evm.cloud.src

{
	"Events":{
		"RB1":[
			{
				"BaseEventType":9,
				"EventType":null
			}
		],
		"RB2":[
			{
				"BaseEventType":9,
				"EventType":null
			}
		],
		"RB3":[
			{
				"BaseEventType":9,
				"EventType":null
			}
		],
		"RB4":[
			{
				"BaseEventType":9,
				"EventType":null
			}
		],
		"RD11":[
			{
				"BaseEventType":18,
				"EventType":null
			}
		],
		"RD15":[
			{
				"BaseEventType":19,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"Field":"targetName",
									"Operator":"Match",
									"Value":"%windir%\\*"
								}
							]
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"BooleanOperator":"Or",
									"Conditions":[
										{
											"Field":"parentVerdict",
											"Operator":"!Equal",
											"Value":1
										},
										{
											"Field":"parentProcessPath",
											"Operator":"Match",
											"Value":"*\\powershell.exe"
										}
									]
								},
								{
									"Field":"targetName",
									"Operator":"Match",
									"Value":"*\\lsass.exe"
								}
							]
						}
					]
				},
				"EventType":"aed59f052d794a489a792e8aa257587d"
			},
			{
				"BaseEventType":19,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"parentVerdict",
							"Operator":"!Equal",
							"Value":1
						},
						{
							"Field":"targetName",
							"Operator":"Match",
							"Value":"%windir%\\*"
						}
					]
				},
				"EventType":null
			}
		],
		"RD16":[
			{
				"BaseEventType":20,
				"Condition":{
					"Field":"parentProcessPath",
					"Operator":"Match",
					"Value":"*"
				},
				"EventType":"3901cf50d77845df94b3ae55831bbc84"
			},
			{
				"BaseEventType":20,
				"EventType":null
			}
		],
		"RD17":[
			{
				"BaseEventType":21,
				"Condition":{
					"Field":"parentProcessPath",
					"Operator":"Match",
					"Value":"*"
				},
				"EventType":"18d0a4eae356423bb5be802d213e7318"
			},
			{
				"BaseEventType":21,
				"EventType":null
			}
		],
		"RD20":[
			{
				"BaseEventType":22,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"Field":"targetName",
									"Operator":"Match",
									"Value":"%windir%\\*"
								}
							]
						},
						{
							"Field":"targetName",
							"Operator":"Match",
							"Value":"*lsass.exe"
						}
					]
				},
				"EventType":"cc51cb01ab35467281b71fcb405d6a3e"
			},
			{
				"BaseEventType":22,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"parentVerdict",
							"Operator":"!Equal",
							"Value":1
						},
						{
							"Field":"targetName",
							"Operator":"Match",
							"Value":"%windir%\\*"
						}
					]
				},
				"EventType":null
			}
		],
		"RD6":[
			{
				"BaseEventType":15,
				"EventType":null
			}
		],
		"RD7":[
			{
				"BaseEventType":16,
				"Condition":{
					"Field":"parentProcessPath",
					"Operator":"Match",
					"Value":"*"
				},
				"EventType":"dc1f8f7cdbb64cb99f61751d507fc83c"
			},
			{
				"BaseEventType":16,
				"EventType":null
			}
		],
		"RD8":[
			{
				"BaseEventType":17,
				"EventType":null
			}
		],
		"RF1":[
			
		],
		"RF10":[
			{
				"BaseEventType":12,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"parentProcessPath",
							"Operator":"MatchInList",
							"Value":"EmailPaths"
						},
						{
							"Field":"path",
							"Operator":"!Match",
							"Value":"%appdata%\\*"
						},
						{
							"Field":"path",
							"Operator":"!Match",
							"Value":"%localappdata%\\*"
						},
						{
							"Field":"path",
							"Operator":"!Match",
							"Value":"%userprofile%\\AppData\\*"
						}
					]
				},
				"EventType":null
			},
			{
				"BaseEventType":7,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"WriteFileWhiteList"
								},
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"BooleanOperator":"And",
									"Conditions":[
										{
											"Field":"parentProcessPath",
											"Operator":"!MatchInList",
											"Value":"WriteFileBlackList"
										},
										{
											"Field":"parentProcessPath",
											"Operator":"!Match",
											"Value":"%systemroot%\\*"
										},
										{
											"BooleanOperator":"Or",
											"Conditions":[
												{
													"Field":"ftype",
													"Operator":"Equal",
													"Value":"PORTABLE_EXECUTABLE"
												},
												{
													"Field":"path",
													"Operator":"MatchInList",
													"Value":"InfectibleFiles"
												}
											]
										}
									]
								}
							]
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*mimikatz*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*golden_ticket*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*lsadump*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*fgdump*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*lsasecrets*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*mimilib*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*mimilove*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*pwdump*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*pwhashes*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*lsass.dmp*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*cachedump*"
								}
							]
						}
					]
				},
				"EventType":"2ae984ad4195477985db788a990be2ed"
			},
			{
				"BaseEventType":7,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"WriteFileWhiteList"
								},
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"BooleanOperator":"And",
									"Conditions":[
										{
											"Field":"parentProcessPath",
											"Operator":"!MatchInList",
											"Value":"WriteFileBlackList"
										},
										{
											"Field":"parentProcessPath",
											"Operator":"!Match",
											"Value":"%systemroot%\\*"
										},
										{
											"BooleanOperator":"Or",
											"Conditions":[
												{
													"Field":"ftype",
													"Operator":"Equal",
													"Value":"PORTABLE_EXECUTABLE"
												},
												{
													"Field":"path",
													"Operator":"MatchInList",
													"Value":"InfectibleFiles"
												}
											]
										}
									]
								}
							]
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*svch0st.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*scvhost.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*svchots.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*scvh0st.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*svhost.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*schost.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*svchosts.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*swchost.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*svshost.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*svcnost.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*syshost.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*svchsot.exe"
								}
							]
						}
					]
				},
				"EventType":"0673857066a945d88f18bc5e4a4e4959"
			},
			{
				"BaseEventType":7,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"WriteFileWhiteList"
								},
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"BooleanOperator":"And",
									"Conditions":[
										{
											"Field":"parentProcessPath",
											"Operator":"!MatchInList",
											"Value":"WriteFileBlackList"
										},
										{
											"Field":"parentProcessPath",
											"Operator":"!Match",
											"Value":"%systemroot%\\*"
										},
										{
											"BooleanOperator":"Or",
											"Conditions":[
												{
													"Field":"ftype",
													"Operator":"Equal",
													"Value":"PORTABLE_EXECUTABLE"
												},
												{
													"Field":"path",
													"Operator":"MatchInList",
													"Value":"InfectibleFiles"
												}
											]
										}
									]
								}
							]
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*\\\\windows\\\\temp*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*debug.bin"
								}
							]
						}
					]
				},
				"EventType":"ee995091a1984308b1a50e8f30c2465e"
			},
			{
				"BaseEventType":7,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"WriteFileWhiteList"
								},
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"BooleanOperator":"And",
									"Conditions":[
										{
											"Field":"parentProcessPath",
											"Operator":"!MatchInList",
											"Value":"WriteFileBlackList"
										},
										{
											"Field":"parentProcessPath",
											"Operator":"!Match",
											"Value":"%systemroot%\\*"
										},
										{
											"BooleanOperator":"Or",
											"Conditions":[
												{
													"Field":"ftype",
													"Operator":"Equal",
													"Value":"PORTABLE_EXECUTABLE"
												},
												{
													"Field":"path",
													"Operator":"MatchInList",
													"Value":"InfectibleFiles"
												}
											]
										}
									]
								}
							]
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"parentProcessPath",
									"Operator":"Match",
									"Value":"*windows*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*memory.dmp"
								}
							]
						}
					]
				},
				"EventType":"3b88a84d13254e96bc31733807a04b7f"
			},
			{
				"BaseEventType":7,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"WriteFileWhiteList"
								},
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"BooleanOperator":"And",
									"Conditions":[
										{
											"Field":"parentProcessPath",
											"Operator":"!MatchInList",
											"Value":"WriteFileBlackList"
										},
										{
											"Field":"parentProcessPath",
											"Operator":"!Match",
											"Value":"%systemroot%\\*"
										},
										{
											"BooleanOperator":"Or",
											"Conditions":[
												{
													"Field":"ftype",
													"Operator":"Equal",
													"Value":"PORTABLE_EXECUTABLE"
												},
												{
													"Field":"path",
													"Operator":"MatchInList",
													"Value":"InfectibleFiles"
												}
											]
										}
									]
								}
							]
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"parentProcessPath",
									"Operator":"Match",
									"Value":"*excavator.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*memory.dmp"
								}
							]
						}
					]
				},
				"EventType":"6e218a32ad814d0290dfa206812e529b"
			},
			{
				"BaseEventType":7,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"WriteFileWhiteList"
								},
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"BooleanOperator":"And",
									"Conditions":[
										{
											"Field":"parentProcessPath",
											"Operator":"!MatchInList",
											"Value":"WriteFileBlackList"
										},
										{
											"Field":"parentProcessPath",
											"Operator":"!Match",
											"Value":"%systemroot%\\*"
										},
										{
											"BooleanOperator":"Or",
											"Conditions":[
												{
													"Field":"ftype",
													"Operator":"Equal",
													"Value":"PORTABLE_EXECUTABLE"
												},
												{
													"Field":"path",
													"Operator":"MatchInList",
													"Value":"InfectibleFiles"
												}
											]
										}
									]
								}
							]
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"BooleanOperator":"Or",
									"Conditions":[
										{
											"Field":"parentProcessPath",
											"Operator":"Match",
											"Value":"*wscript.exe"
										},
										{
											"Field":"parentProcessPath",
											"Operator":"Match",
											"Value":"*cscript.exe"
										}
									]
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*\\start menu\\programs\\startup*"
								}
							]
						}
					]
				},
				"EventType":"2eb42f82cc534183ad605bf62286f5a8"
			},
			{
				"BaseEventType":7,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"WriteFileWhiteList"
								},
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"BooleanOperator":"And",
									"Conditions":[
										{
											"Field":"parentProcessPath",
											"Operator":"!MatchInList",
											"Value":"WriteFileBlackList"
										},
										{
											"Field":"parentProcessPath",
											"Operator":"!Match",
											"Value":"%systemroot%\\*"
										},
										{
											"BooleanOperator":"Or",
											"Conditions":[
												{
													"Field":"ftype",
													"Operator":"Equal",
													"Value":"PORTABLE_EXECUTABLE"
												},
												{
													"Field":"path",
													"Operator":"MatchInList",
													"Value":"InfectibleFiles"
												}
											]
										}
									]
								}
							]
						},
						{
							"Field":"path",
							"Operator":"Equal",
							"Value":"%systemroot%\\system32\\drivers\\etc\\hosts"
						}
					]
				},
				"EventType":"e5f2004c86be4397acd5be606de6b9f0"
			},
			{
				"BaseEventType":7,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"WriteFileWhiteList"
								},
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"BooleanOperator":"And",
									"Conditions":[
										{
											"Field":"parentProcessPath",
											"Operator":"!MatchInList",
											"Value":"WriteFileBlackList"
										},
										{
											"Field":"parentProcessPath",
											"Operator":"!Match",
											"Value":"%systemroot%\\*"
										},
										{
											"BooleanOperator":"Or",
											"Conditions":[
												{
													"Field":"ftype",
													"Operator":"Equal",
													"Value":"PORTABLE_EXECUTABLE"
												},
												{
													"Field":"path",
													"Operator":"MatchInList",
													"Value":"InfectibleFiles"
												}
											]
										}
									]
								}
							]
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"%systemroot%\\System32\\Tasks*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"%systemroot%\\Tasks*"
								}
							]
						}
					]
				},
				"EventType":"830d52dec2ac455a8d453b2b708e8da7"
			},
			{
				"BaseEventType":7,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"WriteFileWhiteList"
								},
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"BooleanOperator":"And",
									"Conditions":[
										{
											"Field":"parentProcessPath",
											"Operator":"!MatchInList",
											"Value":"WriteFileBlackList"
										},
										{
											"Field":"parentProcessPath",
											"Operator":"!Match",
											"Value":"%systemroot%\\*"
										},
										{
											"BooleanOperator":"Or",
											"Conditions":[
												{
													"Field":"ftype",
													"Operator":"Equal",
													"Value":"PORTABLE_EXECUTABLE"
												},
												{
													"Field":"path",
													"Operator":"MatchInList",
													"Value":"InfectibleFiles"
												}
											]
										}
									]
								}
							]
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"Field":"ftype",
									"Operator":"Equal",
									"Value":"PORTABLE_EXECUTABLE"
								}
							]
						}
					]
				},
				"EventType":"8eec359729ae43ce943823debeaf2ded"
			},
			{
				"BaseEventType":7,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"WriteFileWhiteList"
								},
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"BooleanOperator":"And",
									"Conditions":[
										{
											"Field":"parentProcessPath",
											"Operator":"!MatchInList",
											"Value":"WriteFileBlackList"
										},
										{
											"Field":"parentProcessPath",
											"Operator":"!Match",
											"Value":"%systemroot%\\*"
										},
										{
											"BooleanOperator":"Or",
											"Conditions":[
												{
													"Field":"ftype",
													"Operator":"Equal",
													"Value":"PORTABLE_EXECUTABLE"
												},
												{
													"Field":"path",
													"Operator":"MatchInList",
													"Value":"InfectibleFiles"
												}
											]
										}
									]
								}
							]
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"%appdata%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"%programdata%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"%systemroot%\\system\\iosubsys\\*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"%systemroot%\\system\\vmm32\\*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"%systemroot%\\Tasks\\*"
								},
								{
									"Field":"path",
									"Operator":"Equal",
									"Value":"%systemdrive%\\autoexec.bat"
								},
								{
									"Field":"path",
									"Operator":"Equal",
									"Value":"%systemdrive%\\config.sys"
								},
								{
									"Field":"path",
									"Operator":"Equal",
									"Value":"%systemroot%\\wininit.ini"
								},
								{
									"Field":"path",
									"Operator":"Equal",
									"Value":"%systemroot%\\winstart.bat"
								},
								{
									"Field":"path",
									"Operator":"Equal",
									"Value":"%systemroot%\\win.ini"
								},
								{
									"Field":"path",
									"Operator":"Equal",
									"Value":"%systemroot%\\system.ini"
								},
								{
									"Field":"path",
									"Operator":"Equal",
									"Value":"%systemroot%\\dosstart.bat"
								}
							]
						}
					]
				},
				"EventType":"891c444fba4d4ac8b579e5be334c61af"
			},
			{
				"BaseEventType":7,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"WriteFileWhiteList"
								},
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"BooleanOperator":"And",
									"Conditions":[
										{
											"Field":"parentProcessPath",
											"Operator":"!MatchInList",
											"Value":"WriteFileBlackList"
										},
										{
											"Field":"parentProcessPath",
											"Operator":"!Match",
											"Value":"%systemroot%\\*"
										},
										{
											"BooleanOperator":"Or",
											"Conditions":[
												{
													"Field":"ftype",
													"Operator":"Equal",
													"Value":"PORTABLE_EXECUTABLE"
												},
												{
													"Field":"path",
													"Operator":"MatchInList",
													"Value":"InfectibleFiles"
												}
											]
										}
									]
								}
							]
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*.exe"
						}
					]
				},
				"EventType":"da049d853bbd44fc9d121de733800af1"
			},
			{
				"BaseEventType":7,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"WriteFileWhiteList"
								},
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"BooleanOperator":"And",
									"Conditions":[
										{
											"Field":"parentProcessPath",
											"Operator":"!MatchInList",
											"Value":"WriteFileBlackList"
										},
										{
											"Field":"parentProcessPath",
											"Operator":"!Match",
											"Value":"%systemroot%\\*"
										},
										{
											"BooleanOperator":"Or",
											"Conditions":[
												{
													"Field":"ftype",
													"Operator":"Equal",
													"Value":"PORTABLE_EXECUTABLE"
												},
												{
													"Field":"path",
													"Operator":"MatchInList",
													"Value":"InfectibleFiles"
												}
											]
										}
									]
								}
							]
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":".cmd"
						}
					]
				},
				"EventType":"fb8abd2d071c4066892faf2389c5ed66"
			},
			{
				"BaseEventType":7,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"WriteFileWhiteList"
								},
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"BooleanOperator":"And",
									"Conditions":[
										{
											"Field":"parentProcessPath",
											"Operator":"!MatchInList",
											"Value":"WriteFileBlackList"
										},
										{
											"Field":"parentProcessPath",
											"Operator":"!Match",
											"Value":"%systemroot%\\*"
										},
										{
											"BooleanOperator":"Or",
											"Conditions":[
												{
													"Field":"ftype",
													"Operator":"Equal",
													"Value":"PORTABLE_EXECUTABLE"
												},
												{
													"Field":"path",
													"Operator":"MatchInList",
													"Value":"InfectibleFiles"
												}
											]
										}
									]
								}
							]
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*.cert"
						}
					]
				},
				"EventType":"c5c70bd1fafc4bbea6d562d43a305b81"
			},
			{
				"BaseEventType":7,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"WriteFileWhiteList"
								},
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"BooleanOperator":"And",
									"Conditions":[
										{
											"Field":"parentProcessPath",
											"Operator":"!MatchInList",
											"Value":"WriteFileBlackList"
										},
										{
											"Field":"parentProcessPath",
											"Operator":"!Match",
											"Value":"%systemroot%\\*"
										},
										{
											"BooleanOperator":"Or",
											"Conditions":[
												{
													"Field":"ftype",
													"Operator":"Equal",
													"Value":"PORTABLE_EXECUTABLE"
												},
												{
													"Field":"path",
													"Operator":"MatchInList",
													"Value":"InfectibleFiles"
												}
											]
										}
									]
								}
							]
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"%systemroot%\\system32\\grouppolicy\\*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"%systemroot%\\Sysvol\\sysvol\\*\\Policies\\*"
								}
							]
						}
					]
				},
				"EventType":"c04f8af3bab54d029834e66b94e7b966"
			},
			{
				"BaseEventType":7,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"WriteFileWhiteList"
								},
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"BooleanOperator":"And",
									"Conditions":[
										{
											"Field":"parentProcessPath",
											"Operator":"!MatchInList",
											"Value":"WriteFileBlackList"
										},
										{
											"Field":"parentProcessPath",
											"Operator":"!Match",
											"Value":"%systemroot%\\*"
										},
										{
											"BooleanOperator":"Or",
											"Conditions":[
												{
													"Field":"ftype",
													"Operator":"Equal",
													"Value":"PORTABLE_EXECUTABLE"
												},
												{
													"Field":"path",
													"Operator":"MatchInList",
													"Value":"InfectibleFiles"
												}
											]
										}
									]
								}
							]
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*.bat"
						}
					]
				},
				"EventType":"b7951c3ece94475db9d55d4a39443939"
			},
			{
				"BaseEventType":7,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"WriteFileWhiteList"
								},
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"BooleanOperator":"And",
									"Conditions":[
										{
											"Field":"parentProcessPath",
											"Operator":"!MatchInList",
											"Value":"WriteFileBlackList"
										},
										{
											"Field":"parentProcessPath",
											"Operator":"!Match",
											"Value":"%systemroot%\\*"
										},
										{
											"BooleanOperator":"Or",
											"Conditions":[
												{
													"Field":"ftype",
													"Operator":"Equal",
													"Value":"PORTABLE_EXECUTABLE"
												},
												{
													"Field":"path",
													"Operator":"MatchInList",
													"Value":"InfectibleFiles"
												}
											]
										}
									]
								}
							]
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*.dll"
						}
					]
				},
				"EventType":"a02fd5fc871946268191721320e433a8"
			},
			{
				"BaseEventType":7,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"WriteFileWhiteList"
								},
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"BooleanOperator":"And",
									"Conditions":[
										{
											"Field":"parentProcessPath",
											"Operator":"!MatchInList",
											"Value":"WriteFileBlackList"
										},
										{
											"Field":"parentProcessPath",
											"Operator":"!Match",
											"Value":"%systemroot%\\*"
										},
										{
											"BooleanOperator":"Or",
											"Conditions":[
												{
													"Field":"ftype",
													"Operator":"Equal",
													"Value":"PORTABLE_EXECUTABLE"
												},
												{
													"Field":"path",
													"Operator":"MatchInList",
													"Value":"InfectibleFiles"
												}
											]
										}
									]
								}
							]
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":".sys"
						}
					]
				},
				"EventType":"9589d76e7cf84e3887afed92030265c1"
			},
			{
				"BaseEventType":7,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"WriteFileWhiteList"
								},
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"BooleanOperator":"And",
									"Conditions":[
										{
											"Field":"parentProcessPath",
											"Operator":"!MatchInList",
											"Value":"WriteFileBlackList"
										},
										{
											"Field":"parentProcessPath",
											"Operator":"!Match",
											"Value":"%systemroot%\\*"
										},
										{
											"BooleanOperator":"Or",
											"Conditions":[
												{
													"Field":"ftype",
													"Operator":"Equal",
													"Value":"PORTABLE_EXECUTABLE"
												},
												{
													"Field":"path",
													"Operator":"MatchInList",
													"Value":"InfectibleFiles"
												}
											]
										}
									]
								}
							]
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"parentProcessPath",
									"Operator":"!Match",
									"Value":"*PSScriptPolicyTest*"
								},
								{
									"BooleanOperator":"Or",
									"Conditions":[
										{
											"Field":"path",
											"Operator":"Match",
											"Value":"*.ps1"
										},
										{
											"Field":"path",
											"Operator":"Match",
											"Value":"*.psm1"
										}
									]
								}
							]
						}
					]
				},
				"EventType":"3e754a26ae4a48da96519fb891bee53c"
			},
			{
				"BaseEventType":7,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"WriteFileWhiteList"
								},
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"BooleanOperator":"And",
									"Conditions":[
										{
											"Field":"parentProcessPath",
											"Operator":"!MatchInList",
											"Value":"WriteFileBlackList"
										},
										{
											"Field":"parentProcessPath",
											"Operator":"!Match",
											"Value":"%systemroot%\\*"
										},
										{
											"BooleanOperator":"Or",
											"Conditions":[
												{
													"Field":"ftype",
													"Operator":"Equal",
													"Value":"PORTABLE_EXECUTABLE"
												},
												{
													"Field":"path",
													"Operator":"MatchInList",
													"Value":"InfectibleFiles"
												}
											]
										}
									]
								}
							]
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*.jar"
						}
					]
				},
				"EventType":"0fcf32c71112477b92377f65a8f23566"
			},
			{
				"BaseEventType":7,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"WriteFileWhiteList"
								},
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"BooleanOperator":"And",
									"Conditions":[
										{
											"Field":"parentProcessPath",
											"Operator":"!MatchInList",
											"Value":"WriteFileBlackList"
										},
										{
											"Field":"parentProcessPath",
											"Operator":"!Match",
											"Value":"%systemroot%\\*"
										},
										{
											"BooleanOperator":"Or",
											"Conditions":[
												{
													"Field":"ftype",
													"Operator":"Equal",
													"Value":"PORTABLE_EXECUTABLE"
												},
												{
													"Field":"path",
													"Operator":"MatchInList",
													"Value":"InfectibleFiles"
												}
											]
										}
									]
								}
							]
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*.sfx"
						}
					]
				},
				"EventType":"075d820a2d6641d296461d94ba41c8ab"
			},
			{
				"BaseEventType":7,
				"Condition":{
					"BooleanOperator":"Or",
					"Conditions":[
						{
							"Field":"parentProcessPath",
							"Operator":"MatchInList",
							"Value":"WriteFileWhiteList"
						},
						{
							"Field":"parentVerdict",
							"Operator":"!Equal",
							"Value":1
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"parentProcessPath",
									"Operator":"!MatchInList",
									"Value":"WriteFileBlackList"
								},
								{
									"Field":"parentProcessPath",
									"Operator":"!Match",
									"Value":"%systemroot%\\*"
								},
								{
									"BooleanOperator":"Or",
									"Conditions":[
										{
											"Field":"ftype",
											"Operator":"Equal",
											"Value":"PORTABLE_EXECUTABLE"
										},
										{
											"Field":"path",
											"Operator":"MatchInList",
											"Value":"InfectibleFiles"
										}
									]
								}
							]
						}
					]
				},
				"EventType":null
			}
		],
		"RF11":[
			{
				"BaseEventType":10,
				"EventType":null
			}
		],
		"RF12":[
			{
				"BaseEventType":11,
				"EventType":null
			}
		],
		"RF13":[
			{
				"BaseEventType":13,
				"Condition":{
					"BooleanOperator":"Or",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*.lnk"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*.wsf"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*.hta"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*.mhtml"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*.html"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*.doc"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*.docm"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*.xls"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*.xlsm"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*.ppt"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*.pptm"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*.chm"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*.vbs"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*.js"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*.bat"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*.pif"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*.pdf"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*.jar"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*.sys"
						}
					]
				},
				"EventType":"c31b7646ef5244c893998266532cb53a"
			},
			{
				"BaseEventType":13,
				"Condition":{
					"Field":"ftype",
					"Operator":"Equal",
					"Value":"PORTABLE_EXECUTABLE"
				},
				"EventType":"7231096a33aa4720ae4a3ea6445aef7a"
			},
			{
				"BaseEventType":13,
				"EventType":null
			}
		],
		"RF14":[
			{
				"BaseEventType":14,
				"EventType":null
			}
		],
		"RF2":[
			
		],
		"RF3":[
			
		],
		"RF4":[
			{
				"BaseEventType":8,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"!Match",
							"Value":"\\Device\\HarddiskVolumeShadowCopy*"
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"DeleteFileWhiteList"
								},
								{
									"Field":"path",
									"Operator":"MatchInList",
									"Value":"DeleteFileExtensions"
								}
							]
						}
					]
				},
				"EventType":null
			}
		],
		"RF5":[
			
		],
		"RF6":[
			
		],
		"RF7":[
			
		],
		"RF8":[
			
		],
		"RF9":[
			
		],
		"RN1":[
			{
				"BaseEventType":2,
				"Condition":{
					"BooleanOperator":"Or",
					"Conditions":[
						{
							"Field":"parentVerdict",
							"Operator":"!Equal",
							"Value":1
						},
						{
							"Field":"parentProcessPath",
							"Operator":"Match",
							"Value":"*\\powershell.exe"
						}
					]
				},
				"EventType":null
			}
		],
		"RN2":[
			{
				"BaseEventType":3,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"Field":"parentProcessPath",
									"Operator":"Match",
									"Value":"*\\powershell.exe"
								}
							]
						},
						{
							"Field":"parentProcessPath",
							"Operator":"Match",
							"Value":"*verclsid.exe"
						}
					]
				},
				"EventType":"a2ca46c629a24841aa0bb704fd5fe605"
			},
			{
				"BaseEventType":3,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"Field":"parentProcessPath",
									"Operator":"Match",
									"Value":"*\\powershell.exe"
								}
							]
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"transProto",
									"Operator":"Equal",
									"Value":0
								},
								{
									"Field":"transProto",
									"Operator":"Equal",
									"Value":1
								},
								{
									"Field":"transProto",
									"Operator":"Equal",
									"Value":2
								}
							]
						}
					]
				},
				"EventType":"25c0e7ab30244b61a00dc3835e28a0da"
			},
			{
				"BaseEventType":3,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"Field":"parentProcessPath",
									"Operator":"Match",
									"Value":"*\\powershell.exe"
								}
							]
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"parentProcessPath",
									"Operator":"Match",
									"Value":"putty*"
								},
								{
									"BooleanOperator":"Or",
									"Conditions":[
										{
											"Field":"SrcPort",
											"Operator":"Equal",
											"Value":22
										},
										{
											"Field":"SrcPort",
											"Operator":"Equal",
											"Value":23
										},
										{
											"Field":"SrcPort",
											"Operator":"Equal",
											"Value":443
										}
									]
								}
							]
						}
					]
				},
				"EventType":"cf071d44a43f4653ac4e3d28dcd30577"
			},
			{
				"BaseEventType":3,
				"Condition":{
					"BooleanOperator":"Or",
					"Conditions":[
						{
							"Field":"parentVerdict",
							"Operator":"!Equal",
							"Value":1
						},
						{
							"Field":"parentProcessPath",
							"Operator":"Match",
							"Value":"*\\powershell.exe"
						}
					]
				},
				"EventType":null
			}
		],
		"RP1":[
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentProcessPath",
									"Operator":"Match",
									"Value":"*reg.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*reg.exe"
								}
							]
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*save hklm\\security*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*save hklm\\sam*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*save hklm\\system*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*save hklm\\software*"
								}
							]
						}
					]
				},
				"EventType":"ee372297b0254f56a1307bb07930b22f"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*cmd.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*w3wp.exe"
								}
							]
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*&cd&echo*"
						}
					]
				},
				"EventType":"bcdc9face6984eb09b556dbda04788ef"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*cmd.exe"
						},
						{
							"Field":"parentProcessPath",
							"Operator":"Match",
							"Value":"*w3wp.exe"
						}
					]
				},
				"EventType":"9b6f4229f62f442aaf20c9e39b8bb047"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"Field":"path",
					"Operator":"Match",
					"Value":"*dginfect*"
				},
				"EventType":"8f67e773e28c42cba051d4e69900f1c5"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentProcessPath",
									"Operator":"Match",
									"Value":"*findstr.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*findstr.exe"
								}
							]
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*cpassword*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*sysvol*"
								}
							]
						}
					]
				},
				"EventType":"4b33b1eff6b34a1aacc43a6c8c77397b"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*regsvr32.exe"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*.jpg*"
						}
					]
				},
				"EventType":"47067e1c3c4f4cc6bdd7e625fd7f8e22"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*wevtutil.exe"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"* cl *"
						}
					]
				},
				"EventType":"2b5a51f982a44c21aa8aa1a9bde87a0c"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"Or",
					"Conditions":[
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*\\-ma lsass*"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*\\-mp lsass*"
						}
					]
				},
				"EventType":"2489b9cb998f4880a94908d10effc191"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*regsvr32.exe"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*.pdf*"
						}
					]
				},
				"EventType":"2165ddff5cce4d5ca138274666a00242"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"Or",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*g64*.exe"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*g32*.exe"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*pwdump*.exe"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*dumpsvc.exe"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*gsecdump.exe"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*Lz77.exe"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*wcex*.exe"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*cachedump.exe"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*lslsass.exe"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*wce.dll"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*fgdump.exe"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*fgdump*.exe"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*wca.dll"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*mimikatz*"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*mimilove*"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*samdump*"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*creddump*"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*cachedump*.exe"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*servpw64.exe"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*servpw*.exe"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*adpasshunt.exe"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*dumpert.exe"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*nanodump*.exe"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*xordump.exe"
						}
					]
				},
				"EventType":"10c912ba281147f1828acf70a315bc34"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*java.exe"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*metasploit*"
						}
					]
				},
				"EventType":"ef61169a95ce404588890662fe03d311"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"taskeng.exe"
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*.vbs*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*.js*"
								}
							]
						}
					]
				},
				"EventType":"fe16732594394b5e844e46c7157ee90b"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*rundll32.exe"
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*-export dll_u*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*,dll_u*"
								}
							]
						}
					]
				},
				"EventType":"fdcc941d585249af90c48a231a0ba929"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*xcopy.exe"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*/S /E /C /Q /H*"
						}
					]
				},
				"EventType":"e6c9c1b6f0e2485195c7be87aaa961ff"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*reg.exe"
						},
						{
							"Field":"parentProcessPath",
							"Operator":"!Match",
							"Value":"*ir_agent.exe"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"!Match",
							"Value":"*Rapid7*"
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"BooleanOperator":"And",
									"Conditions":[
										{
											"Field":"prcs_cmd_line",
											"Operator":"Match",
											"Value":"*reg query*"
										},
										{
											"Field":"prcs_cmd_line",
											"Operator":"Match",
											"Value":"*/f password*"
										}
									]
								},
								{
									"BooleanOperator":"Or",
									"Conditions":[
										{
											"Field":"prcs_cmd_line",
											"Operator":"Match",
											"Value":"*reg.exe save*"
										},
										{
											"Field":"prcs_cmd_line",
											"Operator":"Match",
											"Value":"*reg save*"
										}
									]
								}
							]
						}
					]
				},
				"EventType":"df28b50c87434b87ae5c3ed49ae17b98"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"Or",
					"Conditions":[
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*impacket*"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*psexec.py*"
						}
					]
				},
				"EventType":"da328e5953024e8da0fdad6309e91383"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*wmic.exe"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*process where*"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*delete"
						}
					]
				},
				"EventType":"c6ba63f3266745c9b88c8883f624d616"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*powershell $*"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*http*"
						}
					]
				},
				"EventType":"c4e3153705044f30bcb827d750c355b2"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"Or",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*shamwow.exe"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*seatbelt.exe"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*beltalowda.exe"
						}
					]
				},
				"EventType":"c20ae8e455d648d6993a6f2a5a09273e"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*wscript.exe"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*jscript*"
						}
					]
				},
				"EventType":"bc495e7b5326460a8bbbab8c88a4178b"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentProcessPath",
									"Operator":"Match",
									"Value":"*\\cmd.exe"
								},
								{
									"Field":"parentProcessPath",
									"Operator":"Match",
									"Value":"*\\winword.exe"
								}
							]
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*powershell*-nop*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*powershell*-w*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*powershell*-command*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*powershell*-nol*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*powershell*-inputformat*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*powershell*-enc*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*powershell*-noni*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*powershell*-file*"
								}
							]
						}
					]
				},
				"EventType":"a67817303f07435da6f901161ff3f990"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*net.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"net1.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"runas.exe"
								}
							]
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*/savecred*"
						}
					]
				},
				"EventType":"a523f5f07d8a4720b206e08a8cf80e41"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*rundll32.exe"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*MyStart*"
						}
					]
				},
				"EventType":"99d497d8a4024c43a454fa465033f10a"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*sc.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*schtasks.exe"
								}
							]
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*/create*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*mshta*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*http*"
								}
							]
						}
					]
				},
				"EventType":"98a5e97e63ce47929bf4c7aae8c4e04c"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*wmic.exe"
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*process call create*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*/format:\\\"https*"
								}
							]
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"!Match",
							"Value":"*hexainstaller.vbs*"
						}
					]
				},
				"EventType":"983308da47f649c8ad30dec646ca3c8e"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*powershell.exe"
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*powershell -noP -sta -w 1*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*-NoP -NonI -W Hidden -Enc*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*-nop -noni -w hidden -enc*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*powershell -nop -sta -w 1*"
								}
							]
						}
					]
				},
				"EventType":"9628c3967a4d4affbcc55ab959df68f9"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*msra.exe"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*.exe\\\""
						}
					]
				},
				"EventType":"663876baa41741e28e38dd6e6b092927"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*regsrv32.exe"
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*http:*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*https:*"
								}
							]
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"!Match",
									"Value":"*Winhttp.dll*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"!Match",
									"Value":"*Wizard2.ocx*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"!Match",
									"Value":"*ChilkatHttp.dll*"
								}
							]
						}
					]
				},
				"EventType":"60ab8637e1eb4957b1b6e67a6a197d6f"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"parentProcessPath",
							"Operator":"Match",
							"Value":"*tstheme.exe"
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*cmd.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*powershell.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*nslookup.exe"
								}
							]
						}
					]
				},
				"EventType":"52f441a361b9478daba8adcd5561419e"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentProcessPath",
									"Operator":"Match",
									"Value":"*cmd.exe"
								},
								{
									"Field":"parentProcessPath",
									"Operator":"Match",
									"Value":"*powershell.exe"
								}
							]
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*dll_injector*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*dllrefresher*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*injector*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*pd64*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*NVTDLLUnInjector*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*nvtdlluninjector*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*inject*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*dllrefresher*"
								}
							]
						}
					]
				},
				"EventType":"501ba034fa3d4909a18cb8e32c5dd024"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*schtasks.exe"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*ScheduledDefrag*"
						}
					]
				},
				"EventType":"4f65d1e3be0e463fa9fc2f9e11738d96"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*certutil.exe"
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*-encode*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*-encrypt*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*-decrypt*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*-urlcache*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*-decode*"
								}
							]
						}
					]
				},
				"EventType":"4a096b050c154acfaa07900170c3496a"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*2>&1*"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*wmiapsrv.exe"
						}
					]
				},
				"EventType":"4882c3390df0479083fb0d94b721931b"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*cscript.exe"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*.vbs /shell*"
						}
					]
				},
				"EventType":"2f2f5f5b53844b6088609d8acf0d8835"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*vssadmin.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*wmic.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*powershell.exe"
								}
							]
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*delete shadow*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*Delete Shadow*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*resize shadowstorage*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*shadowcopy delete*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*Get-WMIObject Win32_ShadowCopy*"
								}
							]
						}
					]
				},
				"EventType":"283f97e94417475c8e9313739cbc686b"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*bitsadmin.exe"
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*/transfer*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*/download*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*/Download*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*/Transfer*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*/addfile*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*/resume*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*/Resume*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*/upload*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*/Upload*"
								}
							]
						}
					]
				},
				"EventType":"26d34c0bcc0e4d9caa50664f0cd5c58b"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*reg.exe"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*CredentialManager*"
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*add*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*ADD*"
								}
							]
						}
					]
				},
				"EventType":"2295b030613f4d31ad2c4f9243ed666e"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentProcessPath",
									"Operator":"Match",
									"Value":"*excel.exe"
								},
								{
									"Field":"parentProcessPath",
									"Operator":"Match",
									"Value":"*winword.exe"
								}
							]
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*cscript.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*wscript.exe"
								}
							]
						}
					]
				},
				"EventType":"1874b8918aa64decb1695263ec2c6ae1"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*cmd.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*cscript.exe"
								}
							]
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*winrm.vbs*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*winrm.cmd*"
								}
							]
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"!Match",
									"Value":"*quickconfig*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"!Match",
									"Value":"*System.Collections.Hashtable*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"!Match",
									"Value":"*help config*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"!Match",
									"Value":"*backgroundintelligenttransfer*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"!Match",
									"Value":"*TrustedHosts*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"!Match",
									"Value":"*nologo*"
								}
							]
						}
					]
				},
				"EventType":"1453b664685844049ab1f54dc8566627"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"Or",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"anchor_x64.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*anchorasjuster_x64.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*ts_1.硥ep"
								}
							]
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*esentutl.exe"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*grabber_temp.edb*"
								}
							]
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"BooleanOperator":"Or",
									"Conditions":[
										{
											"Field":"path",
											"Operator":"Match",
											"Value":"*cmd.exe"
										},
										{
											"Field":"path",
											"Operator":"Match",
											"Value":"*powershell.exe"
										}
									]
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*timeout 3 && del*"
								}
							]
						}
					]
				},
				"EventType":"0b4b246599d1415a85a8b15a943f9ac7"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*cmd.exe"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*NavShExt.dll*"
						}
					]
				},
				"EventType":"012d88585b534856ad6c77c9a2d114da"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*rundll32.exe"
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*RegisterOCX*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*RouteTheCall*"
								}
							]
						}
					]
				},
				"EventType":"eae5ebfd49994126a51274e8560fd40e"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*net.exe"
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*guest*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*active:yes*"
								}
							]
						}
					]
				},
				"EventType":"e96712b8b62648f09be42cc4939aa517"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*wbadmin.exe"
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*delete*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*stop*"
								}
							]
						}
					]
				},
				"EventType":"e83578f45c84483588e3c3f4227d48c6"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*rundll32.exe"
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*javascript*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*writeToTempFile*"
								}
							]
						}
					]
				},
				"EventType":"e58a2e6ba9e04bf589c750de6d934bc4"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*ntdomain*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*get*"
								},
								{
									"BooleanOperator":"Or",
									"Conditions":[
										{
											"Field":"prcs_cmd_line",
											"Operator":"Match",
											"Value":"*DomainControllerAddress*"
										},
										{
											"Field":"prcs_cmd_line",
											"Operator":"Match",
											"Value":"*domaincontrolleraddress*"
										}
									]
								}
							]
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*WMIC.exe"
								},
								{
									"Field":"parentProcessPath",
									"Operator":"Match",
									"Value":"*cmd.exe"
								}
							]
						}
					]
				},
				"EventType":"e10c63e50b064c71ab13968917f16e29"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*schtasks.exe"
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*temp*.exe*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*temp*.tmp*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*temp*.bat*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*TEMP*.exe*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*TEMP*.tmp*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*TEMP*.bat*"
								}
							]
						}
					]
				},
				"EventType":"db6fe0cfdd4148cdac8c0ade06d45b2b"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*mavinject.exe"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*system32*"
								}
							]
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"INJECTRUNNING"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"injectrunning"
								}
							]
						}
					]
				},
				"EventType":"d341b20d22db4480919dea5571ee6aa1"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*.regsvcs.exe"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*.dll*"
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"!Match",
									"Value":"*bootstrap*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"!Match",
									"Value":"*Program Files*"
								}
							]
						}
					]
				},
				"EventType":"c710cbc602134518a51ba85870fee52c"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*regsvr32.exe"
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*scrobj.dll*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*http*"
								}
							]
						}
					]
				},
				"EventType":"c5adf7a81e104a9486516605f889ffdc"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*cmstp.exe"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*.inf*"
						}
					]
				},
				"EventType":"c33a346ee5ad428e993f415fd560d570"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*colorcpl.exe"
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentProcessPath",
									"Operator":"Match",
									"Value":"*cscript.exe"
								},
								{
									"Field":"parentProcessPath",
									"Operator":"Match",
									"Value":"*wscript.exe"
								},
								{
									"Field":"parentProcessPath",
									"Operator":"Match",
									"Value":"*mshta.exe"
								},
								{
									"Field":"parentProcessPath",
									"Operator":"Match",
									"Value":"*winword.exe"
								},
								{
									"Field":"parentProcessPath",
									"Operator":"Match",
									"Value":"*excel.exe"
								},
								{
									"Field":"parentProcessPath",
									"Operator":"Match",
									"Value":"*cmd.exe"
								},
								{
									"Field":"parentProcessPath",
									"Operator":"Match",
									"Value":"*nslookup.exe"
								}
							]
						}
					]
				},
				"EventType":"bd9369bd5d2f47fe9435058569679f95"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*msiexec.exe"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*http*"
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"parentProcessPath",
									"Operator":"!Match",
									"Value":"*skype meetings*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"!Match",
									"Value":"*AppData\\\\Local\\\\Temp\\\\SkypeMeetingsApp.msi*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"!Match",
									"Value":"*SkypeMeetingsApp*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"!Match",
									"Value":"*meeturl=*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"!Match",
									"Value":"*https_*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"!Match",
									"Value":"*https-*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"!Match",
									"Value":"*httpd-*"
								}
							]
						}
					]
				},
				"EventType":"bbaa056b72e6477091c9df12f16ef552"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*rundll32.exe"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*.dat*"
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"!Match",
									"Value":"*shell32.dll*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"!Match",
									"Value":"*DavSetCookie*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"!Match",
									"Value":"*Thunder Network*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"!Match",
									"Value":"*winmail.dat*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"!Match",
									"Value":"*printui.dll*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"!Match",
									"Value":"*CanonBJ*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"!Match",
									"Value":"*FirewallControlPanel*"
								}
							]
						}
					]
				},
				"EventType":"b4ec56297c5e4d5582ab3302fb3aa539"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*powershell.exe"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*\\\\temp\\\\*"
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*.exe"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*.exe'\\\""
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*.exe\\\""
								}
							]
						}
					]
				},
				"EventType":"a1c7d7b50ab94db3b387df688777ba20"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*rundll32.exe"
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*EntryPoint*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*entrypoint*"
								}
							]
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"!Match",
									"Value":"*uninstall*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"!Match",
									"Value":"*UNINSTALL*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"!Match",
									"Value":"*installer.dll\\\",UninstallJREEntryPoint*"
								}
							]
						}
					]
				},
				"EventType":"9c42ee639fbd4f77a1802947cbbdbdb5"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*regsvr32.exe"
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*/i:file:*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*.sct*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*scrobj.dll*"
								}
							]
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"!Match",
							"Value":"*http*"
						}
					]
				},
				"EventType":"9c0c0c7a8d37448082c7e66ca529cf81"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*cmd.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*wscript.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*node.exe"
								}
							]
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*app.js*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*==*"
								}
							]
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*.hta\\\" &exit 1"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*sall.js*"
								}
							]
						}
					]
				},
				"EventType":"89e061caa4eb413389a4131ad6f71131"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*adexplorer.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*adexplorer64.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*adexplorer64a.exe"
								}
							]
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*-snapshot*"
						}
					]
				},
				"EventType":"7a97b704e619403eb8cb2b87d18e572e"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*wscript.exe"
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*AppData\\Local\\Temp\\7z*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*AppData\\Local\\Temp\\RarSFX*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*AppData\\Local\\Temp\\Temp*"
								}
							]
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"!Match",
									"Value":"*run.vbs*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"!Match",
									"Value":"*setup.vbs*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"!Match",
									"Value":"*install.vbs*"
								}
							]
						}
					]
				},
				"EventType":"6c88ff244dc349c4bc63a60680ba6053"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"parentProcessPath",
							"Operator":"Match",
							"Value":"searchprotocolhost.exe"
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*cmd.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*powershell.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*whoami.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*nslookup.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*hostname.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*net.exe"
								}
							]
						}
					]
				},
				"EventType":"62e7cf2323b44b2b9d841ac9ca65befb"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*programdata*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*PROGRAMDATA*"
								}
							]
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*.vbs*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*.js*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*.bat*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*.ps1*"
								}
							]
						}
					]
				},
				"EventType":"4758d0c407824641b97b1656337dc9f7"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*reg.exe"
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*reg add*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*REG ADD*"
								}
							]
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*osk.exe*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*sethc.exe*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*utilman.exe*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*magnify.exe*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*narrator.exe*"
								}
							]
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*Image File Execution Options*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*image file execution options*"
								}
							]
						}
					]
				},
				"EventType":"27ae482e72ec446cb6326aaad307787b"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*cmd.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*powershell.exe"
								}
							]
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*^&*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*^ ^*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*^*^*^*"
								}
							]
						}
					]
				},
				"EventType":"170286b86ebf46bba212be0f529936de"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*sc.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*tscon.exe"
								}
							]
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*cmd.exe /k*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*cmd.exe /c*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*sesshijack*"
								}
							]
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*/dest:console*"
						}
					]
				},
				"EventType":"128f8ed928154547be08fd1b175f161c"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"Or",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*powershell.exe"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*cmd.exe"
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"BooleanOperator":"And",
									"Conditions":[
										{
											"Field":"prcs_cmd_line",
											"Operator":"Match",
											"Value":".*1\\\\> \\\\\\\\\\\\\\\\127\\\\.0\\\\.0\\\\.1\\\\\\\\C\\\\$\\\\\\\\.*"
										},
										{
											"Field":"prcs_cmd_line",
											"Operator":"Match",
											"Value":".*2\\\\>\\\\&1.*"
										}
									]
								},
								{
									"BooleanOperator":"Or",
									"Conditions":[
										{
											"Field":"prcs_cmd_line",
											"Operator":"Match",
											"Value":"*echo [a-z]{6} > \\\\\\\\\\\\\\\\\\\\.\\\\\\\\pipe\\\\\\\\[a-z]{6}.*"
										},
										{
											"Field":"prcs_cmd_line",
											"Operator":"Match",
											"Value":"*-nop -w hidden -noni*"
										}
									]
								}
							]
						}
					]
				},
				"EventType":"ffc20ff7793b48ec8940dbdef5c44c9c"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*cmd.exe"
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*/c dir \\\\\\\\*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*/C dir \\\\\\\\*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*/C type \\\\\\\\*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*/c type \\\\\\\\*"
								}
							]
						}
					]
				},
				"EventType":"fee8a4b445e5442e9f404aad01586971"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*rundll32.exe"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*runhtmlapplication*"
						}
					]
				},
				"EventType":"ec69f2a8968c44a98b3e3e9dcaa596a0"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*dsquery.exe"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*-filter*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*trustedDomain*"
								}
							]
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*nltest.exe"
								},
								{
									"BooleanOperator":"Or",
									"Conditions":[
										{
											"Field":"prcs_cmd_line",
											"Operator":"Match",
											"Value":"*/domain_trusts*"
										},
										{
											"Field":"prcs_cmd_line",
											"Operator":"Match",
											"Value":"*/dsgetdc: /kdc /force*"
										},
										{
											"Field":"prcs_cmd_line",
											"Operator":"Match",
											"Value":"*/trusted_domains*"
										},
										{
											"Field":"prcs_cmd_line",
											"Operator":"Match",
											"Value":"*/dclist*"
										},
										{
											"BooleanOperator":"And",
											"Conditions":[
												{
													"Field":"prcs_cmd_line",
													"Operator":"Match",
													"Value":"*/DSADDRESSTOSITE*"
												},
												{
													"Field":"prcs_cmd_line",
													"Operator":"Match",
													"Value":"*/dsgetsite*"
												}
											]
										}
									]
								}
							]
						}
					]
				},
				"EventType":"e76e85b62edb44599a8382be5c9700c5"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentProcessPath",
									"Operator":"Match",
									"Value":"*wscript.exe"
								},
								{
									"Field":"parentProcessPath",
									"Operator":"Match",
									"Value":"*cscript.exe"
								},
								{
									"Field":"parentProcessPath",
									"Operator":"Match",
									"Value":"*mshta.exe"
								}
							]
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*userinit.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*colorcpl.exe"
								}
							]
						}
					]
				},
				"EventType":"dfb99cb077624a398880dce0255a8eb6"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*wmic.exe"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*.xsl*"
						},
						{
							"Field":"parentProcessPath",
							"Operator":"Match",
							"Value":"*node.exe"
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*/format*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*/FORMAT*"
								}
							]
						}
					]
				},
				"EventType":"d43ae1b53a8c4898a232186a11e8e547"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"parentVerdict",
							"Operator":"!Equal",
							"Value":1
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"%systemroot%\\*"
						}
					]
				},
				"EventType":"d1ae282393824e2198eae3a425112494"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*exportrsa.exe"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*exportrsa*"
						}
					]
				},
				"EventType":"d1953c0271fe4f4cb9566666464eecd0"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*WMIC.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*net.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*net1.exe"
								},
								{
									"Field":"parentProcessPath",
									"Operator":"Match",
									"Value":"*cmd.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*wmic.exe"
								}
							]
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"BooleanOperator":"And",
									"Conditions":[
										{
											"Field":"prcs_cmd_line",
											"Operator":"Match",
											"Value":"*SET*"
										},
										{
											"Field":"prcs_cmd_line",
											"Operator":"Match",
											"Value":"*PASSWORD*"
										},
										{
											"Field":"prcs_cmd_line",
											"Operator":"Match",
											"Value":"*FALSE*"
										}
									]
								},
								{
									"BooleanOperator":"And",
									"Conditions":[
										{
											"Field":"prcs_cmd_line",
											"Operator":"Match",
											"Value":"*set*"
										},
										{
											"Field":"prcs_cmd_line",
											"Operator":"Match",
											"Value":"*password*"
										},
										{
											"Field":"prcs_cmd_line",
											"Operator":"Match",
											"Value":"*false*"
										}
									]
								},
								{
									"BooleanOperator":"And",
									"Conditions":[
										{
											"Field":"prcs_cmd_line",
											"Operator":"Match",
											"Value":"*EXPIRES*"
										},
										{
											"Field":"prcs_cmd_line",
											"Operator":"Match",
											"Value":"*NEVER*"
										}
									]
								},
								{
									"BooleanOperator":"And",
									"Conditions":[
										{
											"Field":"prcs_cmd_line",
											"Operator":"Match",
											"Value":"*expires*"
										},
										{
											"Field":"prcs_cmd_line",
											"Operator":"Match",
											"Value":"*never*"
										}
									]
								}
							]
						}
					]
				},
				"EventType":"d00d075592584b178c24501279d53913"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*rundll32.exe"
						},
						{
							"Field":"parentProcessPath",
							"Operator":"Match",
							"Value":"*powershell.exe"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"!Match",
							"Value":"*C:\\\\Windows\\\\ccm\\\\PrepDrv.inf"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"!Match",
							"Value":"*Follow Me Queue*"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"!Match",
							"Value":"*cryptext.dll,CryptExtOpenCER*"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"!Match",
							"Value":"C:\\\\ProgramData\\\\Lenovo\\\\ImController\\\\Plugins\\\\LenovoBatteryGaugePackage\\\\x64\\\\LenovoBatteryGaugePackage.dll*"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"!Match",
							"Value":"\\\"C:\\\\Windows\\\\system32\\\\rundll32.exe\\\" C:\\\\ProgramData\\\\Lenovo\\\\ImController\\\\Plugins\\\\LenovoBatteryGaugePackage\\\\x64\\\\LenovoBatteryGaugePackage.dll, LaunchPinVantageToolbarToast"
						}
					]
				},
				"EventType":"c54981745f11465a95eb7326cacd2c76"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"parentProcessPath",
							"Operator":"Match",
							"Value":"*winzip*"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*wscript.exe"
						}
					]
				},
				"EventType":"ac379b82a2e042a3bf91ce9b3b2ce09f"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentProcessPath",
									"Operator":"Match",
									"Value":"*winword.exe"
								},
								{
									"Field":"parentProcessPath",
									"Operator":"Match",
									"Value":"*powerpnt.exe"
								},
								{
									"Field":"parentProcessPath",
									"Operator":"Match",
									"Value":"*excel.exe"
								}
							]
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*powershell.exe"
						}
					]
				},
				"EventType":"ab996615c55a49bb8c567eb18ea9d7ef"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*$recycle.bin*"
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"!Match",
									"Value":"*printermanager.exe"
								},
								{
									"Field":"path",
									"Operator":"!Match",
									"Value":"*chrome.exe"
								}
							]
						}
					]
				},
				"EventType":"75bc56960c004a2db87a85f189dd763f"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*control.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*rundll32.exe"
								}
							]
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*.cpl*"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"!Match",
							"Value":"*intl.cpl*"
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*temp*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*C:\\\\Users\\\\Public*"
								}
							]
						}
					]
				},
				"EventType":"7172d6686a22414d960b1baf2c0c2222"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*cmdkey.exe"
						},
						{
							"Field":"parentProcessPath",
							"Operator":"!Match",
							"Value":"*microsoft.sara.exe"
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*/list"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*/list:"
								}
							]
						}
					]
				},
				"EventType":"6e09797dea344c41a5de8f64f6b90ddb"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*netsh.exe"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*add*"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*helper*"
						}
					]
				},
				"EventType":"5153a551dd154d8dacfd7fe0d78c4d69"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*netsh.exe"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*wlan*"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":".*key.clear.*"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":".*show.profiles.*"
						}
					]
				},
				"EventType":"4e9fa6d2e6c34871a7971edf05ed2fc7"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*cmd.exe"
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*/V /C \\\"set x=*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*/S /D /c\\\" echo %x:*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*/k echo %time% && timeout 4000 > NUL*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*.log\\\"&& exit"
								}
							]
						}
					]
				},
				"EventType":"4e391caf73b2444fa5e57f02c741de4e"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"Field":"verdict",
					"Operator":"!Equal",
					"Value":1
				},
				"EventType":"4e1885dddf8b428bad867f20e8bdb1a2"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*msbuild.exe"
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*\\\\Windows\\\\Temp*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*\\\\Windows\\\\temp*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*\\\\windows\\\\Temp*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*\\\\windows\\\\temp*"
								}
							]
						}
					]
				},
				"EventType":"4d6a2a84f7ce43f0946313afa7f62fef"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*net.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*cmd.exe"
								}
							]
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*net use*"
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*c$*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*C$*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*ipc$*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*IPC$*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*ADMIN$*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*admin$*"
								}
							]
						}
					]
				},
				"EventType":"22f6efe09ea5483b8271a9d0624f3535"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"cscript.exe"
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*PubPrn.vbs*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*pubprn.vbs*"
								}
							]
						}
					]
				},
				"EventType":"20bde7b8a85547f1896f0cfac4c5b777"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"parentProcessPath",
							"Operator":"Match",
							"Value":"*msbuild.exe"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*userinit.exe"
						}
					]
				},
				"EventType":"1367a054799144d18e0393c96095f6e7"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*reg.exe"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*Credential Providers*"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*add*"
						}
					]
				},
				"EventType":"12c3d36090e647d6ba7e443515c7bb4d"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"parentProcessPath",
							"Operator":"Match",
							"Value":"*winlogon.exe"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"!Match",
							"Value":"*Logon*"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"!Match",
							"Value":"*setupcomplete*"
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*cmd.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*powershell.exe"
								}
							]
						}
					]
				},
				"EventType":"111db5b56c17407c8b98bf893ff61f5e"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*bcdedit.exe"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*off*"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"!Match",
							"Value":"*/set hypervisorlaunchtype off*"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"!Match",
							"Value":"*flightsigning off*"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"!Match",
							"Value":"*testsigning off*"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"!Match",
							"Value":"*nointegritycheck off*"
						}
					]
				},
				"EventType":"0c9f4971312b464fb698bc75e887ef63"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*acw.exe"
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*extensions*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*Extensions*"
								}
							]
						}
					]
				},
				"EventType":"01d1e1bb1ac54203bd350e8cbd790a38"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"Or",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*whoami.exe*"
						},
						{
							"Field":"parentProcessPath",
							"Operator":"Match",
							"Value":"*whoami.exe*"
						}
					]
				},
				"EventType":"d18a23389bbc4176860188631c21b2a8"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*csrss.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*lsass.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*lsm.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*services.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*smss.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*svchost.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*taskhost.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*taskhostw.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*wininit.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*winlogon.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*msdtc.exe"
								}
							]
						},
						{
							"Field":"path",
							"Operator":"!Match",
							"Value":"*\\\\windows\\\\system32*"
						},
						{
							"Field":"path",
							"Operator":"!Match",
							"Value":"*\\\\windows\\\\syswow64*"
						},
						{
							"Field":"path",
							"Operator":"!Match",
							"Value":"*\\\\systemroot\\\\system32*"
						},
						{
							"Field":"path",
							"Operator":"!Match",
							"Value":"*\\\\asus\\\\asus business manager*"
						},
						{
							"Field":"path",
							"Operator":"!Match",
							"Value":"*\\\\winnt\\\\system32*"
						}
					]
				},
				"EventType":"c0c51491591747ecb59833b56a43c4fd"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"parentProcessPath",
							"Operator":"Match",
							"Value":"*wmiprvse.exe"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*cmd.exe"
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*2>&1*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*/Q*"
								}
							]
						}
					]
				},
				"EventType":"b346affda88a4fdf9602b6472a9e8042"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"parentProcessPath",
							"Operator":"Match",
							"Value":"*wmiprvse.exe"
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*cmd.exe /Q*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*127.0.0.1*"
								}
							]
						}
					]
				},
				"EventType":"95eb197f662c4ea2abeb64b9489361f7"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*acw.exe"
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*extensions*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*Extensions*"
								}
							]
						}
					]
				},
				"EventType":"31471a1b693342ddb36f275e08ffae18"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*dir*"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*/ah*"
						}
					]
				},
				"EventType":"112ace36c0dd4d70bacce21111161dc7"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"Or",
					"Conditions":[
						{
							"Field":"parentProcessPath",
							"Operator":"Match",
							"Value":"*\\temp\\*"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*\\temp\\*"
						}
					]
				},
				"EventType":"0a15c8af0eeb4f8abcb063ab9e6f0872"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"parentProcessPath",
							"Operator":"Match",
							"Value":"*explorer.exe"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*svchost.exe"
						}
					]
				},
				"EventType":"ae6e5f57fcd5407ea3f4eb21024a8e1d"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*reg.exe"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*InprocServer32*"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*.dll*"
						},
						{
							"Field":"prcs_cmd_line",
							"Operator":"Match",
							"Value":"*HKLM\\\\Software\\\\Classes\\\\CLSID\\\\*"
						}
					]
				},
				"EventType":"75f7d72e25cf423f80b55e00dd2eca75"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"Field":"parentProcessPath",
							"Operator":"Match",
							"Value":"*tasklist*"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*tasklist*"
						}
					]
				},
				"EventType":"c387556922144f3796fa0c4d68265e5a"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"Field":"path",
					"Operator":"Match",
					"Value":"*t-.exe"
				},
				"EventType":"bd12f60aa4f34a46bfbf02da8f5adf6f"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"Or",
					"Conditions":[
						{
							"Field":"parentProcessPath",
							"Operator":"Match",
							"Value":"*whoami*"
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*whoami*"
						}
					]
				},
				"EventType":"21e792d72afb4f9ab6ec3a5bf2d150be"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentProcessPath",
									"Operator":"Match",
									"Value":"*cmd.exe"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*cmd.exe"
								}
							]
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*calc*"
								},
								{
									"Field":"prcs_cmd_line",
									"Operator":"Match",
									"Value":"*/c*"
								}
							]
						}
					]
				},
				"EventType":"854679db09164723bd1273c48ab30f23"
			},
			{
				"BaseEventType":1,
				"Condition":{
					"Field":"path",
					"Operator":"Match",
					"Value":"*gitl.exe"
				},
				"EventType":"11a53d2b8e31441c9f7f471ba6dc5230"
			},
			{
				"BaseEventType":1,
				"EventType":null
			}
		],
		"RP2":[
			
		],
		"RP3":[
			
		],
		"RR1":[
			
		],
		"RR2":[
			{
				"BaseEventType":4,
				"Condition":{
					"BooleanOperator":"Or",
					"Conditions":[
						{
							"Field":"parentVerdict",
							"Operator":"!Equal",
							"Value":1
						},
						{
							"Field":"parentProcessPath",
							"Operator":"MatchInList",
							"Value":"RegWhiteList"
						}
					]
				},
				"EventType":null
			}
		],
		"RR3":[
			{
				"BaseEventType":5,
				"Condition":{
					"BooleanOperator":"Or",
					"Conditions":[
						{
							"Field":"parentVerdict",
							"Operator":"!Equal",
							"Value":1
						},
						{
							"Field":"parentProcessPath",
							"Operator":"MatchInList",
							"Value":"RegWhiteList"
						}
					]
				},
				"EventType":null
			}
		],
		"RR4":[
			
		],
		"RR5":[
			{
				"BaseEventType":6,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"RegWhiteList"
								}
							]
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Equal",
									"Value":"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
								},
								{
									"Field":"reg_value_name",
									"Operator":"Equal",
									"Value":"DisableTaskMgr"
								},
								{
									"Field":"reg_value_data",
									"Operator":"Equal",
									"Value":"1"
								}
							]
						}
					]
				},
				"EventType":"d16e6c17653b406cad49b60f861839ff"
			},
			{
				"BaseEventType":6,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"RegWhiteList"
								}
							]
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Equal",
									"Value":"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
								},
								{
									"Field":"reg_value_name",
									"Operator":"Equal",
									"Value":"EnableLUA"
								},
								{
									"Field":"reg_value_data",
									"Operator":"Equal",
									"Value":"0"
								}
							]
						}
					]
				},
				"EventType":"2db5471000734de2b313f48d11c2e469"
			},
			{
				"BaseEventType":6,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"RegWhiteList"
								}
							]
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Equal",
									"Value":"HKEY_CURRENT_USER\\Software\\Classes\\Folder\\shell\\open\\command"
								},
								{
									"Field":"reg_value_name",
									"Operator":"Equal",
									"Value":"DelegateExecute"
								},
								{
									"Field":"reg_value_data",
									"Operator":"Match",
									"Value":"*"
								}
							]
						}
					]
				},
				"EventType":"7628b07fb4794a54b78f515cd9e0e911"
			},
			{
				"BaseEventType":6,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"RegWhiteList"
								}
							]
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\*"
								},
								{
									"Field":"reg_value_name",
									"Operator":"Equal",
									"Value":"Type"
								},
								{
									"BooleanOperator":"Or",
									"Conditions":[
										{
											"Field":"reg_value_data",
											"Operator":"Equal",
											"Value":"1"
										},
										{
											"Field":"reg_value_data",
											"Operator":"Equal",
											"Value":"2"
										}
									]
								}
							]
						}
					]
				},
				"EventType":"531e589e6b8546df835491edd2094426"
			},
			{
				"BaseEventType":6,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"RegWhiteList"
								}
							]
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*shell\\open*"
						}
					]
				},
				"EventType":"e4445a4231664c99a93d07bc24a9467f"
			},
			{
				"BaseEventType":6,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"RegWhiteList"
								}
							]
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Active Setup\\Installed Components\\*"
						}
					]
				},
				"EventType":"3c1464cca4974dfcb517c1bcfcba1f49"
			},
			{
				"BaseEventType":6,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"RegWhiteList"
								}
							]
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"*exefile\\shell\\runas\\command*"
						}
					]
				},
				"EventType":"37a1615f7b1d4ad59f41db9e03dcd095"
			},
			{
				"BaseEventType":6,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"RegWhiteList"
								}
							]
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"BooleanOperator":"And",
									"Conditions":[
										{
											"Field":"path",
											"Operator":"Match",
											"Value":"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\*"
										},
										{
											"Field":"reg_value_name",
											"Operator":"Equal",
											"Value":"ImagePath"
										},
										{
											"Field":"reg_value_data",
											"Operator":"Match",
											"Value":"*svchost.exe*"
										}
									]
								},
								{
									"BooleanOperator":"And",
									"Conditions":[
										{
											"Field":"path",
											"Operator":"Match",
											"Value":"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\*\\Parameters"
										},
										{
											"Field":"reg_value_name",
											"Operator":"Equal",
											"Value":"ServiceDll"
										},
										{
											"Field":"reg_value_data",
											"Operator":"Match",
											"Value":"*.dll"
										}
									]
								}
							]
						}
					]
				},
				"EventType":"1c5302cb2be1464096b9ac904058b3d5"
			},
			{
				"BaseEventType":6,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"RegWhiteList"
								}
							]
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Equal",
									"Value":"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds\\Microsoft.PowerShell"
								},
								{
									"Field":"reg_value_name",
									"Operator":"Equal",
									"Value":"ExecutionPolicy"
								}
							]
						}
					]
				},
				"EventType":"0231704b1b334f008736a190541f3b87"
			},
			{
				"BaseEventType":6,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"RegWhiteList"
								}
							]
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Equal",
									"Value":"HKEY_LOCAL_MACHINE\\SOFTWARE\\policies\\microsoft\\windows defender\\real-time protection\\disablerealtimemonitoring"
								},
								{
									"Field":"path",
									"Operator":"Equal",
									"Value":"HKEY_LOCAL_MACHINE\\SOFTWARE\\policies\\microsoft\\windows defender\\real-time protection\\disablescanonrealtimeenable"
								},
								{
									"Field":"path",
									"Operator":"Equal",
									"Value":"HKEY_LOCAL_MACHINE\\SOFTWARE\\policies\\microsoft\\windows defender\\real-time protection\\disableonaccessprotection"
								},
								{
									"Field":"path",
									"Operator":"Equal",
									"Value":"HKEY_LOCAL_MACHINE\\SOFTWARE\\policies\\microsoft\\windows defender\\real-time protection\\disablebehaviormonitoring"
								},
								{
									"Field":"path",
									"Operator":"Equal",
									"Value":"HKEY_LOCAL_MACHINE\\SOFTWARE\\policies\\microsoft\\windows defender\\real-time protection\\disablerealtimemonitoring"
								},
								{
									"Field":"path",
									"Operator":"Equal",
									"Value":"HKEY_LOCAL_MACHINE\\SOFTWARE\\policies\\microsoft\\windows defender\\disableantispyware"
								}
							]
						}
					]
				},
				"EventType":"0185611c334f41b794d781c84064c683"
			},
			{
				"BaseEventType":6,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"RegWhiteList"
								}
							]
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\PROTOCOLS\\Filter*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\PROTOCOLS\\Handler*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Desktop\\Components*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SharedTaskScheduler"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellServiceObjectDelayLoad*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellServiceObjectDelayLoad*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellExecuteHooks*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_CURRENT_USER\\Software\\Classes\\*\\ShellEx\\ContextMenuHandlers*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_LOCAL_MACHINE\\Software\\Classes\\*\\ShellEx\\ContextMenuHandlers*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_CURRENT_USER\\Software\\Classes\\AllFileSystemObjects\\ShellEx\\ContextMenuHandlers*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_LOCAL_MACHINE\\Software\\Classes\\AllFileSystemObjects\\ShellEx\\ContextMenuHandlers*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_CURRENT_USER\\Software\\Classes\\Directory\\ShellEx\\ContextMenuHandlers*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_LOCAL_MACHINE\\Software\\Classes\\Directory\\ShellEx\\ContextMenuHandlers*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_CURRENT_USER\\Software\\Classes\\Directory\\Shellex\\DragDropHandlers*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_LOCAL_MACHINE\\Software\\Classes\\Directory\\Shellex\\DragDropHandlers*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_CURRENT_USER\\Software\\Classes\\Directory\\Shellex\\PropertySheetHandlers*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_LOCAL_MACHINE\\Software\\Classes\\Directory\\Shellex\\PropertySheetHandlers*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_CURRENT_USER\\Software\\Classes\\Directory\\Shellex\\CopyHookHandlers*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_LOCAL_MACHINE\\Software\\Classes\\Directory\\Shellex\\CopyHookHandlers*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_CURRENT_USER\\Software\\Classes\\Folder\\Shellex\\ColumnHandlers*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_LOCAL_MACHINE\\Software\\Classes\\Folder\\Shellex\\ColumnHandlers*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_CURRENT_USER\\Software\\Classes\\Folder\\ShellEx\\ContextMenuHandlers*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_LOCAL_MACHINE\\Software\\Classes\\Folder\\ShellEx\\ContextMenuHandlers*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_CURRENT_USER\\Software\\Classes\\Directory\\Background\\ShellEx\\ContextMenuHandlers*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_LOCAL_MACHINE\\Software\\Classes\\Directory\\Background\\ShellEx\\ContextMenuHandlers*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellIconOverlayIdentifiers*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellIconOverlayIdentifiers*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_CURRENT_USER\\Software\\Microsoft\\Ctf\\LangBarAddin*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Ctf\\LangBarAddin*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Approved*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Approved*"
								}
							]
						}
					]
				},
				"EventType":"fedb6d804cab40a6ad563685534ae482"
			},
			{
				"BaseEventType":6,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"RegWhiteList"
								}
							]
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Equal",
									"Value":"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
								},
								{
									"Field":"reg_value_name",
									"Operator":"Equal",
									"Value":"DisableRegistryTools"
								},
								{
									"Field":"reg_value_data",
									"Operator":"Equal",
									"Value":"1"
								}
							]
						}
					]
				},
				"EventType":"f931a5c6308e41c9854d733367832863"
			},
			{
				"BaseEventType":6,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"RegWhiteList"
								}
							]
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Equal",
									"Value":"*netlogon\\\\parameters\\\\disablepasswordchange"
								},
								{
									"Field":"reg_value_data",
									"Operator":"Equal",
									"Value":"1"
								}
							]
						}
					]
				},
				"EventType":"f5376456c5ad4901b7e77319620a3f4c"
			},
			{
				"BaseEventType":6,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"RegWhiteList"
								}
							]
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\WinSock2\\Parameters\\Protocol_Catalog9\\Catalog_Entries*"
						}
					]
				},
				"EventType":"d1952be09f9641bf81153a2bdea5406f"
			},
			{
				"BaseEventType":6,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"RegWhiteList"
								}
							]
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\*"
								},
								{
									"Field":"reg_value_name",
									"Operator":"Equal",
									"Value":"ImagePath"
								},
								{
									"Field":"reg_value_data",
									"Operator":"Match",
									"Value":"*.exe*"
								},
								{
									"Field":"reg_value_data",
									"Operator":"!Match",
									"Value":"*svchost.exe*"
								}
							]
						}
					]
				},
				"EventType":"caa6808c7c854efca5de8ea5e07baaba"
			},
			{
				"BaseEventType":6,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"RegWhiteList"
								}
							]
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Equal",
									"Value":"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters"
								},
								{
									"Field":"reg_value_name",
									"Operator":"Equal",
									"Value":"DataBasePath"
								}
							]
						}
					]
				},
				"EventType":"bfa803a33bd24305abaf4e37da4bce7b"
			},
			{
				"BaseEventType":6,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"RegWhiteList"
								}
							]
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Equal",
									"Value":"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System"
								},
								{
									"Field":"reg_value_name",
									"Operator":"Equal",
									"Value":"DisableCMD"
								},
								{
									"Field":"reg_value_data",
									"Operator":"Equal",
									"Value":"2"
								}
							]
						}
					]
				},
				"EventType":"b51a5f7ad047492282fe54bdfb1b2cec"
			},
			{
				"BaseEventType":6,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"RegWhiteList"
								}
							]
						},
						{
							"Field":"path",
							"Operator":"Equal",
							"Value":"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun"
						}
					]
				},
				"EventType":"a8ef229f79e94cf7845a83ec8cb1baf4"
			},
			{
				"BaseEventType":6,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"RegWhiteList"
								}
							]
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Equal",
									"Value":"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows"
								},
								{
									"Field":"reg_value_name",
									"Operator":"Equal",
									"Value":"AppInit_DLLs"
								}
							]
						}
					]
				},
				"EventType":"40a7c7b5532a41bebca9cc85626519ec"
			},
			{
				"BaseEventType":6,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"RegWhiteList"
								}
							]
						},
						{
							"Field":"path",
							"Operator":"Match",
							"Value":"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile*"
						}
					]
				},
				"EventType":"11f82664d0034177901df736ccc39d65"
			},
			{
				"BaseEventType":6,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"RegWhiteList"
								}
							]
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Equal",
									"Value":"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager"
								},
								{
									"Field":"reg_value_name",
									"Operator":"Equal",
									"Value":"BootExecute"
								}
							]
						}
					]
				},
				"EventType":"b039c7328e854ac7b5fbdb0076372088"
			},
			{
				"BaseEventType":6,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"RegWhiteList"
								}
							]
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces\\*"
								},
								{
									"Field":"reg_value_name",
									"Operator":"Equal",
									"Value":"NameServer"
								}
							]
						}
					]
				},
				"EventType":"af026a4d209847f6a234ecb87d165552"
			},
			{
				"BaseEventType":6,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"RegWhiteList"
								}
							]
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\System\\Scripts\\Startup*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logon*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*"
								},
								{
									"Field":"path",
									"Operator":"Equal",
									"Value":"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_CURRENT_USER\\Software\\Microsoft\\WindowsNT\\CurrentVersion\\Windows*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_CURRENT_USER\\Software\\Microsoft\\WindowsNT\\CurrentVersion\\Windows\\Run*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run*"
								},
								{
									"Field":"path",
									"Operator":"Equal",
									"Value":"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run"
								},
								{
									"Field":"path",
									"Operator":"Equal",
									"Value":"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logoff*"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\System\\Scripts\\Shutdown*"
								}
							]
						}
					]
				},
				"EventType":"3e15b3f76bd14be59c948a0fc93f55aa"
			},
			{
				"BaseEventType":6,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"RegWhiteList"
								}
							]
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\*"
								},
								{
									"Field":"reg_value_name",
									"Operator":"Equal",
									"Value":"Start"
								},
								{
									"Field":"reg_value_data",
									"Operator":"Equal",
									"Value":"4"
								}
							]
						}
					]
				},
				"EventType":"1dcc953afdb14aa69bed01791e61324c"
			},
			{
				"BaseEventType":6,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"RegWhiteList"
								}
							]
						},
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"BooleanOperator":"And",
									"Conditions":[
										{
											"Field":"path",
											"Operator":"Equal",
											"Value":"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
										},
										{
											"Field":"reg_value_name",
											"Operator":"Equal",
											"Value":"NoAutoUpdate"
										},
										{
											"Field":"reg_value_data",
											"Operator":"Equal",
											"Value":"1"
										}
									]
								},
								{
									"BooleanOperator":"And",
									"Conditions":[
										{
											"Field":"path",
											"Operator":"Equal",
											"Value":"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate"
										},
										{
											"Field":"reg_value_name",
											"Operator":"Equal",
											"Value":"DisableWindowsUpdateAccess"
										},
										{
											"Field":"reg_value_data",
											"Operator":"Equal",
											"Value":"1"
										}
									]
								},
								{
									"BooleanOperator":"And",
									"Conditions":[
										{
											"Field":"path",
											"Operator":"Equal",
											"Value":"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\WindowsUpdate"
										},
										{
											"Field":"reg_value_name",
											"Operator":"Equal",
											"Value":"DisableWindowsUpdateAccess"
										},
										{
											"Field":"reg_value_data",
											"Operator":"Equal",
											"Value":"1"
										}
									]
								}
							]
						}
					]
				},
				"EventType":"0286a9c43d7d470681c322c3fad746c8"
			},
			{
				"BaseEventType":6,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"RegWhiteList"
								}
							]
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"reg_value_data",
									"Operator":"Equal",
									"Value":"1"
								},
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*\\\\currentversion\\\\app paths\\\\control.exe*"
								}
							]
						}
					]
				},
				"EventType":"f94c9f1e43ae4465b91abd8c0ebfc5ce"
			},
			{
				"BaseEventType":6,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"RegWhiteList"
								}
							]
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Match",
									"Value":"*\\\\securityproviders\\\\wdigest\\\\uselogoncredential"
								},
								{
									"Field":"reg_value_data",
									"Operator":"Equal",
									"Value":"1"
								}
							]
						}
					]
				},
				"EventType":"dd2de7db4731477baa3009ff06f71ddd"
			},
			{
				"BaseEventType":6,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"RegWhiteList"
								}
							]
						},
						{
							"BooleanOperator":"And",
							"Conditions":[
								{
									"Field":"path",
									"Operator":"Equal",
									"Value":"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
								},
								{
									"Field":"reg_value_data",
									"Operator":"Equal",
									"Value":"2"
								},
								{
									"BooleanOperator":"Or",
									"Conditions":[
										{
											"Field":"reg_value_name",
											"Operator":"Equal",
											"Value":"Hidden"
										},
										{
											"Field":"reg_value_name",
											"Operator":"Equal",
											"Value":"ShowSuperHidden"
										}
									]
								}
							]
						}
					]
				},
				"EventType":"a5655a55ea564e419a433505fa875f1d"
			},
			{
				"BaseEventType":6,
				"Condition":{
					"BooleanOperator":"And",
					"Conditions":[
						{
							"BooleanOperator":"Or",
							"Conditions":[
								{
									"Field":"parentVerdict",
									"Operator":"!Equal",
									"Value":1
								},
								{
									"Field":"parentProcessPath",
									"Operator":"MatchInList",
									"Value":"RegWhiteList"
								}
							]
						},
						{
							"Field":"path",
							"Operator":"Equal",
							"Value":"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Lanmanserver\\Shares"
						}
					]
				},
				"EventType":"4f2f2ed474cf439e84aa93d0f70673fc"
			},
			{
				"BaseEventType":6,
				"Condition":{
					"BooleanOperator":"Or",
					"Conditions":[
						{
							"Field":"parentVerdict",
							"Operator":"!Equal",
							"Value":1
						},
						{
							"Field":"parentProcessPath",
							"Operator":"MatchInList",
							"Value":"RegWhiteList"
						}
					]
				},
				"EventType":null
			}
		]
	},
	"Lists":{
		"DeleteFileExtensions":[
			"*.app",
			"*.bat",
			"*.cmd",
			"*.com",
			"*.cpl",
			"*.dll",
			"*.exe",
			"*.inf",
			"*.job",
			"*.jar",
			"*.js",
			"*.jar",
			"*.jse",
			"*.lnk",
			"*.msc",
			"*.msh",
			"*.msh1",
			"*.msh2",
			"*.mshxml",
			"*.msh1xml",
			"*.msh2xml",
			"*.osx",
			"*.pif",
			"*.ps1",
			"*.ps2",
			"*.psc2",
			"*.psc1",
			"*.ps1xml",
			"*.ps2xml",
			"*.py",
			"*.pyc",
			"*.reg",
			"*.rgs",
			"*.scr",
			"*.scf",
			"*.sct",
			"*.sys",
			"*.vb",
			"*.vbe",
			"*.vbs",
			"*.vbscript",
			"*.ws",
			"*.wsf",
			"*.wsh",
			"*.chm",
			"*.doc",
			"*.docx",
			"*.docm",
			"*.dotm",
			"*.hta",
			"*.mam",
			"*.mrc",
			"*.mhtml",
			"*.mht",
			"*.otm",
			"*.pdf",
			"*.potm",
			"*.ppam",
			"*.ppsm",
			"*.ppt",
			"*.pptx",
			"*.pptm",
			"*.sldm",
			"*.udf",
			"*.xls",
			"*.xlsx",
			"*.xlam",
			"*.xlm",
			"*.xlsm",
			"*.xltm",
			"*.zip",
			"*.7z",
			"*.rar",
			"*.rarx",
			"*.gz",
			"*.gz2",
			"*.bz",
			"*.bz2",
			"*.cab",
			"*.msi",
			"*.msp"
		],
		"DeleteFileWhiteList":[
			"*\\powershell.exe",
			"*\\cmd.exe",
			"*\\sdelete.exe",
			"*\\sdelete64.exe",
			"*\\cscript.exe",
			"*\\wscript.exe",
			"*\\wmiprvse.exe"
		],
		"EmailPaths":[
			"*\\thunderbird.exe",
			"*\\outlook.exe"
		],
		"InfectibleFiles":[
			"*.lnk",
			"*.wsf",
			"*.hta",
			"*.mhtml",
			"*.html",
			"*.doc",
			"*.docm",
			"*.xls",
			"*.xlsm",
			"*.ppt",
			"*.pptm",
			"*.chm",
			"*.vbs",
			"*.js",
			"*.bat",
			"*.pif",
			"*.pdf",
			"*.jar",
			"*.sys"
		],
		"RegWhiteList":[
			"*\\powershell.exe",
			"*\\regedit.exe",
			"*\\reg.exe",
			"*\\cscript.exe",
			"*\\wscript.exe"
		],
		"WriteFileBlackList":[
			"*\\cmdagent.exe",
			"*\\MsMpEng.exe",
			"*\\RmmService.exe",
			"*\\ITSMService.exe",
			"*\\officec2rclient.exe",
			"*\\PmService.exe",
			"*\\remsh.exe",
			"*\\cfpconfg.exe",
			"*\\ngen.exe",
			"*\\cwagtsrv.exe",
			"*\\edrstart.exe",
			"*\\Code.exe",
			"*\\git.exe",
			"*\\DropboxUpdate.exe",
			"*\\GoogleUpdate.exe",
			"*\\devenv.exe"
		],
		"WriteFileWhiteList":[
			"*\\powershell.exe",
			"*\\explorer.exe",
			"*\\cmd.exe",
			"*\\xcopy.exe",
			"*\\cscript.exe",
			"*\\wscript.exe"
		]
	}
}