-NetRipper|Invoke-EgressCheck|Invoke-PostExfil|Invoke-PSInject|Invoke-RunAs|MailRaider|New-HoneyHash|Set-MacAttribute|Invoke-DCSync|Invoke-PowerDump|Exploit-Jboss|Invoke-ThunderStruck|Invoke-VoiceTroll|Set-Wallpaper|Invoke-InveighRelay|Invoke-PsExec|Invoke-SSHCommand|Get-SecurityPackages|Install-SSP|Invoke-BackdoorLNK|PowerBreach|Get-SiteListPassword|Get-System|Invoke-BypassUAC|Invoke-Tater|Invoke-WScriptBypassUAC|PowerUp|PowerView|Get-RickAstley|Find-Fruit|HTTP-Login|Find-TrustedDocuments|Invoke-Paranoia|Invoke-WinEnum|Invoke-ARPScan|Invoke-PortScan|Invoke-ReverseDNSLookup|Invoke-SMBScanner|Invoke-Mimikittenz)</field>
		<description>Potential Malicious Powershell</description>
		<options>no_full_log</options>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100523" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1546.008,technique_name=Accessibility Features$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1546</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100524" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1546.011,technique_name=Application Shimming$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1546</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100525" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1197,technique_name=BITS Jobs$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1197</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100526" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1548.002,technique_name=Bypass User Access Control$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1548</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100527" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1027,technique_name=Obfuscated Files or Information$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1027</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100528" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1204,technique_name=User Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1204</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100529" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1054,technique_name=Indicator Blocking$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1054</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100530" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1518.001,technique_name=Security Software Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1518</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100531" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1218.004,technique_name=InstallUtil$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100532" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1218.002,technique_name=rundll32.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100533" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1546.008,technique_name=Windows Error Reporting$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1546</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100534" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1033,technique_name=System Owner/User Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1033</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100535" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1016,technique_name=System Network Configuration Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1016</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100536" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1057,technique_name=Process Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1057</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100537" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1049,technique_name=System Network Connections Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1049</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100538" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1018,technique_name=Remote System Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1018</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100539" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1083,technique_name=File and Directory Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1083</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100540" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1134,technique_name=Access Token Manipulation$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1134</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100541" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1112,technique_name=Modify Registry$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1112</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100542" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1063,technique_name=Security Software Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1063</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100543" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1087,technique_name=Account Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1087</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100544" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1070,technique_name=Indicator Removal on Host$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1070</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100545" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1053,technique_name=Scheduled Task$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1053</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100546" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1117,technique_name=Regsvr32$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1117</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100547" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1047,technique_name=Windows Management Instrumentation$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1047</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100548" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1202,technique_name=Indirect Command Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1202</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100549" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1059,technique_name=Command-Line Interface$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1059</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100550" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1086,technique_name=PowerShell$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1086</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100551" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1073,technique_name=DLL Side-Loading$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1073</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100552" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1500,technique_name=Compile After Delivery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1500</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100553" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1216,technique_name=Signed Script Proxy Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1216</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100554" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1170,technique_name=Mshta$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1170</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100555" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1158,technique_name=Hidden Files and DirectoriesHidden Files and Directories$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1158</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100556" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1053,technique_name=Scheduled Tasks$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1053</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100557" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1218,technique_name=Signed Binary Proxy Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100558" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1031,technique_name=Modify Existing Service$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1031</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100559" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1081,technique_name=Credentials in Files$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1081</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100560" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1222,technique_name=File Permissions Modification$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1222</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100561" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1074,technique_name=Data Staged$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1074</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100562" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1490,technique_name=Inhibit System Recovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1490</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100563" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1088,technique_name=Bypass User Account Control$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1088</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100564" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1127,technique_name=Trusted Developer Utilities$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1127</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100565" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1003,technique_name=Credential Dumping$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1003</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100566" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1127,technique_name=dfsvc.exe Making Network Connections$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1127</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100567" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1103,technique_name=Credential Dumping$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1103</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100568" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1105,technique_name=Remote File Copy with Expand$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1105</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100569" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1105,technique_name=Remote File Copy$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1105</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100570" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=1218,technique_name=Signed Binary Proxy Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100571" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1127,technique_name=Trusted Developer Tools$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1127</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100572" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1118,technique_name=InstallUtil$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1118</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100573" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1127,technique_name=Javascript compilation$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1127</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100574" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1218,technique_name=Proxy Execution of unsigned C# Code$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100575" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1218,technique_name=Signed Binary Proxy Execution" condition="is$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100576" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1217,technique_name=Trusted Script Proxy Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1217</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100577" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1218,technique_name=Trusted Script Proxy Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100578" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1216,technique_name=Trusted Script Proxy Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1216</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100579" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1218,technique_name=Trusted Binary Proxy Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100580" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=1086,technique_name=Powershell$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1086</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100581" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1053,technique_name=Scheduled Task/Job$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1053</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100582" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1218.010,technique_name=Regsvr32$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100583" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1059.003,technique_name=Windows Command Shell$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1059</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100584" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1059.001,technique_name=PowerShell$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1059</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100585" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1218.005,technique_name=Mshta$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100586" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1564.001,technique_name=Hidden Files and DirectoriesHidden Files and Directories$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1564</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100587" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1543.003,technique_name=Windows Service$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1543</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100588" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1552.001,technique_name=Credentials in Files$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1552</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100589" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1078,technique_name=Valid Accounts$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1078</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100590" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1040,technique_name=Network Sniffing$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1040</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100591" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=1482,technique_name=Domain Trust Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1482</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100592" level="3">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1482,technique_name=Domain Trust Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1482</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100593" level="10">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1127</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100594" level="10">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1569.002,technique_name=Service Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1569</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100595" level="10">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1096,technique_name=NTFS File Attributes$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1096</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100596" level="10">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1105,technique_name=Ingress Tool Transfer$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1105</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100597" level="10">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1218.003,technique_name=CMSTP$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100598" level="10">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1137,technique_name=Office Application Startup$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1137</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100599" level="10">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1218.009,technique_name=Regsvcs/Regasm$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100600" level="10">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1007,technique_name=System Service Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1007</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100601" level="10">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1089,technique_name=Disabling Security Tools$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1089</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100602" level="10">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1005,technique_name=Data from Local System$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1005</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100603" level="10">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1098,technique_name=Account Manipulation$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1098</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100604" level="10">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1012,technique_name=Query Registry$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1012</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100605" level="10">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1036,technique_name=Process Evasion$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1036</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100606" level="10">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1036,technique_name=Masquerading$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1036</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100607" level="10">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1218.002,technique_name=Control Panel Items$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100608" level="10">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1021.006,technique_name=Windows Remote Management$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1021</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!-- Sysmon - Event 1: Process creation $(win.eventdata.description) -->
	<rule id="100609" level="10">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1202,technique_name=Remote File Copy$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1202</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100610" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1505.002,technique_name=Exchange Transport Agent Installation$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1505</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100611" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1090.003,technique_name=Tor Proxy Usage$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1090</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100612" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1090.003,technique_name=Psiphon Proxy$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1090</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100613" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1560,technique_name=PowerShell Compress-Archive$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1560</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100614" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1110.002,technique_name=Hashcat Password Cracking$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1110</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100615" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1539,technique_name=Steal Web Session Cookie$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1539</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100616" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1003.002,technique_name=PowerShell SAM Dump$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1003</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100617" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1003.002,technique_name=Hive Dump via certutil$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1003</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100618" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1003.002,technique_name=SAM Dump via esentutl$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1003</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100619" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1003.002,technique_name=SAM Dump via reg.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1003</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100620" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1025,technique_name=PowerShell Search Removable Media$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1025</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100621" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1074.001,technique_name=PowerShell Compress-Archive$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1074</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100622" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1074.001,technique_name=PowerShell Download .bat to Temp$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1074</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100623" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1114.001,technique_name=PowerShell Email Collection Get-Inbox.ps1$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1114</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100624" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1114.001,technique_name=PowerShell Email Collection Get-Inbox.ps1$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1114</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100625" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1039,technique_name=CMD copy Admin Share$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1039</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100626" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1039,technique_name=PowerShell copy-item Admin Share$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1039</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100627" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1550.003,technique_name=PsExec used for Pass-the-Ticket$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1550</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100628" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1550.003,technique_name=Rubeus Pass-the-Ticket$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1550</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100629" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1550.003,technique_name=Mimikatz Pass-the-Ticket$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1550</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100630" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1072,technique_name=PDQ Deploy Console Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1072</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100631" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1072,technique_name=Radmin Viewer Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1072</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100632" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1570,technique_name=technique_name=NetUse QUIC$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1570</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100633" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1555.003,technique_name=PowerSharpPack Sharpweb$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1555</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100634" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1555.003,technique_name=Esentutl Chrome Login Dump$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1555</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100635" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1555.003,technique_name=BrowserCollector Executed$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1555</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100636" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1555.003,technique_name=WebBrowserPassView Executed$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1555</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100637" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1048.003,technique_name=PowerShell SMTP Exfil$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1048</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100638" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1048.003,technique_name=ICMP Ping Exfil$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1048</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100639" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1048.003,technique_name=nslookup DNS Exfil$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1048</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100640" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1048.003,technique_name=dig DNS Exfil$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1048</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100641" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1048.003,technique_name=Rclone FTP Upload$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1048</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100642" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1048.003,technique_name=PowerShell FTP Upload$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1048</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100643" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1048.003,technique_name=PowerShell HTTP POST$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1048</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100644" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1048.003,technique_name=Python HTTP Server$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1048</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100645" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1030,technique_name=PowerShell Chunked Upload$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1030</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100646" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1567.002,technique_name=Rclone Cloud Exfiltration$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1567</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100647" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1567.002,technique_name=Pastebin Exfiltration via PowerShell$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1567</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100648" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1070.001,technique_name=VBA Clear Logs$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1070</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100649" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1070.001,technique_name=Remove Logs PowerShell$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1070</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100650" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1070.001,technique_name=Clear Logs via PowerShell$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1070</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100651" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1070.001,technique_name=Clear Event Logs via wevtutil$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1070</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100652" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1134.002,technique_name=Create Process with Token - cmd.exe from LSASS token$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1134</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100653" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1218.008,technique_name=Odbcconf.exe Load .rsp file$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100654" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1218.008,technique_name=Odbcconf.exe REGSVR DLL Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100655" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1562.006,technique_name=Block EDR via NRPT Rule$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1562</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100656" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1562.006,technique_name=Disable PowerShell ETW with logman$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1562</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100657" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1207,technique_name=PsExec Launching DCShadow$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1207</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100658" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1207,technique_name=Mimikatz DCShadow Command$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1207</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100659" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1553.006,technique_name=BCDedit TestSigning Enable$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1553</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100660" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1134.001,technique_name=JuicyPotato Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1134</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100661" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1134.001,technique_name=BadPotato Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1134</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100662" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1134.001,technique_name=NSudo Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1134</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100663" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1134.001,technique_name=Empire Token Duplication$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1134</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100664" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1134.001,technique_name=Named Pipe Client Impersonation$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1134</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100665" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1134.001,technique_name=Unusual Parent for PowerShell$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1134</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100666" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1218.001,technique_name=Any hh.exe Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100667" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1218.001,technique_name=hh.exe via PowerShell$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100668" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1218.001,technique_name=hh.exe Decompile CHM$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100669" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1218.001,technique_name=hh.exe Executing CHM File$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100670" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1070.005,technique_name=Remove Admin Shares via net.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1070</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100671" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1070.005,technique_name=Disable Auto Admin Shares via reg.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1070</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100672" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1070.005,technique_name=Remove Network Share via Remove-FileShare$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1070</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100673" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1070.005,technique_name=Remove Network Share via PowerShell$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1070</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100674" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1070.005,technique_name=Remove Network Share via net.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1070</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100675" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1055.012,technique_name=PowerShell Process Hollowing Start-Hollow.ps1$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1055</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100676" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1564.006,technique_name=Hyper-V Creation via PowerShell$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1564</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100677" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1564.006,technique_name=VirtualBox Activity$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1564</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100678" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1134.005,technique_name=Mimikatz SID-History Injection$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1134</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100679" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1036.003,technique_name=cmd.exe masquerading as lsm.exe in C root$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1036</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100680" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1036.003,technique_name=Windows exe masquerading as svchost.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1036</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100681" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1036.003,technique_name=powershell.exe masquerading as taskhostw.exe in AppData$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1036</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100682" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1036.003,technique_name=wscript.exe masquerading as svchost.exe in AppData$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1036</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100683" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1036.003,technique_name=cscript.exe masquerading as notepad.exe in AppData$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1036</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100684" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1036.003,technique_name=cmd.exe masquerading as lsass.exe in Temp$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1036</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100685" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1553.004,technique_name=Subvert Trust Controls: Install Root Certificate$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1553</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100686" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1127.001,technique_name=MSBuild Executed from AppData"$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1127</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100687" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1127.001,technique_name=MSBuild Execution with .xml"$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1127</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100688" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1127.001,technique_name=MSBuild Execution with .csproj"$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1127</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100689" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1564.003,technique_name=Hidden Conhost Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1564</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100690" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1564.003,technique_name=Headless Browser Execution Edge$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1564</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100691" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1564.003,technique_name=Headless Browser Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1564</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100692" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1564.003,technique_name=PowerShell Hidden Window$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1564</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100693" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1070.004,technique_name=Delete TeamViewer Logs$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1070</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100694" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1070.004,technique_name=Recycle Bin Deletion$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1070</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100695" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1070.004,technique_name=File Deletion via PowerShell$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1070</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100696" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1070.004,technique_name=File Deletion via CMD$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1070</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100697" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1622,technique_name=PowerShell Debugger Checks$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1622</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100698" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1550.002,technique_name=PtH via Invoke-WMIExec$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1550</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100699" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1550.002,technique_name=PtH via CrackMapExec$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1550</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100700" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1550.002,technique_name=PtH via Mimikatz$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1550</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100701" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1129,technique_name=Remove VIB via plink.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1129</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100702" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1129,technique_name=Install VIB via plink.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1129</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100703" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1129,technique_name=Load Component via pscp.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1129</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100704" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1204.002,technique_name=Suspicious LNK File Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1204</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100705" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1204.002,technique_name=Office spawning WScript$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1204</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100706" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1204.002,technique_name=Excel launching CMD$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1204</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100707" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1204.002,technique_name=Word launching PowerShell$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1204</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100708" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1106,technique_name=Shellcode Execution via Syscalls$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1106</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100709" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1106,technique_name=Suspicious Process Creation via Native API$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1106</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100710" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1059.010,technique_name=Compiled AutoHotKey Executable$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1059</id>
		</mitre>
		<options>no_full_log</options>
		<group>syon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100711" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1059.010,technique_name=AutoIT Script Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1059</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100712" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1059.010,technique_name=AutoHotKey Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1059</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100713" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1059.010,technique_name=Python Script Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1059</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100714" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1059.010,technique_name=AutoIt Script Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1059</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100715" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1059.010,technique_name=CScript Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1059</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100716" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1059.010,technique_name=WScript Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1059</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100717" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1059.010,technique_name=CMD Execution of Built-in Tools$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1059</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100718" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1059.010,technique_name=PowerShell Obfuscated Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1059</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100719" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1059.010,technique_name=Command and Scripting Interpreter: PowerShell$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1059</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100720" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1559,technique_name=Named Pipe Client$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1559</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100721" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1559,technique_name=Named Pipe Server$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1559</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100722" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1559,technique_name=Named Pipe Executor$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1559</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100723" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1059.005,technique_name=Office Spawning mshta (Encoded VBS)$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1059</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100724" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1059.005,technique_name=Encoded VBS via Office Macro$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1059</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100725" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1059.005,technique_name=VBScript via cscript.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1059</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100726" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1110.001,technique_name=LDAP Brute Force PowerShell$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1110</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100727" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1110.001,technique_name=AzureAD Brute Force$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1110</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100728" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1110.001,technique_name=Kerbrute Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1110</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100729" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1110.001,technique_name=ESXi SSH Brute Force$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1110</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100730" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1040,technique_name=PowerShell Network Sniffing$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1040</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100731" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1040,technique_name=Pktmon Filter Add$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1040</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100732" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1040,technique_name=Pktmon Capture Start$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1040</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100733" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1040,technique_name=Netsh Trace Start$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1040</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100734" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1040,technique_name=Tshark Packet Capture$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1040</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100735" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1552.002,technique_name=Registry PuTTY Credential Search$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1552</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100736" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1552.002,technique_name=Registry HKCU Credential Search$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1552</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100737" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1552.002,technique_name=Registry HKLM Credential Search$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1552</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100738" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1558.004,technique_name=PowerView Get-DomainUser PreauthNotRequired$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1558</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100739" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1558.004,technique_name=Invoke-Rubeus PowerSharpPack$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1558</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100740" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1558.004,technique_name=Rubeus ASREPRoast$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1558</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100741" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1555,technique_name=Word Credential Dump Macro$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1555</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100742" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1555,technique_name=WinPwn TeamViewer Decrypt$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1555</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100743" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1555,technique_name=WinPwn Wifi Creds$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1555</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100744" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1555,technique_name=LaZagne Credential Theft$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1555</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100745" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1555,technique_name=PowerShell Credential Dump Script$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1555</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100746" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1555,technique_name=vaultcmd Web Credentials$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1555</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100747" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1555,technique_name=vaultcmd Windows Credentials$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1555</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100748" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1552,technique_name=PowerShell History Credential Search$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1552</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100749" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1649,technique_name=PowerShell Certificate Store Enumeration$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1649</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100750" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1649,technique_name=PowerShell Export-Certificate$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1649</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100751" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1552.006,technique_name=PowerShell Download Get-GPPPassword Script$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1552</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100752" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1552.006,technique_name=PowerShell Get-GPPPassword Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1552</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100753" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1552.006,technique_name=GPP findstr cpassword$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1552</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100754" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1056.002,technique_name=PowerShell PromptForCredential Usage$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1056</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100755" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1110.004,technique_name=Kerbrute Credential Stuffing$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1110</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100756" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1187,technique_name=Rpcping Forced Auth Attempt$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1187</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100757" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1187,technique_name=PowerShell Download InternalMonologue$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1187</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100758" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1187,technique_name=PowerShell InternalMonologue$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1187</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100759" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1187,technique_name=PetitPotam Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1187</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100760" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1558.002,technique_name=RunAs NetOnly Session$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1558</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100761" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1558.002,technique_name=Scheduled Tasks Query via Silver Ticket$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1558</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100762" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1558.002,technique_name=Klist Purge Ticket Cleanup$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1558</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100763" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1558.002,technique_name=Mimikatz Silver Ticket Command$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1558</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100764" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1016.001,technique_name=Test-NetConnection SMB$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1016</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100765" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1016.001,technique_name=Test-NetConnection HTTP$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1016</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100766" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1016.001,technique_name=Test-NetConnection ICMP$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1016</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100767" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1016.001,technique_name=Ping Internet Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1016</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100768" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1615,technique_name=PowerShell Get-GPO Cmdlet$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1615</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100769" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1615,technique_name=WinPwn GPORemoteAccessPolicy$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1615</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100770" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1615,technique_name=WinPwn GPOAudit Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1615</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100771" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1615,technique_name=Download PowerView Script$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1615</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100772" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1615,technique_name=PowerView Get-DomainGPO$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1615</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100773" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1615,technique_name=gpresult Group Policy Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1615</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100774" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1652,technique_name=DriverQuery Signed Driver Info$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1652</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100775" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1652,technique_name=DriverQuery Verbose Output$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1652</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100776" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1087.002,technique_name=Wevtutil NTLM Export$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1087</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100777" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1087.002,technique_name=Kerbrute userenum$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1087</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100778" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1087.002,technique_name=AdFind Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1087</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100779" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1087.002,technique_name=ADRecon.ps1 Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1087</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100780" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1087.002,technique_name=PowerView Get-DomainUser Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1087</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100781" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1087.002,technique_name=PowerShell ADSISearcher Enumeration$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1087</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100782" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1087.002,technique_name=PowerShell Get-ADComputer Enumeration$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1087</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100783" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1087.002,technique_name=PowerShell ADUser/Computer Enumeration$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1087</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100784" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1087.002,technique_name=query user via server$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1087</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100785" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1087.002,technique_name=net group domain$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1087</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100786" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1087.002,technique_name=net user domain$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1087</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100787" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1087.002,technique_name=Logged On User Discovery via query.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1087</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100788" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1087.002,technique_name=PowerShell Users Folder Enumeration$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1087</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100789" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1087.002,technique_name=Local Account Folder Listing$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1087</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100790" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1087.002,technique_name=Credential Enumeration via cmdkey$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1087</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100791" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1087.002,technique_name=Local Group Member Discovery via PowerShell cmdlets$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1087</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100792" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1087.001,technique_name=Local Account Discovery via PowerShell cmdlets$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1087</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100793" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1087.001,technique_name=Local Group Discovery via net.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1087</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100794" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1087.001,technique_name=Local Account Discovery via net.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1087</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100795" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1497.001,technique_name=Virtualization Check via WMI Temperature$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1497</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100796" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1497.001,technique_name=Virtualization Check via WMI Model/Manufacturer$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1497</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100797" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1497.001,technique_name=Suspicious PowerShell Virtualization Check$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1497</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100798" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1069.002,technique_name=Group Discovery via ADSISearcher$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1069</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100799" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1069.002,technique_name=Group Discovery via ldifde.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1069</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100800" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1069.002,technique_name=Group Discovery via AdFind$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1069</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100801" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1069.002,technique_name=Group Discovery via PowerView$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1069</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100802" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1069.002,technique_name=Group Discovery via PowerShell Get-AD*$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1069</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100803" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1135,technique_name=Snaffler.exe execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1135</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100804" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1135,technique_name=SharpShares.exe execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1135</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100805" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1135,technique_name=WinPwn shareenumeration$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1135</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100806" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1135,technique_name=PowerView Invoke-ShareFinder$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1135</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100807" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1135,technique_name=PowerView Find-DomainShare$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1135</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100808" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1135,technique_name=dir ip for share discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1135</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100809" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1135,technique_name=get-smbshare PowerShell cmdlet$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1135</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100810" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1135,technique_name=net share usage$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1135</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100811" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1135,technique_name=net view usage$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1135</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100812" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1120,technique_name=FSUTIL Drives Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1120</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100813" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1120,technique_name=WinPwn Printercheck$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1120</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100814" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1120,technique_name=Get-Printer Peripheral Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1120</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100815" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1120,technique_name=Get-WMIObject Peripheral Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1120</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100816" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1082,technique_name=PowerShell OS Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1082</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100817" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1082,technique_name=PowerShell GDR Enumeration$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1082</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100818" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1082,technique_name=VSSADMIN Shadow Copy Enumeration$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1082</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100819" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1082,technique_name=Griffon Recon Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1082</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100820" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1082,technique_name=Execution of set command$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1082</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100821" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1082,technique_name=Execution of hostname$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1082</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100822" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1082,technique_name=Query CurrentBuildNumber from Registry$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1082</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100823" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1082,technique_name=Query ProductName from Registry$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1082</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100824" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1082,technique_name=Execution of ver command$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1082</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100825" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1082,technique_name=Execution of WMIC Commands$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1082</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100826" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1082,technique_name=Query MachineGUID$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1082</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100827" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1082,technique_name=Query Disk Enum Registry Key$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1082</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100828" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1082,technique_name=Execution of systeminfo$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1082</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100829" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1016.002,technique_name=netsh wlan profile dump$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1016</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100830" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1010,technique_name=csc.exe Used to Compile Window Discovery Tool$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1010</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100831" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1217,technique_name=CMD Recursive Where Firefox$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1217</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100832" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1217,technique_name=CMD Recursive Where Bookmark$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1217</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100833" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1217,technique_name=PowerShell Bookmark File Search$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1217</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100834" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1217,technique_name=PowerShell Extract Edge History$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1217</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100835" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1217,technique_name=PowerShell Extract Chrome History$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1217</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100836" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1217,technique_name=CMD Favorites Folder Scan$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1217</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100837" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1482,technique_name=nltest trusted_domains$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1482</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100838" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1482,technique_name=nltest domain_trusts$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1482</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100839" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1482,technique_name=dsquery domain trust discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1482</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100840" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1482,technique_name=PowerShell DirectoryServices Trusts$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1482</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100841" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1482,technique_name=PowerShell Get-ForestTrust$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1482</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100842" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1482,technique_name=PowerShell Get-NetDomainTrust$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1482</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100843" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1482,technique_name=AdFind OU enumeration$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1482</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100844" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1482,technique_name=AdFind trust enumeration$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1482</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100845" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1482,technique_name=TruffleSnout domain enumeration$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1482</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100846" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1482,technique_name=TruffleSnout forest enumeration$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1482</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100847" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1005,technique_name=PowerShell File Search$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1005</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100848" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1005,technique_name=PowerShell Compress-Archive$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1005</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100849" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1003.004,technique_name=Mimikatz execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1003</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100850" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1003.004,technique_name=PowerShell Add-Type LSA abuse$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1003</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100851" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1003.004,technique_name=PowerShell dumper.ps1 usage$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1003</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100852" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1003.004,technique_name=PsExec dumping LSA secrets$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1003</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100853" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1016,technique_name=DNS controller discovery with nslookup$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1016</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100854" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1016,technique_name=Qakbot recon batch execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1016</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100855" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1016,technique_name=AdFind subnet enumeration$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1016</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100856" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1016,technique_name=NLTEST domain trusts$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1016</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100857" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1016,technique_name=TrickBot style network discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1016</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100858" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1016,technique_name=Show all firewall rules$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1016</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100859" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1016,technique_name=NET CONFIG usage$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1016</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100860" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1016,technique_name=NETSH interface show$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1016</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100861" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1016,technique_name=NBTSTAT execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1016</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100862" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1016,technique_name=ARP command execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1016</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100863" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1016,technique_name=IPConfig execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1016</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100864" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1083,technique_name=ESXi file enumeration via plink$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1083</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100865" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1083,technique_name=DirLister tool execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1083</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100866" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1083,technique_name=PowerShell MAZE-style folder discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1083</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100867" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1083,technique_name=PowerShell gci recursive$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1083</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100868" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1083,technique_name=PowerShell ls recursive$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1083</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100869" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1083,technique_name=PowerShell Get-ChildItem recursive$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1083</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100870" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1083,technique_name=CMD TREE command$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1083</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100871" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1083,technique_name=CMD DIR enumeration$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1083</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100872" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1557.001,technique_name=PowerShell GitHub Inveigh$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1557</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100873" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1557.001,technique_name=PowerShell Download Inveigh Script$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1557</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100874" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1557.001,technique_name=PowerShell Inveigh Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1557</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100875" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1021.003,technique_name=DCOM Spawned Process - foxprow.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1021</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100876" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1021.003,technique_name=DCOM Spawned Process - calc.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1021</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100877" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1021.003,technique_name=PowerShell Excel DCOM Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1021</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100878" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1021.003,technique_name=PowerShell MMC20 DCOM Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1021</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100879" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1563.002,technique_name=RDP Hijacking via Service Start$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1563</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100880" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1563.002,technique_name=RDP Hijacking via sc.exe Service Creation$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1563</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100881" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1563.002,technique_name=RDP Hijacking Using tscon$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1563</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100882" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1021.001,technique_name=Disable NLA for RDP via Registry$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1021</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100883" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1021.001,technique_name=Open Firewall for Custom RDP Port via netsh$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1021</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100884" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1021.001,technique_name=Change RDP Port via reg.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1021</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100885" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1021.001,technique_name=Open Firewall for Custom RDP Port via PowerShell$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1021</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100886" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1021.001,technique_name=Change RDP Port via PowerShell$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1021</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100887" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1021.001,technique_name=RDP Session Initiation Using mstsc$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1021</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100888" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1021.001,technique_name=RDP Login Using cmdkey$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1021</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100889" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1552.004,technique_name=Certificate Dumping with mimikatz$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1552</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100890" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1552.004,technique_name=Export-Certificate PowerShell Cmdlet$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1552</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100891" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1552.004,technique_name=Export-PfxCertificate PowerShell Cmdlet$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1552</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100892" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1552.004,technique_name=Certificate Export using certutil.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1552</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100893" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1552.004,technique_name=ADFS Certificate Export via AADInternals (Remote)$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1552</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100894" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1552.004,technique_name=ADFS Certificate Export via AADInternals (Local)$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1552</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100895" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1552.004,technique_name=File Search for Private Keys via cmd$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1552</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100896" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1003.001,technique_name=Dump LSASS via Silent Process Exit (NanoDump)$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1003</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100897" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1003.001,technique_name=Dump LSASS with rdrleakdiag.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1003</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100898" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1003.001,technique_name=Dump LSASS with xordump.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1003</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100899" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1003.001,technique_name=Dump LSASS using createdump.exe (.NET)$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1003</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100900" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1003.001,technique_name=PowerShell Mimikatz DumpCreds$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1003</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100901" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1003.001,technique_name=Dump LSASS using procdump -mm$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1003</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100902" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1003.001,technique_name=Dump LSASS with Out-Minidump.ps1$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1003</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100903" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1003.001,technique_name=LSASS Read with pypykatz$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1003</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100904" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1003.001,technique_name=Analyze LSASS Dump with mimikatz.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1003</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100905" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1003.001,technique_name=Dump LSASS with Task Manager$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1003</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100906" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1003.001,technique_name=Dump LSASS with nanodump.x64.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1003</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100907" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1003.001,technique_name=Dump LSASS with Dumpert$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1003</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100908" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1003.001,technique_name=Dump LSASS with comsvcs.dll$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1003</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100909" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1003.001,technique_name=Dump LSASS with procdump.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1003</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100910" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1110.003,technique_name=Password Spray with kerbrute.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1110</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100911" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1110.003,technique_name=Lightweight Domain Password Spray (usersdpsLight.txt)$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1110</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100912" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1110.003,technique_name=WinPwn DomainPasswordSpray Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1110</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100913" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1110.003,technique_name=LDAP Password Spray via Get-ADUser$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1110</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100914" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1110.003,technique_name=DomainPasswordSpray.ps1 Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1110</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100915" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1110.003,technique_name=Password Spray with net use IPC$ (FOR loop)$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1110</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100916" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1003.005,technique_name=List Cached Credentials via cmdkey.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1003</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100917" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1558.001,technique_name=Ticket Injection with rubeus.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1558</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100918" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1558.001,technique_name=Golden Ticket Attack with rubeus.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1558</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100919" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1558.001,technique_name=Ticket Injection with mimikatz.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1558</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100920" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1558.001,technique_name=Golden Ticket Attack with mimikatz.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1558</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100921" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1552.001,technique_name=SessionGopher launched via PowerShell$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1552</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100922" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1552.001,technique_name=WinPwn execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1552</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100923" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1552.001,technique_name=PowerShell Credential Files Access$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1552</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100924" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1552.001,technique_name=access unattend.xml credentials$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1552</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100925" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1552.001,technique_name=powershell grep-like search for password$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1552</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100926" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1552.001,technique_name=findstr looking for credentials in documents$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1552</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100927" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1552.001,technique_name=findstr extracting passwords$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1552</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100928" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1003.003,technique_name=Copy SYSTEM hive from VSC$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1003</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100929" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1003.003,technique_name=Copy ntds.dit from VSC$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1003</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100930" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1003.003,technique_name=mklink to shadow copy$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1003</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100931" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1003.003,technique_name=ntdsutil ifm dump$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1003</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100932" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1003.003,technique_name=diskshadow execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1003</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100933" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1003.003,technique_name=esentutl dumping ntds$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1003</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100934" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1003.003,technique_name=powershell shadowcopy$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1003</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100935" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1003.003,technique_name=wmic create shadow copy$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1003</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100936" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1003.003,technique_name=vssadmin create shadow copy$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1003</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100937" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1558.003,technique_name=PowerSharpPack Rubeus Kerberoasting$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1558</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100938" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1558.003,technique_name=WinPwn Kerberoasting$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1558</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100939" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1558.003,technique_name=Kerberoasting using setspn.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1558</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100940" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1558.003,technique_name=Rubeus Kerberoasting$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1558</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100941" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1558.003,technique_name=PowerShell Invoke-Kerberoast$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1558</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100942" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1003.006,technique_name=DSInternals Get-ADReplAccount$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1003</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100943" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1003.006,technique_name=Mimikatz DCSync Attack$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1003</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100944" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1056.004,technique_name=PowerShell TLS Credential Hooking$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1056</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100945" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1056.004,technique_name=DLL Injection with mavinject$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1056</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100946" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1007,technique_name=PowerShell Get-Service Enumeration$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1007</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100947" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1007,technique_name=net.exe start Service List$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1007</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100948" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1007,technique_name=Tasklist Service View$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1007</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100949" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1007,technique_name=SC Query Services$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1007</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100950" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1654,technique_name=Wevtutil Log Enumeration$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1654</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100951" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1654,technique_name=PowerShell Get-EventLog Enumeration$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1654</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100952" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1069.001,technique_name=WMIC group enumeration$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1069</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100953" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1069.001,technique_name=PowerShell WMIObject Win32_Group$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1069</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100954" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1069.001,technique_name=PowerShell Get-LocalGroupMember$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1069</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100955" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1069.001,technique_name=PowerShell Get-LocalGroup$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1069</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100956" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1069.001,technique_name=net.exe local group enumeration$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1069</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100957" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1201,technique_name=secedit.exe export security policy$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1201</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100958" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1201,technique_name=PowerShell Get-ADDefaultDomainPasswordPolicy$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1201</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100959" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1201,technique_name=PowerShell Get-DomainPolicy (PowerView)$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1201</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100960" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1201,technique_name=net.exe domain password policy$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1201</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100961" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1201,technique_name=net.exe local password policy$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1201</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100962" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1614.001,technique_name=PowerShell Language and Culture Info$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1614</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100963" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1614.001,technique_name=PowerShell Get-WinSystemLocale$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1614</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100964" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1614.001,technique_name=WMIC Locale Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1614</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100965" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1614.001,technique_name=dism.exe Intl Language Info$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1614</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100966" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1614.001,technique_name=chcp Language Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1614</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100967" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1614.001,technique_name=Registry Language Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1614</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100968" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1012,technique_name=PowerShell COM Object Enumeration$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1012</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100969" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1012,technique_name=PowerShell Registry Enumeration$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1012</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100970" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1012,technique_name=reg.exe SystemStartOptions query$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1012</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100971" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1012,technique_name=reg.exe SIL CollectionState query$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1012</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100972" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1012,technique_name=reg.exe AlwaysInstallElevated query$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1012</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100973" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1012,technique_name=reg.exe generic query$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1012</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100974" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1614,technique_name=curl.exe generic external IP lookup$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1614</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100975" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1614,technique_name=curl.exe geolocation query via public IP API$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1614</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100976" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1518.001,technique_name=Firewall rule enumeration via powershell$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1518</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100977" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1518.001,technique_name=Windows Defender status inspection$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1518</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100978" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1518.001,technique_name=fltmc.exe sysmon driver discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1518</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100979" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1518.001,technique_name=Defender exclusion check via wmic$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1518</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100980" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1518.001,technique_name=wmic.exe AV product enumeration$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1518</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100981" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1518.001,technique_name=powershell.exe querying for AV processes$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1518</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100982" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1518.001,technique_name=tasklist.exe checking AV software$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1518</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100983" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1518.001,technique_name=netsh.exe firewall discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1518</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100984" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1018,technique_name=Netscan Tool Usage$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1018</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100985" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1018,technique_name=Get-WmiObject DS_Computers$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1018</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100986" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1018,technique_name=PowerView Get-DomainController$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1018</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100987" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1018,technique_name=PowerShell Get-AdComputer Enumeration$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1018</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100988" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1018,technique_name=PowerShell ADSISearcher Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1018</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100989" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1018,technique_name=PowerShell DirectorySearcher Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1018</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100990" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1018,technique_name=AdFind Domain Controller Enumeration$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1018</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100991" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1018,technique_name=AdFind Computer Enumeration$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1018</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100992" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1018,technique_name=PowerShell nslookup sweep$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1018</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100993" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1018,technique_name=ARP Cache Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1018</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100994" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1018,technique_name=Ping sweep with for loop$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1018</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100995" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1018,technique_name=Remote System Discovery via nltest$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1018</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100996" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1018,technique_name=net group Domain Computers$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1018</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100997" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1018,technique_name=Remote Discovery via net view$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1018</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100998" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1046,technique_name=WinPwn Web App Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1046</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="100999" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1046,technique_name=WinPwn BlueKeep Scan$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1046</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101000" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1046,technique_name=WinPwn MS17-10 Scan$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1046</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101001" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1046,technique_name=PowerShell RDP Services Check$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1046</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101002" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1046,technique_name=PowerShell Subnet Port Scan$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1046</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101003" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1046,technique_name=WinPwn Spool Vulnerability Scan$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1046</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101004" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1046,technique_name=Python Port Scanner$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1046</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101005" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1046,technique_name=Netcat Port Scan$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1046</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101006" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1046,technique_name=Telnet Port Scan$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1046</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101007" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1046,technique_name=PowerShell Nmap Scan$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1046</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101008" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1518,technique_name=WinPwn powerSQL Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1518</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101009" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1518,technique_name=WinPwn DotNet Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1518</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101010" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1518,technique_name=WinPwn Dotnetsearch Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1518</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101011" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1518,technique_name=PowerShell Query 32-bit Software$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1518</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101012" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1518,technique_name=PowerShell Query Installed Software$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1518</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101013" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1518,technique_name=IE Version Registry Query$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1518</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101014" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1124,technique_name=w32tm delay tactic$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1124</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101015" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1124,technique_name=Registry TimeZone Discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1124</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101016" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1124,technique_name=Windows time command execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1124</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101017" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1124,technique_name=Get-Date PowerShell system time$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1124</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101018" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1124,technique_name=w32tm timezone discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1124</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101019" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1124,technique_name=net time discovery$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1124</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101020" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1489,technique_name=Kill service process using taskkill$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1489</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101021" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1489,technique_name=Stop service using net.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1489</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101022" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1489,technique_name=Stop service using sc.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1489</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101023" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1491.001,technique_name=ESXi DCUI Defacement via plink$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1491</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101024" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1491.001,technique_name=Modify LegalNotice Registry Text$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1491</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101025" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1491.001,technique_name=Modify LegalNotice Registry$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1491</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101026" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1491.001,technique_name=Change Wallpaper via PowerShell$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1491</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101027" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1531,technique_name=Azure AD User Deletion PowerShell$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1531</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101028" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1531,technique_name=Remove from Domain Admins (PowerShell)$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1531</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101029" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1531,technique_name=Delete User with net.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1531</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101030" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1531,technique_name=Change Password with net.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1531</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101031" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1486,technique_name=DiskCryptor Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1486</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101032" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1486,technique_name=GPG4Win File Encryption$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1486</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101033" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1485,technique_name=Plink ESXi Snapshot Delete$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1485</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101034" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1485,technique_name=Cipher Wipe Deleted Files$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1485</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101035" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1485,technique_name=SDelete Overwrite$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1485</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101036" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1490,technique_name=Modify VSS Permissions$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1490</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101037" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1490,technique_name=Resize Shadow Storage$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1490</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101038" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1490,technique_name=Disable System Restore (Registry)$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1490</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101039" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1490,technique_name=Disable SR Scheduled Task$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1490</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101040" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1490,technique_name=Delete System State Backup$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1490</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101041" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1490,technique_name=Delete Backup Files$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1490</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101042" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1490,technique_name=Disable Recovery Console$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1490</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101043" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1490,technique_name=Delete Backup Catalog$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1490</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101044" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1490,technique_name=Delete Shadows via wmic$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1490</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101045" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1490,technique_name=Delete Shadows via vssadmin$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1490</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101046" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1529,technique_name=System Logoff$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1529</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101047" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1529,technique_name=System Restart$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1529</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101048" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1529,technique_name=System Shutdown$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1529</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101049" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1566.002,technique_name=PowerShell Encoded Command (Paste and Run)$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1566</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101050" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1195,technique_name=Suspicious Scheduled Task Named ExplorerSync$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1195</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101051" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1195,technique_name=javaw.exe Running Suspicious JAR from Temp$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1195</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101052" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1078.001,technique_name=RDP Access Enabled via Registry$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1078</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101053" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1078.001,technique_name=Guest Added to Administrators$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1078</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101054" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1078.001,technique_name=Guest Account Activated$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1078</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101055" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1078.001,technique_name=PowerShell WinPwn Credential Dump$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1078</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101056" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1078.001,technique_name=Add User to Administrators Group$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1078</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101057" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1078.001,technique_name=Create Local User (net user)$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1078</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101058" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1020,technique_name=PowerShell File Creation for Exfil$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1020</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101059" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1020,technique_name=PowerShell FTP Credential Use$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1020</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101060" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1020,technique_name=PowerShell FTP Exfiltration$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1020</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101061" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1020,technique_name=HTTP PUT via PowerShell$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1020</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101062" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1048.002,technique_name=wget.exe HTTPS exfiltration using --post-data$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1048</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101063" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1048.002,technique_name=wget.exe HTTPS exfiltration using --post-file$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1048</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101064" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1048.002,technique_name=curl.exe file upload to HTTPS$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1048</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101065" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1041,technique_name=DNS tunneling via Resolve-DnsName$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1041</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101066" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1041,technique_name=PowerShell HTTP POST to C2$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1041</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101067" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1048,technique_name=dig DNS Exfiltration$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1048</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101068" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1048,technique_name=DNSExfiltrator PowerShell$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1048</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101069" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1048,technique_name=Exfiltration via SSH$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1048</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101070" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1218.011,technique_name=Rundll32 RouteTheCall$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101071" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1218.011,technique_name=Rundll32 with .scr screensaver$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101072" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1218.011,technique_name=Rundll32 with ordinal$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101073" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1218.011,technique_name=Rundll32 Control_RunDLL$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101074" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1218.011,technique_name=Rundll32 URL.dll FileProtocolHandler$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101075" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1218.011,technique_name=Rundll32 ieadvpack.dll$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101076" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1218.011,technique_name=Rundll32 LaunchINFSection$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101077" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1218.011,technique_name=Rundll32 VBScript Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101078" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1218.011,technique_name=Rundll32 JavaScript GetObject$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101079" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1216.001,technique_name=Pubprn.vbs remote script execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1216</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101080" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1006,technique_name=Direct Volume Access PowerShell$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1006</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101081" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1036.007,technique_name=Execution of disguised script .ps1$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1036</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101082" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1036.007,technique_name=Execution of .vbs with Office/Image prefix$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1036</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101083" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1036.007,technique_name=Execution of disguised PDF EXE$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1036</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101084" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1036.007,technique_name=Execution of double extension file$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1036</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101085" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1036.005,technique_name=Execution of fake system binary$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1036</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101086" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1564,technique_name=Create user with $ symbol$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1564</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101087" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1564,technique_name=Create user with trailing space$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1564</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101088" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1564,technique_name=Hidden service via sc.exe sdset$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1564</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101089" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1564,technique_name=NirCmd execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1564</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101090" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1562.009,technique_name=Safe Mode via bcdedit$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1562</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101091" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1222.001,technique_name=SubInAcl execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1222</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101092" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1222.001,technique_name=Attrib usage to remove read-only$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1222</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101093" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1222.001,technique_name=Attrib usage to hide or unprotect files$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1222</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101094" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1222.001,technique_name=File ACL modification via icacls.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1222</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101095" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1222.001,technique_name=Ownership change via takeown.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1222</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101096" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1218.007,technique_name=Msiexec executing DLL unregister$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101097" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1218.007,technique_name=Msiexec executing DLL register/unregister$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101098" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1218.007,technique_name=Msiexec fetching remote MSI$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101099" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1218.007,technique_name=Msiexec executing local MSI$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1218</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101100" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1070.003,technique_name=PowerShell Clear-History cmdlet$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1070</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101101" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1070.003,technique_name=PowerShell AddToHistoryHandler override$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1070</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101102" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1070.003,technique_name=Disable PS history logging (SaveNothing)$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1070</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101103" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1140,technique_name=Renamed Certutil Encode$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1140</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101104" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1140,technique_name=Renamed Certutil Usage$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1140</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101105" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1140,technique_name=Certutil Encode$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1140</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101106" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1140,technique_name=Certutil Decode$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1140</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101107" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1562,technique_name=reg.exe Disable LSA Protection$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1562</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101108" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1070.006,technique_name=PowerShell AccessTime$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1070</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101109" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1070.006,technique_name=PowerShell ModifyTime$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1070</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101110" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1070.006,technique_name=PowerShell Timestomp Command$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1070</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101111" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1562.002,technique_name=Use of Phant0m Script$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1562</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101112" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1562.002,technique_name=Stop EventLog Service$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1562</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101113" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1562.002,technique_name=Disable EventLog Service$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1562</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101114" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1562.002,technique_name=Disable Logging with wevtutil$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1562</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101115" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1562.002,technique_name=Disable Logging Tools$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1562</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101116" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1562.004,technique_name=PowerShell Add Firewall Rule$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1562</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101117" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1562.004,technique_name=netsh add firewall rule$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1562</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101118" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1562.004,technique_name=netsh enable SMB/RDP$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1562</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101119" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1562.004,technique_name=netsh disable firewall$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1562</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101120" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1574.008,technique_name=Suspicious Execution of Get-Variable.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1574</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101121" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1484.001,technique_name=Group Policy Reg Change via PowerShell$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1484</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101122" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1484.001,technique_name=Group Policy Reg Change via reg.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1484</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101123" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1547.003,technique_name=TimeProvider Persistence via Reg.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1547</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101124" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1547.003,technique_name=TimeProvider Persistence via PowerShell/Reg$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1547</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101125" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1546.012,technique_name=IFEO Reg Injection via PowerShell$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1546</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101126" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1546.012,technique_name=IFEO Reg Injection via CMD$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1546</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101127" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1055.004,technique_name=Suspicious Child Process Spawned$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1055</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101128" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1055.004,technique_name=APC Injection Tools Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1055</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101129" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1546.003,technique_name=WMI MOF Compilation$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1546</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101130" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1546.003,technique_name=WMI Persistence Tools Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1546</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101131" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1562.010,technique_name=PowerShell v2 with Suspicious Command$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1562</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101132" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1562.010,technique_name=PowerShell Version 2 Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1562</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101133" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1562.010,technique_name=PowerShell AMSI/Logging Bypass Keywords$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1562</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101134" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1562.001,technique_name=AMSI Bypass via PowerShell$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1562</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101135" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1562.001,technique_name=Registry tampering via reg.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1562</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101136" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1562.001,technique_name=Disable Defender via DISM or OptionalFeature$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1562</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101137" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1562.001,technique_name=Disable Defender via MpCmdRun.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1562</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101138" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1562.001,technique_name=Uninstall Sysmon$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1562</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101139" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1562.001,technique_name=Disable Defender via sc.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1562</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101140" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1562.001,technique_name=Disable Windows Defender (PowerShell)$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1562</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101141" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1562.001,technique_name=Delete Defender Scheduled Tasks$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1562</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101142" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1027.007,technique_name=Suspicious Process Using Dynamic API Resolution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1027</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101143" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1220,technique_name=WMIC XSL Script Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1220</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101144" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1220,technique_name=MSXSL XSL Script Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1220</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101145" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1564.001,technique_name=Hidden or System File via PowerShell$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1564</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101146" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1564.001,technique_name=Hidden or System File via attrib.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1564</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101147" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1564.004,technique_name=ADS Creation via powershell.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1564</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101148" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1564.004,technique_name=ADS Creation via reg.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1564</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101149" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1564.004,technique_name=ADS Creation via certutil or makecab$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1564</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101150" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1564.004,technique_name=ADS Creation via cmd utilities$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1564</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101151" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1574.012,technique_name=CLR Process Trigger (Event Viewer)$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1574</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101152" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1574.012,technique_name=CLR Process Trigger (User/Proc Scope)$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1574</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101153" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1548.002,technique_name=SilentCleanup Task Trigger$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1548</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101154" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1548.002,technique_name=WSReset.exe UAC Bypass$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1548</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101155" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1548.002,technique_name=computerdefaults.exe UAC Bypass$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1548</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101156" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1548.002,technique_name=sdclt.exe UAC Bypass$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1548</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101157" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1548.002,technique_name=fodhelper.exe UAC Bypass$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1548</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101158" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1548.002,technique_name=eventvwr.exe UAC Bypass$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1548</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101159" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1574.001,technique_name=KeyScrambler.exe DLL Sideloading$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1574</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101160" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1574.001,technique_name=dotnet.exe with DOTNET_STARTUP_HOOKS$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1574</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101161" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1574.001,technique_name=GUP.exe DLL Sideloading$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1574</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101162" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1574.001,technique_name=PowerShell renamed to updater.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1574</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101163" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1055.003,technique_name=InjectContext.exe Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1055</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101164" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1547.009,technique_name=.lnk shortcut executed$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1547</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101165" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1547.009,technique_name=.url shortcut executed$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1547</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101166" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1574.008,technique_name=Executed fake Get-Variable.exe in WindowsApps$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1574</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101167" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1098,technique_name=Password Policy Check - Set-ADAccountPassword$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1098</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101168" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1098,technique_name=Sync DSRM Password$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1098</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101169" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1098,technique_name=Create Domain Account$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1098</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101170" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1098,technique_name=Add Domain User to Group$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1098</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101171" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1098,technique_name=Modify Local Account Description$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1098</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101172" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1098,technique_name=Rename Administrator Account$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1098</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101173" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1055.015,technique_name=ListPlanting Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1055</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101174" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1037.001,technique_name=Reg.exe setting UserInitMprLogonScript$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1037</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101175" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1176,technique_name=Chrome Extension Loaded via Command Line$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1176</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101176" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1546.011,technique_name=Shim Installation with sdbinst.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1546</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101177" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1505.003,technique_name=xcopy Web Shell to IIS Path$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1505</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101178" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1136.001,technique_name=dscl User Creation on macOS$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1136</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101179" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1136.001,technique_name=Pw Useradd on FreeBSD$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1136</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101180" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1136.001,technique_name=Useradd on Linux$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1136</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101181" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1136.001,technique_name=Download and Execute PowerShell Admin Script$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1136</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101182" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1136.001,technique_name=Remove Local User via PowerShell$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1136</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101183" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1136.001,technique_name=Create Local Account via PowerShell$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1136</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101184" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1136.001,technique_name=Add User to Administrators via net.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1136</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101185" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1136.001,technique_name=Create Local Account via net.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1136</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101186" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1136.001,technique_name=LDAP User Removal (Cleanup)$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1136</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101187" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1136.001,technique_name=LDAP Domain User Creation (Non-Elevated)$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1136</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101188" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1136.001,technique_name=LDAP Domain Admin Account Creation$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1136</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101189" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1136.001,technique_name=Create Domain User via PowerShell$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1136</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101190" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1136.001,technique_name=Create Domain Admin User via net.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1136</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101191" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1547.001,technique_name=Startup Payload Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1547</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101192" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1505.004,technique_name=PowerShell IIS Module$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1505</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101193" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1505.004,technique_name=AppCmd Module Install$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1505</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101194" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1546.008,technique_name=Setup.exe Trigger$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1546</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101195" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1547.008,technique_name=LSASS Targeted Process Creation$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1547</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101196" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1132.001,technique_name=Suspicious PowerShell XOR$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1132</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101197" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1071.004,technique_name=PowerShell DNS C2 Script Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1071</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101198" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1071,technique_name=Telnet C2 Client Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1071</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101199" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1219,technique_name=PowerShell Download of RAT Tool$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1219</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101200" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1219,technique_name=Remote Access Tool Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1219</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101201" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1572,technique_name=ngrok Tunnel Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1572</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101202" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1572,technique_name=PowerShell DoH Beaconing$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1572</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101203" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1571,technique_name=PowerShell Test-NetConnection Unusual Port$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1571</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101204" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1095,technique_name=Netcat Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1095</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101205" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1095,technique_name=PowerShell C2 Scripts$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1095</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101206" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1071.001,technique_name=Curl with Suspicious User-Agent$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1071</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101207" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1071.001,technique_name=PowerShell with Suspicious User-Agent$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1071</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101208" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1001.002,technique_name=PowerShell with Extract-Invoke-PSImage$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1001</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<rule id="101209" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1001.002,technique_name=PowerShell Creating Tar File$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1001</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101210" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1090.001,technique_name=PortProxy Setup via Netsh$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1090</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101211" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1560.001,technique_name=Makecab Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1560</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101212" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1560.001,technique_name=7-Zip Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1560</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101213" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1560.001,technique_name=WinZIP Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1560</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101214" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1560.001,technique_name=WinRAR Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1560</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101215" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1113,technique_name=PowerShell CopyFromScreen$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1113</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101216" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1113,technique_name=PSR Screenshot Capture$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1113</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101217" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1056.001,technique_name=PowerShell Keylogger Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1056</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101218" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1553.005,technique_name=PowerShell MOTW Bypass Unblock-File$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1553</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101219" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1553.005,technique_name=Execute from ISO$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1553</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101220" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1553.005,technique_name=Mount ISO via PowerShell$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1553</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101221" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1555.004,technique_name=PowerShell Invoke-WCMDump$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1555</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101222" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1555.004,technique_name=VaultCmd Credential Access$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1555</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101223" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1036.004,technique_name=Suspicious Service Creation with sc$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1036</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101224" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1036.004,technique_name=Suspicious Task Creation with schtasks$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1036</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101225" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1546,technique_name=Setup.exe Triggered Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1546</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101226" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1546,technique_name=Suspicious PowerShell Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1546</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
		<!--  -->
	<rule id="101227" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1140,technique_name=Certutil Encode/Decode in Temp$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1546</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
			<!--  -->
	<rule id="101228" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1140,technique_name=Certutil Decode to Executable in Temp$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1546</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
			<!--  -->
	<rule id="101229" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1140,technique_name=Renamed Certutil Used$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1546</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
				<!--  -->
	<rule id="101230" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1055.011,technique_name=Process Injection: Extra Window Memory Injection$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1546</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
					<!--  -->
	<rule id="101231" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1053.005,technique_name=Modify Scheduled Task with PowerShell$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1053.005</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
				<!--  -->
	<rule id="101232" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1053.005,technique_name=Scheduled Task via XML Import$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1053.005</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
				<!--  -->
	<rule id="101233" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1053.005,technique_name=Scheduled Task via Office Macro (VBA)$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1053.005</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	
				<!--  -->
	<rule id="101234" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1053.005,technique_name=Scheduled Task Exec from Registry$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1053.005</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
				<!--  -->
	<rule id="101235" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1204.002,technique_name=Office launching cscript$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1204.002</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
				<!--  -->
	<rule id="101236" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1204.002,technique_name=Office launching explorer$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1204.002</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
				<!--  -->
	<rule id="101237" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1204.002,technique_name=Office launching headless Chrome$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1204.002</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
				<!--  -->
	<rule id="101238" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1204.002,technique_name=Office launching mshta$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1204.002</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
				<!--  -->
	<rule id="101239" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1204.002,technique_name=Encoded PowerShell from Office$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1204.002</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
				<!--  -->
	<rule id="101240" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1059.001,technique_name=PowerShell Base64 Decoding$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1059.001</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
				<!--  -->
	<rule id="101241" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1059.001,technique_name=PowerShell Alternate Data Stream Usage$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1059.001</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
				<!--  -->
	<rule id="101242" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1059.001,technique_name=PowerShell COM Object Abuse (MsXml2)$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1059.001</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
				<!--  -->
	<rule id="101243" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1059.001,technique_name=PowerShell Remote Session Creation$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1059.001</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
				<!--  -->
	<rule id="101244" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1059.001,technique_name=PowerShell Known Malicious Cmdlets$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1059.001</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
				<!--  -->
	<rule id="101245" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1059.001,technique_name=PowerShell Core Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1059.001</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101246" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1559,technique_name=Named Pipe Execution via Argument$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1559</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101247" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1059.005,technique_name=VBScript via CScript/WScript$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1059.005</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101248" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1059.005,technique_name=VBScript via WScript$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1059.005</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>    
	<!--  -->
	<rule id="101249" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1059.005,technique_name=VBScript HTA Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1059.005</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>  
	<!--  -->
	<rule id="101250" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1137.006,technique_name=Excel Add-in XLL Execution$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1137.006</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule> 
	<!--  -->
	<rule id="101251" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1137.006,technique_name=Excel Auto-Loaded Add-in from AppData$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1137.006</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule> 
	<!--  -->
	<rule id="101252" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1137.006,technique_name=Word Auto-Loaded Add-in (WLL)$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1137.006</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule> 
	<!--  -->
	<rule id="101253" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1137.006,technique_name=Excel VBA Add-in Auto-Start (XLAM)$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1137.006</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule> 
	<!--  -->
	<rule id="101254" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1137.006,technique_name=PowerPoint Add-in Auto-Start (PPAM)$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1137.006</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule> 
	<!--  -->
	<rule id="101255" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1137.006,technique_name=Office Add-in Launching Suspicious Child$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1137.006</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule> 
	<!--  -->
	<rule id="101256" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1176,technique_name=Edge Extension Loaded via Command Line$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1176</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101257" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1176,technique_name=Brave Extension Loaded via Command Line$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1176</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101258" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1176,technique_name=Vivaldi Extension Loaded via Command Line$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1176</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101259" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1176,technique_name=Opera Extension Loaded via Command Line$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1176</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101260" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1176,technique_name=Chromium-Based Extension Loaded via Command Line$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1176</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101261" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1176,technique_name=Chromium-Based Extension Loaded via Command Line$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1176</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101262" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1112,technique_name=Registry modified via reg.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1112</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101263" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1112,technique_name=Registry modified via cmd.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1112</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101264" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1112,technique_name=Registry modified via PowerShell Set-ItemProperty$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1112</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101265" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1112,technique_name=Registry write to HKLM/HKCU$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1112</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101266" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1112,technique_name=Registry write to HKLM/HKCU$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1112</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101267" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1112,technique_name=Rundll32 abusing apphelp.dll for ShimFlushCache$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1112</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101268" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1112,technique_name=Registry modification via regini.exe$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1112</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101269" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1112,technique_name=Registry modification via regsvr32$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1112</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101270" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1112,technique_name=Disable Windows Task Manager via registry$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1112</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101271" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1112,technique_name=Disable Security Notifications$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1112</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
	<!--  -->
	<rule id="101272" level="13">
		<if_sid>61603</if_sid>
		<field name="win.eventdata.RuleName">^technique_id=T1112,technique_name=Load malware via App Paths registry$</field>
		<description>Sysmon - Event 1: Process creation $(win.eventdata.description)</description>
		<mitre>
			<id>T1112</id>
		</mitre>
		<options>no_full_log</options>
		<group>sysmon_event1,</group>
	</rule>
</group>
