From 1df345beedbd0a02c470f6d0e6176ca20e0022f9 Mon Sep 17 00:00:00 2001
From: wagga40 <6437862+wagga40@users.noreply.github.com>
Date: Sat, 2 Dec 2023 10:58:42 +0100
Subject: [PATCH] Update docs and rules

---
 docs/Zircolite_manual.pdf                | Bin 569931 -> 569933 bytes
 docs/_sidebar.md                         |   2 +-
 rules/rules_linux.json                   |  18 ++
 rules/rules_windows_generic.json         | 126 +++++-----
 rules/rules_windows_generic_full.json    | 295 ++++++++++++----------
 rules/rules_windows_generic_high.json    | 126 +++++-----
 rules/rules_windows_generic_medium.json  | 283 ++++++++++++---------
 rules/rules_windows_generic_pysigma.json | 297 +++++++++++++----------
 rules/rules_windows_sysmon.json          | 126 +++++-----
 rules/rules_windows_sysmon_full.json     | 295 ++++++++++++----------
 rules/rules_windows_sysmon_high.json     | 126 +++++-----
 rules/rules_windows_sysmon_medium.json   | 283 ++++++++++++---------
 rules/rules_windows_sysmon_pysigma.json  | 297 +++++++++++++----------
 tools/zircolite_server/requirements.txt  |   1 -
 14 files changed, 1275 insertions(+), 1000 deletions(-)

diff --git a/docs/Zircolite_manual.pdf b/docs/Zircolite_manual.pdf
index 0a0ff3768bc1ad00ee0d89905b0403d406116892..337649b00529bdd1b078842be46887fea5faf003 100644
GIT binary patch
delta 7274
zcmai(RZtvEvxXBSSONr=V2iuUB8$5Og1ZG+++7yi1QsWY1r6?=;KAL42Z!LcI6;D+
zd|#c5|35e9YNn>9-kPfS>FMt3kuBQME!q$8=WrA_DjW@t4u4UHfpr7}iHl=<c)DAe
zJ7N1Snj|hc2TS6Ioj{}7>g--(n9nhW$x0C{EecRlJ~OYQuZbh#3b^CEQ)^|$Vx$rY
zhXwiEJ0`k#f-s*3JZG|AxH)?|?ai*J$Zg1`$oreqBa6sVmtAI(+jec1YMxk)2p;eJ
zTJGoDgPeU#jF8;vRn0I5F)_+0^{DhQOfgYEg4e$pS0$WL>&XL;dm-ys>nD!eOJ<ai
znu->}wwTp+6_uh%VjdxD|7$DQ$sJpL0mf@zJLGWagsvC=%54p;77_;<-6>wG54d_O
zHg(zY8!WxJZ~TyK{Sr@4KooO>+v~GXLJo7c0b2Tc3>MV=#W0LQj@0&3D~UEW0iTRY
z+6Q`C23ssm>f_E{ogKu+vj=zeh*m*-AG0VaW%b}eBFq(rX&{^wGTTj|k3(3L<e-36
z*Ncv6NKYtQOM}Rf<H;=wp2ONvUaOK->4QfCT9YTzI@LsqL@c_WQaVkrGO-K3Gq&pf
zJv8Z~NY!U*<=1t6+oeXnalTdzVWPipAV#>%`d;>jLXVZb1pD8cHR?F?_ZuzS`f<Kr
zy|hU7e|jdxwgF3g{R)sWc8s9{8+Eob)V~_5PWq|-lmjM)-qm~IvQ*G~RLf5j0#S}b
zYDaubKv8|sC*>jJeWm;MC!7y6daA&crhVE{*%fU%mU}%XA=&8Bc3@CaC1JG0P0+*U
zNn`fiTswydsYK=7`0f5fWt{xaV|cksV;7d(ukG+9E6<}UkxNKZ3|t@9sv6Ig-w_$E
zvqH798E~~UHzv4ZAlmAJyT0X05vDfR><n=GY(<j+Zz%h^V#Un1J92!OXC*3@rvGL-
zQLd`|sdkCPc|hw@<MyW6SZ!_-oMe!rLXE14Er70MMptR3EExe&j7X@Egy!sXPrM0Y
zDfvLf9RJM@zlJ>F<LCz%yJLaP)}{(;Ej240&mAaYLCWrBrci`odq_zrT(zLYg_U7m
zk*t9qv+NaCnU*JQsJ%>{y>+oY!EKte)Lt=7ZXVh&pS>auzCAbn&$zV}`=8uGXwt8e
z;bef@JdF^@ixS<zs$4@5qqY%2b2$&!i(z)GVZNO{$utHYDs6Ju)^uvzK05phy`|b-
z_#qZ3$A%1KJ^@nB<9!!f$V-r9{+>N4ejaquS7Sq8(y*7%_hmK}E1HZQi=Te4-o!28
zWZLofS3>!vpiH=3ygQ-<LL_P#kCyO_h=mys=Y#2OEA|e$_p0g4%$;2>oP$_*rd20>
zY=wAz0<Tu@&jTu&Cy;ynUmCd1Fqr;NFn>02Sdzq-TYX@=NYxCkj9u~SBmoMc$V?}L
zvFco+>b%jb*)8vAp4z9fqP1ARtsfpAE{l+j@~u_~I(Z<9B<?KgFL!O{>by?W29!;2
z_C`;>coQ&btZ3V4{P~J&C78AoYjxcw`p5RR#rNT|`Q{dObhhuyyyWYBw{@LzUDFW=
z<%E#W1P$!(#*QgO`qusm${2h6X6G|tTb(L9>51u}y8B4iY%nt*_+({#H#yhtvKZ+3
zJHe%A_-e}Q<Z*4ugYOG_%6c;ibf)^MxT+$+w83A(;76DZDM!@0fog!!Q=^0+yzQt=
z!b*ZN_9Ps(S!?iy3w8Trg)Ieh^~VHwBGzYj%{mBI==bTU?;sPYW>7d~#7IssnEBHJ
z2!Ek6;&30xyBvx9Nf3_w`I;%6u-NFBdOHyVV<<#XI7v-7*HQk8pMJ(CPCHsXQzNp=
zbDnUWrX~E;OwM<(#2^fVEy3O@#r}2DI3+c!iyRoHq+xv;M}$vVfr-a5!|zLig0kKf
zc|lnc-6fOv(pRyhwM!=WO$bK*OJ7%7d#626v?`Nyaqc*~a3-b|%gJ~idm&E6=k@Wt
zz6tc?ELYmkh0TOkr8Qb6A#}=KnGr}bt2m4r5h(r;s&J-ggth~6U)$j|;^mAN*!>?l
zcKdJ%Ce88R{mV+G1D7~%`2!n48FWa)lqZj!MIYyfrZNw_Y_^Oc1&Sds_(jyFkY%o@
zI*^r|nB}t!X<gV$zHoL=;{Go?^WeRHtU!v1nZlEBH`0DzlHSc9j)t(zi<N5f{O%L3
z1R|4}f0>*7jll>L;{LA;@_E#LlN%s^4aMdXdCAaV`IZGPnO+w+HTJp4<j0}0(GUsQ
z5_l-jMFKIdK+I3?T9NG^TNO}TKI%99v)J->xp7+{E5T$%J5aP?w>@Uae|c_{9`sfx
zg=zASDP@#1uZbAZ%GVA2#Qp3JF1%Pg2^dv&)?(4<)IrL32^iqva_Jy&Cz16y_5OCD
zuQx*Q;Ar;@fcM3Ej`8;m{oA6Rnp<C_L}IzsO#1*;iciNK>y=lnTGcPzrL)niWiP5T
z{4ZJws&As*T4D}|8=?lPm@Q2C?!alqJ++EE*FCkVy+yYI;$Nx{1N9!+Ze6A^hGEVa
zO4Fhtx^&RN0=hH?%Tzn+k#`#62}V-R1=Qyg9Dp2tK8wtLXX;NJkv25v7qsVf!;UIh
zQ9c9Bz-Ai?OHe-$9#3p;X@f7HY|Jhn=21<uP1!vd&0VudNLRkciyapu3!WEI#2uEy
zRj(?GGvLf8SCprXaaUy-7>ss3g=GXFWX7;|z`pT7S$B0$p@<SCgbd;z$s|(wFni$`
zcjtnhfAlh1du;W&3FM^;$lR20C1gayvvXPhuGY8`J#WGH85`@wvdvz@?-~(Yo$EFw
zMLpv@J7+kw_rPPy4(h2&3*y-LZEGm$>y?9%b!#Xv7!#vh%<bFzC`8C6y(q2}JVXmk
z2w!YaiXP+qr8|D9{7;&azwZR<U?E@9+HZZ&e*Ra50?6j1na6d~A67i(Z5No5{4i5J
z;<1YN%JcBR!lB)BvN_VUvcsWer0ndPDvrc#;9t%lR~Q1YrKoQ1zm>@ypvlvqU{_WO
zdyy5BGFfNgU=iUgl}K<9>eAu#*cJV%?$j#b2E-&`O6;)W+5J>gB&^QF`KgLS?8me&
z{g|gy9kG0#a~Wdjq1=DLFQ}bk$pp%@esa|}etyxk;QUG83+Kyz9FOvW;!W1ic||y5
zl%^b!5l|Bt@O>=e*ddSyBJdl2+TlMJJJ#N7`~C|k@TI@MQKHj@PK@eJ*AXzw$v<CY
zUlr|rvXBoArCwS(rISHC$7NEh!Nk{hKXf04MW-$${0Y_<Z!{m0y}^__4`<YI<^t+~
z5ZZ}l4T6w2-*`C8l_lBcCEYNMu%pZ@G^w%Dg`;j@lx)oScNt(M6a|gvkWiKgqEyZK
zH`G|<gg+C3d>=nW&KTrA<De*1SJR~~QD)q#kl0{$D@e`3uO^oLOxr>rPDB_`G*~4o
z8-?|{Z!ir$4iHKl%z;SvLE6J3Ai9!;T0f;|#rt}>LV`C^c+QN}iTciRS+N&%wB{U_
zb!3*PUrnD=CL`^fR$HA5mi1p!{H;mUOdJ;1lkXm%DZgC*^RH8H|NPBDg8%g)Bq}?E
zNCHByAEOK!K5zIJeWWf(|KK#8GFl`8`c)uJVFh_}b3G%J!p_PZ;Bk_1x3;%yrIGFp
zcx*ZHlFJ9z6;*p8$8{6ur>ptjlSCHH&?Vj>t0+Y!R%d%0R^m^y+q1>9=6tx8#@owP
zNS0G99$-tzyOlY{&w0712_2lMkr7SoWg~V4Rea&^*;BIcA9o7^$&TcfE7F718h<Z*
zaT;vcVRrV0ZmX94=Dycdum*fgu~Oxf^=Wq5<NKNJ=!Dqf2-zR%bq9&1DHPoh$1+qM
z;oTNDc=-JR7h*^eSR>pO2mmyU7V7KF!%_~*$}mZC%is;n&%yM(42m@Uy+nWr9ZDd>
zb0kp?J}VBso|!cI4W@J`S|B4{1WzTtg-X>Jd?Aq^b6QC~3h9m-MN#<tALqDb$b=G7
zrFf(m`otNm)!*%b`d$=w8OLC?F&}DGGYXXG6OwCJ4E1K3XJZ>_;@G_O?sSY_Sk$v2
zKd7xwoXmL247F*j53A}JoWT3dasBul;V~uiuSpcQ7);OkQsiziXkp#mv)+71sNjYK
zQi3J$ajr|pJd4;n>K>+plwK-gF9WuH>c{GI!M&VBCH;(xQFr(o|5DoY4{^(4%&h^I
zj8W03AO!*1-t6#cJ!rs#c*f-*fZ@PLEMl=*>iqIja}t2&9lho*h&dE;P}8J_J7DNV
zR>O`GG5-60XhEdn3MSq7XTyPsZ9-|L2WiNcJGC4`>MFbaK^98cKe;Vkg{~UrR`>3b
z#L5x@tg%OkN;5n@xDe|sotat(`e=@>zze=CPZt^Q(M=?CYNIRpeEcQNR5_JKAnjv5
zVv)7F+vaE3=Q2B{hanR}_2^l8y5BU}UoQRlT!b42z_xO>OeA`Rm*RDY!3^X7FK821
z?7JoLLr;DK{Owp0o<0SmIab7JI+fl&a|11YaPB7i+XgXuyx?k%>umJ!9y>hzBiF?0
zG|l$3RBx@&Cd}X9?dfnb7AHK_RQ;Z$w3(+3|7o-yDcUiwz0%N}a4tCVFwo%pu<U5K
z6xLODSgvdVD++%Q{#jN;Sa+wOz)HZW*D_F9>|m!>X~-^Gc%MykS?PnvZ!mil|GvMC
zOE1yk&_D&Z58>l|UDYy?<oFeZYh1`AV&k3BbY=O=rs1q1Beb638HiZLGM&*=^Z*Zn
zLT#tfJzq3{d`l`0E~M2}AT>!)O@dbVqK^i`!Yus`#%vW8$1tmIul}Mi4s4l2q;-#L
zC?jN{gtBG)u{RKxz=sA*k8T^5IswF${_cd*0l*z1L&M+zfL;+4!C45UGwpf{;u#2~
zlL2DWB_Kj+Q(Ca?PoaV<S0Y{P+%dq)Xzz21AFfNDL*pDL!s7Sfuj6j~KD%LO>$y8!
zK${Z0>WhrKs-u3b`-kTh{X;r`K_zSyd%z$lhVlHTGi`<rT1$#=9@;zdI$j+D@`EHA
zG_|EL$*JLv(g~Ti7hNIfo2(FxhPR=xj$LnMc>w~8&~K$BhOx&UF4_LgCr(UL%>8M6
z!B`xrTM2Jn&JI%(l39vc`x9*zSs96@aVg%Jy+EZWQ?}r!W#zU*_b>**3RAU6EE#^I
z&`l`5?Ece<?y9d&;=oU6?D{OX4<C!32F<JP`&rm?RmGSbn|<>EVaCt1KVH;X&ijF1
zjo|8&Nlu~sh;zc=9-;8qvrp>5`5<JTh7neKA<er!M0#;LNop)bh*{K)ZcHzWtFV?x
zE&0O~WvR!Y(u`97bSMO)3kFE>#SUZP;6W)F_Bb7odN$`94EjTxhEkI(#oJTI$gGy}
zL3-4)6La9DUMJjyZgP${zYC3rvP94sD0=b3{T&9ZG9p(!;yDUq=NGpv(OO(rUa+-T
zb#WSD!ZHK_$?dF|_C*nS1}7cL(BmWQ35bc2TmzDzIFNmh>Z$mM3QH}#HbeGB9|qKX
z=QK4=PD#liA8Sg?Fj`)E&Dr`5`-E>dp?&81=Rke?WFXMSyH?CBXz<Y_Q*WVbwzXCN
zUD>__3}o%^Bj_)fo-{4@nbqc`)~EKIoKF7iTgzQ6zfC7YqZO|iIjV01${f1Tw8Ojj
z>YgFTcH6aD!Tdit8?c@c<QwP1!9p411|UkGa=1Ny)gpBsdfp@##*8oOr(*d+`QrY<
z{$fT5YFv6Sdn?!O%+X<9MvrT+SVs%X`n(QQEv536DzR_YF0Zh<rT?^Ded<6`7I3Wa
zsQdEEMl-+h>RK5mY^Lb3%nN3O#-%XsAUz`%6Uoh#$U{xw1oI*sAfBw2t>G=LF2$nw
zWk0!Dxn2Itz8zUf^a{t&Ydu}X?UJm@c!M!=kN$NgJ*1gg&`-wV?H-3k8BcO>PlB~R
z_E~xonIkHj`Dj!S{kLY3Z!87E926!ZHp$Ob*?E@a+Kvi;RovRml{Q`nHLTqixjOG>
zDYLCc;$CMg;={&=_^*=>78p!gs;rI#yyhx791buPSSp_<`{o}~v`s0K1>|)Vo817k
zzKXP7HH;s8L)HtHzh^4SudY)KIH#qbrh$?qV9-GEn?*5$WbnGlT%4O;Q==BHWcc)%
zxYp;Qcg@kBSf+5JH<F`r>W%Gmc||H_d&BXOrTYVMaM)XmgSPesGO{!NETRQFp{$sz
z@)M!J#=$twL9&bO3Lr<BLE<r&roEt7vtWCb5PO!)?VD_<35q&P&VeC%VP}g0e|sCV
zjnV4BDx=`$$k){cDkH_i62;Iv3xAO`nLt-=!_P(-Pu)xmdm;u29qwm1yB&^9<73Xl
z`|sHqHDMc4q~Dk~?$yfO(gHJ5Y#O5vh5(+e6oG|+FYq}2uP1ES8;);%3eL7|d77)L
zAkE%!Lc@GV*oD;*opF4jx<WgqwjsTx-^?rn9DJSOtTFvro7kJxFZrT;bo4`22<j=W
zus@xnSYRJ`l+}n~YY}>`)6)>C%23T41)qm{@WDz>MT>dk%vy&_SqmGbw)ognm+6x1
zN21r_+dZFaY~e-&<(Q7wQSww!)i0(o0T27VABY8{*8unuIYAt7zDeu&9VZJh;O?hI
z%;H$-k&H6EkOYIi$Q=F9>OU-IYy~KDawzIpY})4iq_nh>Wu6WU&QQ@oW=AQqnP=v4
zfiR?s0<p0Ayd*<_qUV}8HHN?@W*E5oHP8F8;@Wum<bEAr*XT)_OBA!Mp{XXNVnkR3
z3QZ?%H**Ew_vaU$+}#;DBZDY6Xj$9_@7jZ2M@AP@9WuybzN%BDCoqRUqlZQ*?%}%&
zbFY;RdC{|`dW{iwA^csPBF(~S3FCWJH({IGwnY~#TgeEXKeCG;*5a?T6D&RQ6%h&w
zWC1UxC()$y;yQ_@P`w11p`|VP{@R)J%B@UAsKaJz1H*nKxt$O5wJ(_NUQdSmYWR>*
zAf2ZOrxAHdHeATJ*qfp*_?Uc3fJAzD;ZnVZ{iaxe41AA-A%!b_Hj3d@2}0X51Xi`j
zpGsi%#h2mAO<bmY+P%+T*l=Le3(|-Pi}%Fm3r&DJdj7WFlhYuZT8Zj7cn^Ne9~0eH
z(lCO~N{qy!v{-JX4PHmO5t4JH<W2~{2JOr>B{nq)B_^(JKg?m6GaHj3r_?(#D4fbi
zmbO&5Z)Aia1(f+T&cxT(!k5GiFy{yNVf_c;W75wGwkJiR(jr*y_-%5OxsCJk(@1YV
z4L=#e!b;+$+;f2-w`#80>U<fBN{iUMh^qtJp5bmBGTGWXH&lGLPa7YKs_P~`+EGrW
z1M2h?mqSFiA;Z*%AN+a@DT?!)hDjEU(xYCaN%d-5`PRXi3J#2+O5uw3u>LBJYVQam
zHxn$H!kD|6Ng~t68fR=9DlB^&zHL7~iv~WGq8O(Vx>;?#@RIc!yha!&<ddtX<oLx$
zo4b4{X$NJ8@QR4g!{zAy9rD1Ib!#lhORT7!>Ubym{9y8;CdzAb#<D$i#p&o%xx~oP
zp`!q&P2&E{>?BFys-;^a>=j5*aBf?#3{B`k6Xi6-J&5Paat>v5hmA(P`zdLo=p7Ko
zWhBN^ff&5nA%<@^jqY)*oJ8c*;+-N18x}w0?e2I9HQlm#E#7%wLV4fchmOuFR0Njc
z`|ynkiCo;JawFVnEfXkm_0x?HRlZg!_t*9uOzMaV<MezC@-gX#<@@B@@pGA;?!@l0
z!MqPhH4A5DXadDEj8iTSjLViHeiC@q%u#?$!|W3O9P-tjw2r-3;VR>ij<5g4(A`hx
ztKJ9lD*G~C9y^WYm!e3I<e_RVJYNl&en{j}*85ZYwy#3DPwXwL^tF=QP=mJUTZYsN
za-M>`pl0o67DweiSd~&AUYrusANA7j;hK{@h3DI+(<j*o!zxLl#<~0jj}nH8Qih1)
zlD?~BHu>-deE?In>+SVxg6P8qJ;$%AKj?(_x4$wZb?OxmY&|QzSjW>*_APk>GUn)j
zL1FhhB)>9rr;!GI2|+z}(S45eZvea3ka$h+$k5y6=+NH{Fnw3;WsMSDAi{$AhhwAe
zGMyn-o8i92R}P{!Rw5BeR<To=B-%rn()o2wsK58=&CI~!7s2RVW$FF!<_67fYo)WY
zLcqFx;hK{&i!V|qDooS0p$NuC1Y|mY1kh8ym3naBH~&`oW>q(OBjAH!^JI9GoHu~o
z`MW-%1NgKH+tP7JQPzG8sAq21U15DJK+euT(${G&Zx|;f;Ad9F!GDw)d&3_;v9Y13
z3XW3tz?f++HK1JNecNS@FLat#PG!9E?`2m0tT#gg{k+{zy({DV#E(+FjzmkBUo~_r
z&Tt%&WPJA-Oy<6LqJw+G$|(+oHTS4k1E})rDrs6Y%W`S9Pv{t5WT$M&P=u}v|Akp1
z=<ZzHOFSDsYj1YDO8*pF!}!zcQ|yp^TgCojU@u-0SWLD7PNy4X&JYIZS=kFwUJpk{
zxbW^iJq!KDI+cQ`!sL*)w1AlNar0XVfcUI<!4{U>f<h38wFN|opO1&vnvYLh^#8k&
z@=%4T02BDn`jmghK>d?BaNuk=(r>i@L93COa1}^XS5m?r?`R;MOz$vTlXX~wV}+Aj
z5zlegKJ%U1+BnT^v!BSKKb5CnbL=jVN-+Co^yvw<>amlydmoE0UDqgrImsBzgDC<5
z_M1_~3<S;3RYl`#`gdqz*2rSO4m;lwToq5frkKRyXMxL!m4o)-rK#^$46x@U`KKeB
zRlVbBzst^uX!+2z<dGYe6mLqhniNEQ)m3ZK65JIlP;4mm(?h;-7rf{_-jnm;wpNTk
zs?0)4^<^#-woNKTwc^?Lr;z^6)V)Z|qc-(=*!NS?xHr`C(>SBWFmqvnCD)ZWQ=9y*
z4d&LzUSgejm3yF!o0NB+SQc&$mRGF2dAd>HJyAe(+s1V1#|(hqnTeBw3ca6d{bHeN
ze(|H^3C#7gt~2~Dsvmy-A}Wi53hqES5#9CRXEy7O?EOOe!EeEMPTwg7bD+@z8;r}r
zORgeCW~^16qQFlU6Ri?33pXHQARyy|9r!hqIjL&DCwnIgn5fvC#(Ir90|9bne6w!G
zK5+B>8Sw_~k6umV7-d%$>vdjZ1e+Vkxz7<8ob(;lXM+<M)#8SC+!y#AJKUV;cmUNG
zzuXNxyJl}3a_|ks!xatDE3?etu>|aQ@I@P6(+~}-_XVo0y{&-tX!(+HnTZLk8Hk4O
zR=?)jU}%leJHr+*$NANH;7fP{0sZP;^2MN97i*2hJEaltxA}vXy`da{;5sELwshXn
zt%>uKVG0U#vJVI6H&s(;$l&ocRyA3ye8cg}Z{ldlZ$kCY$1|KXwKo+fdjgoQk_1Kb
z+&|8qD#Wjk1AAbmx;?8_$d*2(BbTya8qG$uk_@wPBGzyvu_=>nS$|GFp?An8-6V|p
z-vUWJh3#vx!z`Mn`X%o0pH5KL;suZV;dsrjN_x;ZvAHrJ!zCGBQte@r_O@;5oFFOF
yvNlt%1nJpNo`1UK|D6;5-MK*Q|4t3f-93HX@vW?}`31m2LOj?E403An*#85?fa5O!

delta 7267
zcmajERag|@7Bvh~Lw8BT(A^;*-AIQZ;Lx2z#|R7(LpMkxE#0j&42>Wm4FW@hbbX%l
z{1^ZEZoa#Hv7U9a*Sq#!@1EFUgzqqZf+9m-K~bQnP&6od69(onL_k^^%M0vj19HLg
zTQ*BEb?TELh*-bmyq?holBbwq6HS-vmm9>+?q$Y`d=vr2;XgmPUgJm$5p2RIcgH=3
zr$pd!HG!L_nx=n#!qlrd<!`P*YD9J&3(MF{I`cMDJ0bAWeaW{gWUIb2iD!FDCw4D)
z&&^UznuY!LUG{E}`CIUZNL_uf?Ed*uQdFiW{L%lkVrgHU(^gOm@bZy!J@AsG*nd9n
zz~#0@kTlE0VsJlo_eA}9zk^EnYapSY17a*<+OUOmwX+DQx6kR{_+7dpv-&tC;A<6R
z&jZ?YS@Os|PC(1!>_;#FLa=!OWp$v90HGh0#1}iLO<)L#O#$hJ<@D>M0!+s-R3IU{
ztXJYI4-A$X0dEqF{Z`b7kq0CXj8Y0A4Cbg0pQg<OG-WdxY`K4jHuHf@+C5Wc)Vt7S
zVb)=GA_Ig?Y%D+Z&m?{XVg61lugK&}3j0MQL44~l47Ss_eIaV&EYu4n`33!jB|+R)
z)rLZR2>m65#lwE<Ape2(QU3@EUBB)-pLkufR>xNx%uYA7h<(&DRz2hnbJDCGJY04i
z@jRt-&fJPkA;cxgm^#7Ggt+)Pm>37_EvhYOzZ8g(`#&^$<FS8Z2-Pai5*MVMvTTI=
znhC}Xx~&^wh{ov6&99l=SJmc-b$HDw>PB}|DCyqTE_+6ieaY}#%%~=Y(Lt^cpN3oW
zd254BeFQ>GZt}0@9!weH%2zRs)?LGiW4hq@t?>P2Ghf7@CnaV*#4nf8LJ2~QU)Axp
zWBBeUqc+#AqtVZAow{#yQvxTy#(R}*iw!O(hUsEp(FxZ!oXl8VQiS^j2-I_xvcf(X
zz1X$#|Bf$1xE<^rdP<okZ0p;GiiF~*urHFZg~m07aU(OtFfgb!yxI*d?UymVEh%^v
zQlQXRDm&t;f-ZsrX{bxeOG*%}7!NCt9XOhzx5X&o2mhgWyu&LZBa%oe>ZwTm$mFoN
zKwmBbEPpo>O;U*)U73|zsk(31fmWFR85%>xHdoHTEmQs@QCmLDw@RmfhX5dKOysD&
z4^zU8p)4?A==|(Bk*V#Xx?eNYMZwkxWSh$*N3lsC2-0?eBx+g7m68*<CMQZ2(lxM-
zf68+hhssWIMUU}GrH`rTfA+7}SF)U%CWq%G6)YF2lew8#v2Z!o0e>bI{PG!8?a^wS
z=zT}w^59KWsyHTI6k~9fs7R#JXZW>1k_##1;F2Sgd@&eeV02m*LDcfW*x=I8LBiJp
zD*txeeDek$wUU<a=)Y><JI7#!2>s7nPBn8|mLX7FzatHCHc;G1SY;-XV`NF!{?dY}
zN_YQf5xbcr)@Fm@rRO@2Q+J+7#m?7mZ|&T#^v<^1;ft5h(-K`(^;_l6(&|8ng!%oL
za&5?ZQ;JwLqErIb2k~a>92J7Fb)N42P@Ws!Iy|*Vuz>VPNz&lkP))h!Jw9I;UW@Wh
zDLNM~pNc&_uHCT_x-G2S%q`K09G_5dlclg_<AEj)e)lTp8(y8yLuh}6{B1t{;zJi4
zFxm>T2|VZ!g`6FWXKSXz-OXaV5XKLBMut7SE8Y2Aw*8H<WP@j1tUc8)EBRD?=Dzd!
z4Ri^^zL5U&B`#P-=!J}76JF|~jB4K~s+u^vNqvUgZwJNSSvB;lS@JgnHrle(sY6GU
zQAdUf*I+!#69sR_XnAi$6!Ap#9CvHt#b|i=jw~>Dj5SwVgz4dRGQw1)Qn7rpeBh(R
zQS@2js;plfqonmuuKsXR)#e8E=BP2d8-lb}MhJBYo1ota769K68kvfCEs291dbXhu
zfd6xFgFy#f5~#nn!5|C!5&o|hBWxD=o26JrTsSvvN0$2z+K_r<r;|R5W;k|cH)FZ~
zN?l8ga7=eKx<P-bqUJ|ZNyj?{?>K=Gl%-tBs2$|oceDzX!dKwRW`Oc%gaoztKRU2e
zdVfA~#h$;FYf0_)eMH-gm51mgp?5X>McnK7P3yDqeEUNJ>Eupvyfrm7%HTP5gElQ2
zURoTCWULU!L>@g`o~#3RThq&#8oUkd!P`g7-t@QOSV`h+dDx0n_rAM7S&Y-!ydl@+
zHyit}=w>c4SRi7e|Cj2Vwq!^?pFWYcA2pDqWR1t75q@i-|MsA>(w#86kM2lRWd3*E
zZTxZ;hE9?<J}f?!Gn!Q+a;T|ik$iC4!|i*XOpPc-Y`1q`+h|;$8;hol0}af~6}BP%
z937+JX6}ysL3Wn8-Y>`b^Y9zG6^P49)BAuIqJ&>JMZJ)~;K?A}L6j7Ww;h=j=eFGs
zVisEtbJWY$()qwqu(4r2?~}4;>$m0LN1wo(s#;46(czsFmu9N<qZ+dtTCMta;DL2L
zMJs%y#<|MxBu3y`(JMB^UqTXQ{VXX7Q+2N7-EO3WUq@b8%s{fFwXemrA=!T@n_iE~
zv(SukG4yMoytj?HNcxTC$%K{^Nn40iT}XK-bdBWTtSX6}R7RduW?<`dq2I;2usbby
zNdJZZ4}EMGfay&*U&D?izd#ObknM&*$sC$ApGWatF+=B*HL&l8w5+E#kLM>(gNSiY
zN+}ruB2cQAn)p9d_}-2egxd2R-|!FE4t;WX5nNWmz?0hZKa^GDd;<D&|By^H|KZ!+
zp;77&OX9;~oR8A;yrtX{f5b8HxTO^Ex}|*Ax4B1x-%CGRt!LZe9fXYcR$iDUB%VLP
zf?#vc{pJ=e$(5$lFP2Lb4v*S5x4;vHZxbkp86QW78-S@zsaZEY0F2Z*j3c4@vUrT*
ziFS$MD#As0vcg25opLp8I|3c1;U}DbEGHYr4k<*zcS0hP-Yuqwoy|v6@n+@^A@&7U
z7IdbU)vyK4N9QNAl~u#I-WU3Uk4+gm*BELLGp9bje}a18^gN)LJynp!TIOgw5HWm0
zZkFl@V_{yvetBB%iZtVz?n_C@5#57NwGJA#cAxcrt58P_w$I0vbowu54@C1+U-zj9
zxvUDdLxQU$rlxKTZgf^vZcpJ?D-C|D$2Uq}%;?bP(%MDlwn4;dGt-oI_*3x;16>gA
zvAyoH6~p{EV=hUC$I~BI-K|>u??wJ7@NTb_xs0^jGqMbKf#2*FAJ%}GR$<@a0((3I
z+m3V7-BpeaX+4RpfX`{sgSN(5${lxhT8tmw<R0da#SixfiP548j4Q=hYNMJ+s98>9
ziIfUEW7?xovEhN#WeJ@%uz<2&%KVUZD>O9Ad_iT^4K@y$Z+sZ_uk^51uz(<|uz=)n
z+dBSw2~LuN=3)}WC_1Y5C^QFGnVLDCgqVc!IxI@p+NiJ0GHi-uDJ@EcpP`6CJmoBl
z(T<2xU!&Z3{Dweh9IG50BcU=-mU(NVt^Fv#5`tY>Bqpt|$k6F{k{#FS=uF?~Ve<UB
zB*gfQP%Ra^D47*TYxZ+#jo_*uJh=C(;O5YOtw7`U-~18#A1C;?ONRevmwY09$kYwX
z*muQ}wbv|}E#($23>H2Fk|H>&{6~6gPblxTWj9x{q`Wrw?FL);CfFW*R}PYuJRCJ#
z9QJt(Q^aQ5`OPV!J7$<t9uO@EskbWzPfqj6XBNI%7E}4HyqyU()fyCBuzJY7!{3X#
zDS38B2?l@2v8uxOU`rPsQ*(s4w`Jow^z1FmF{sI?zOA;CX?5Jrt%YSJv(cEkVKz54
zqvxeCeVpwTuV(Its1vZ!+_X`)v(4m=OW1+xAWMGUPbR$=SS_%IM(e(_!7JdFuLMJu
zx-?!unTUje#i*dVm<>g0%N&9;mV{}dSbz#lVwc6@XQ?TW`PSe=f>GXz7NOma;(^AZ
zpNLPdA2nmwr4)NW%fGOL(8!buK?Rv$s%e}3DM%{@A`SlQoUIC@GLaw~OF3|{Yyc+)
zGni#@Lnsr*Uq~Ji%&{<lPU>VC9wVI9CU~R=Qb$ZuhSTtwTDM&1Q#W1>E|1zzzD)Kt
zuDq6q^s201U2@+%ziM-s)%kCi=<YFCk%cpq?=cu5uPB{FvwfVEhYbbft*C~j{vMOR
zDT&0gzO{ZzzTGb3abl(!urRztrvd9?!isy0<EJfo4HSq8k~^s)GVsS0JnF4%r_iCd
z!7opjox#tGG=IO7FvE?4$(pU~Ml;H+6!i!eC&ISp>4Bm(@IMj~)Q<BGBMkt0X^l%|
zyV^R)BG&3wN^P)7s9_~7Sy>Tg+8@htN(_BGmDD{DbuRCY$%Z|JGF(4FN2zp#p{jI*
zNq=h-B2~2<|H6ORnc|3G0h;aR8SZMhg)V?gIkY=4{}M?!q`gZe=)g2}y?m5DonPe$
zsrTuSpm_awR;C`|I~6BlPI^IS?G6#dvT;oz!6nG>dB9+Ui2RRglePYnfCf+RNCKVN
zlV7ONFc-@S%3Ug!<=s34mp{4oy~YoDV7WxcH&fYYz4Tc-I=WSC=W?0je3@&uRqvJ%
zY4HKOxJ@QXOjp#KQ&e>DcN4r!lprK~7xh;Iy%~02f--g;&o5e*np$wfRhNwRAVV70
zo!;dJn#%URH}U$w4?L|mPFfkWw5G!OfogXa@(8EX6NH0KD@FkAjr0f2ntIl&Cf=5=
z#%}M`EFSAXQa}I61341A<?I?Wn-PO+g*8bE!<s*bpk3Ofdke{Uk0W=X-ZZM+%|m+p
zFyMF=77K0+S=1msn=l(5;Xj{&Sjw^MLAmNb>xK)kMGP>YaA$3i+T-q~vSTKCVG`X?
zs{D@FNF*s>x0DkU18lZnKI)1Aod~F#w8w>1GKoqx0N$m9DN5-YfcLt8HHs%S0Kw54
z1v-0)%l!t%>`)0kuqZJGn6KYu4()Ag*WvBic9-<f{O=s9p~%Q=46hu5!l7BKlg<_@
zt@9g<anR_;e@Z28m3qP;D*NAX+HK<GwbDZL6aqo(neU;=@OvvkIW^)Dw9WD^NBQ`7
z-D81CQx&E1UlmW5yBjI&L;>cMn#_R-D2nu_)xjl{qfjCTl5LIGKcHk9o}*t|{d_c3
z;Us$I+oOUmq$x2Dk$5b8;mAaBCH3j=Ni&<m#A~u3y5sCP4axqYg!VvmP|(IJA7gC_
zCt>0b?i6w`2BLH*!OxkkAu4n)IZIS2b^Nyr{Dn=nA_dID3rzNYK6ND^6%z`<os}P%
zyYb@S=CMt*SaDERB(B{-gms@D-~Of*Ut1UpQzjNUAc@NpH7paAa^R8KIS{pq^mjj*
z<;8c1EZ-n=UKmJCJ@%8quK3wD(kCZL28y60jUNr^vI6~0EP8o-$k6PAPlWN5H6MvX
z;uI|4vFJolzk;<kkEm%uI6uu}Gh?Y71BOZ_lIxJp*|<bz$`AfSOsR>SL=rNuRBSZs
z+#%xWP}#PmaeqZY{_){)0B{nSp`a9G<k1EZ1|T*5rB#vgPwvj=sfDv<?Cvt}efBy5
z?vdU2#A5S)>w7cN{?+YD>dK?q4NNzj_2i8D<+S0&;I!(<-A>1xt8D(Lx0j-^vo}9C
zes9;AvSMs$<p^vZVhd%Xy}o&AB*dxPY0<!Q-bR`-+~_Fy7?8{E=_8cOn;v&}v?~UY
zF26l%>QJNz^du$7sQ!d>&QY)oFmhokvQa3uz$-sTr`C#7i+dNR9;c<*gd6^oWM|W*
zz1($=eD_s+@#>9*n;NQ*!P*ZSr^rU;Jo5HfWRfL&k*ai9+pOOA_9io*rxu^p&t~h3
z24?4#F53oQ&RdYo<II14s(d5JlI_nA$^EVnR_(fV%ZQ#XW5^;bB3#I1!W~f593*8j
z@vFGGNLIFrr_<K7GoZib!;&V+Of;i}&Hz}}^>6wl(TwS&{x%nLB=cll>J~0<b3Jz#
z6qoltbO3QOP@0Np0)uIC-ZP684mgwlZ6Ob6q%B*8uB{C&3GB5B?-_2kH(lgH_5o8B
z+{fbWglmpcodZt4n!l~KY<9%ixIArel?Z<)a@Fs)(hooj*W$ZP<;wR&cq{*0yH=!G
zD89CpLO{Xb^o3|G9q5k4SAcvB{a1jT5$X>&O4-Hl6V)QG^b4B4T-J19*R=elzg7B^
zd&F3};o}rumDU*SY4&QijD`UU32?k;Q1AO%e`UVzjEj4hJrZ;DHAiC@V?HCN$5da1
z+}h>uK^HY|mA~Ezudairce`lM0yWtbLojTrD;)`l2Cg=sM|-z7zjIxba~hNtl((kA
z^EMa+IVz}=Pr|wxK5_NL2zD1UPk$5HyG0D8hUOb(ujIGiMqlRp=vmi7+{TvJVxsl^
z=uy%Yb6!-1*&El%cMn%~ufXVH=5cRzqBRvpvVZx;gz=gFpaBI*n8(*vRT<aN*yClD
zniUF>5fUVqPIC-DV!LRIk&?y6y5Ua6X-CW~dVK&%riXs^Gm0=+1Qs6G8QG6u$FhH$
zQnd*L=n;cAf$uqT(BIZUT2Xhg_w2Pd{oe^Bj{BvhaFn#l?g(*Z{w_{+gu^y;dcerK
zJ9seaBH|kW@=_`C_ar5mzh%TI=8N{P%0As9-!~J?D&#9>x5fpCO;Rlb$`a(@IX|mH
ztqnaG398)5-l9220Nu?{k<^T3BPi_vQAm}u)oE?J=k&#OXb$BN<ObR23Q-!feHjpn
z>TTl2_h1=Z=b<FZz5ylJxu<k)oKU4uO&^MBEM5gUj#3U+ZWS0|4`4%jWr|8sl7=pd
zE=3c|$9g7EB*Tx)szH`gYoV~Qb$}6wi7bawO^m4^#(<K{sK^2ah|^HG&u>UDlKz(1
z!~8fbRo8-A7d`?}V5y(G^%Ku#55{UQvBHriyont<s1gQ`)y)_-DJ#DYLZ6*M(=F2e
zPCAC-Et=T%b9F{apLK@l6!QRy^60?$Jw6jB;O+IdxRe+BnMgk!-`6w<*IDA(_y#pQ
zUW6*nwxk<Z;*5%pMl#p8zM5QJs#8KL0fk|<_JElt!*3rUpCokoaXKu2%BUf^^rcM?
z-{DlhgOi>f*wZBZ!d#W0Qks>WCQ<uSKQr;Akle;W#h3HBB5?Dz75!4mXl!}8@ma@%
zWRaO^617Jw>dT^iyIMrcU9bjr$~|R9_HAg(ufVo7b@|O%?TpX&^GEikW~-(4VWX%0
zgo0NDI3AsCkj`Hfy>;G)MtVbtUmjBh5^{l}^MuQ)+Tr`$2tfCsNVZ{Xar7)zHk(WL
zB3@eSISdwDA5TMru%`)(VqC5*#^=Q5wI`UE9m16v5RO5~9-5WIDD_uy(w#PE@W4My
zg)xUaW9;KPdFRBmR9M=(IdHuGh)$@UwmCzbSK#gm*{z^1DyQtMA6RC0-Sy^<&=)u{
zR5l7(UG8Ad38t^eT}u736gxjFlqS$pIB8s56JM~|;M)q}DOM7b{%Uvsy)pc}DAqz*
z%OXEt`sHqSbOkZz$Fj2~>n&B-bK1j`zFW4vWJBt`JrAzWfvi$$R=$O=9$f|LPL?%R
z<!)m_zOIAsyvbc%U2EW4Us1)MbYE>p?rvF1cZbr#dhL=-#3hHhrzW>gZ4OyKUlA_Z
zd&ss(wo-PNJV+6OukmzpK~=Z}QleAvgL#XJx&6!eJ8;7z_Lu5}7CaS(6NenH>-`&k
z5cRymH1N%5<81R-Tccmh+e<T7w;Z&&5u0_8=c^6{g|hAU&20H+e-ieb{(VnUChH!C
zCQ8$3)~ero^Bjo0YKFeM?y&k(CFGKl-;I9Vy|>i3q$n)Q(Xh~ox@a8>sPrp+*Krqo
z_23+{#*7sm!1md-vg`H?u`xev!1g#(ZYff+)dS;@yU|q~6)}+1Vb1(Z#a~_&B4*G5
zVQ|(PtkE09FHkExFVy$AsVIun+ntz!CD^%{6n-LY{k45(RmbdH#~gJEf*r3K#p1a%
zu)VY1{CmozK(^FayJ()5iQzX3vw(4g*6J{iAnPAAzD?!clr|lAZ^@y_@AAJVo5|5{
zMCgnrhx9w73_2^4MP0sWP+{*JkqbV7jP&_`;S%FGVJ|0*+@^qL9sh|5{KQ$9!5O^Y
zTv7C^!V*KfWcX3L6cCutaZTkoy}#sE+%J)x0Uzd+JBaKM(d+ZkIIkQe*>o)3aDlP=
zA#7sM_1s%ZA)KVttQXHjKw380C-8x6-2~aXEo>`D1sBmIoyyf9U)Q#2?e7h_c<hH=
zF7RX&Jf1u21j(;*JewgF7M~fLSX@17)D)xM8L`RP=JEu}z4WD#BA0!!P1s!5PrNVa
zDvsOo%oUN>cTKn}?9zFbc6)SRd%Q**^}i@n$sx|$tVG%`%{)aHLz=5hfAfoZoF?&t
z_Ft3%$InS`7QMetuLFbV!kY9Z7&<2l87^*+$-}4AFQgOt+-ZX)-$;juba3V-C>P@5
zYP@{eSx*!$Oc$0WtI~Ww*ZdIWmMkVE(-OtBFi=M%Kj7Ya^+Wfz=li+l?jx1h7{^9N
zTn&I*&QeTN*cv1tE&vj=6cHEVw*raT3J8dSL~U)wZTR^Gr6vDgh>XV?fHFkz|DPR%
z=an_|bx4NJ0||q*2r#sD*cnxl@Hnud3ILY!&WnmiXh#5%BTJ(rH0<m6ZqO+|Kfi~~
z)=(U0Tr@xb&}YGyz~7G-yE&I@8m=cfI%*a70iq?(mF_t5z8V95M^UPalyAhZ^wmsH
z$I=*`!2RgsUm=#{94CteRD~sJo+FJSDRF!>bLFB7V^z81e%h_0c_tBBX#vEDJZoO(
z7(7JQVq8qCp=#$2I~~Gy&8Vsgt3tH+gkE%*Y(J9wz!v0N?fJM{VW=N8QawY5(liF)
z6$~BE^hF0zRV$IIh-SKCSF`jctC@0ek1|kH&gYQNLR^%81sPI&b~32f?jQuCj3${>
zKd@b0Q$)-xcRas5T4lP)#}A6d4x?)HDI9$d!n^)yxXS9E(9Y^I`sXvy>Ch$>JTZYe
zv#=spk=e<Qd+CnE^MfSkQ;NI5yB`&qF?02=GPbdVTJ4!@`h<<659>Kgt=Ru;%TPoA
zJmU;8h(SoO-6?E0+^Ivc-GR1SY}9d9?p$P+zDJ?kb%5b*h4DUtoX|nzFu{7($-X5q
zj6F+{$^JXz_$m+XKOcENL{hmkx%Ped9c${&>DnK$NLA(j=Hz>B8}`G7>jx;zgPo_p
zXA%EloAxAmNhI)G;H2NGjSl~#FztZ6A4S4PTw2JWpdYo?hN@&l*|}uipqC#q@229n
zL2^IR+702ZxL@b!YXhc!bf+I_)&>J_k?6MNgP>Dqn9_rLImt`oyrXI>tdh4^PiZu>
z6ca<PQDpZ;OC7euB8qN*l^eOArjNdB<9w&bSy<S^uYtty)|!RHdEFhy!A})=AUhq8
zlpBx>ql%zbRF@~!4C+D`<)|IJ$u14guPs(VK-M>2Sv%Luli0~QTjOcT#Z6|9rk+MF
z86;})3qFcHJ2-aIyy8kL23g60VqVQV#xAGVX*tK^jlf}t2fyk=sFPFbJqAI=Pu71~
o+4}!G5dN#&EFJ%y3qhV>KTjK5tPGh302)95i<wzbO9|`$08^p{b^rhX

diff --git a/docs/_sidebar.md b/docs/_sidebar.md
index 248d653..ce16384 100644
--- a/docs/_sidebar.md
+++ b/docs/_sidebar.md
@@ -8,7 +8,7 @@
 
 * Advanced use
     * [Working with large datasets](Advanced.md#working-with-large-datasets)
-    * [Keep data used by Zircolite](#keep-data-used-by-zircolite)
+    * [Keep data used by Zircolite](Advanced.md#keep-data-used-by-zircolite)
     * [Filtering](Advanced.md#filtering)
     * [Forwarding detected events](Advanced.md#forwarding-detected-events) 
     * [Templating and Formatting](Advanced.md#templating-and-formatting)
diff --git a/rules/rules_linux.json b/rules/rules_linux.json
index 6e78d8c..1ac4d01 100644
--- a/rules/rules_linux.json
+++ b/rules/rules_linux.json
@@ -2373,6 +2373,24 @@
         ],
         "filename": "proc_creation_lnx_susp_java_children.yml"
     },
+    {
+        "title": "Potential Linux Process Code Injection Via DD Utility",
+        "id": "4cad6c64-d6df-42d6-8dae-eb78defdc415",
+        "description": "Detects the injection of code by overwriting the memory map of a Linux process using the \"dd\" Linux command.",
+        "author": "Joseph Kamau",
+        "tags": [
+            "attack.defense_evasion",
+            "attack.t1055.009"
+        ],
+        "falsepositives": [
+            "Unknown"
+        ],
+        "level": "medium",
+        "rule": [
+            "SELECT * FROM logs WHERE (Image LIKE '%/dd' ESCAPE '\\' AND CommandLine LIKE '%of=%' ESCAPE '\\' AND CommandLine LIKE '%/proc/%' ESCAPE '\\' AND CommandLine LIKE '%/mem%' ESCAPE '\\')"
+        ],
+        "filename": "proc_creation_lnx_dd_process_injection.yml"
+    },
     {
         "title": "Decode Base64 Encoded Text",
         "id": "e2072cab-8c9a-459b-b63c-40ae79e27031",
diff --git a/rules/rules_windows_generic.json b/rules/rules_windows_generic.json
index f6c0db9..d4dcefe 100644
--- a/rules/rules_windows_generic.json
+++ b/rules/rules_windows_generic.json
@@ -2880,7 +2880,7 @@
     {
         "title": "Potential Svchost Memory Access",
         "id": "166e9c50-8cd9-44af-815d-d1f0c0e90dde",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential access to svchost process memory such as that used by Invoke-Phantom to kill the winRM Windows event logging service.",
         "author": "Tim Burrell",
         "tags": [
@@ -3375,7 +3375,7 @@
     {
         "title": "Malicious PowerShell Scripts - PoshModule",
         "id": "41025fd7-0466-4650-a813-574aaacbe7f4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of known offensive powershell scripts used for exploitation or reconnaissance",
         "author": "frack113, Nasreddine Bencherchali",
         "tags": [
@@ -4654,7 +4654,7 @@
     {
         "title": "Malicious Nishang PowerShell Commandlets",
         "id": "f772cee9-b7c2-4cb2-8f07-49870adc02e0",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects Commandlet names and arguments from the Nishang exploitation framework",
         "author": "Alec Costello",
         "tags": [
@@ -4692,7 +4692,7 @@
     {
         "title": "DNS Query for Anonfiles.com Domain - Sysmon",
         "id": "065cceea-77ec-4030-9052-fc0affea7110",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects DNS queries for \"anonfiles.com\", which is an anonymous file upload platform often used for malicious purposes",
         "author": "pH-T (Nextron Systems)",
         "tags": [
@@ -5641,7 +5641,7 @@
     {
         "title": "Potential DLL Sideloading Of Non-Existent DLLs From System Folders",
         "id": "6b98b92b-4f00-4f62-b4fe-4d1920215771",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects DLL sideloading of system dlls that are not present on the system by default. Usually to achieve techniques such as UAC bypass and privilege escalation",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -6529,7 +6529,7 @@
     {
         "title": "Suspicious Startup Folder Persistence",
         "id": "28208707-fe31-437f-9a7f-4b1108b94d2e",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when a file with a suspicious extension is created in the startup folder",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -9905,7 +9905,7 @@
     {
         "title": "Potential Exploitation Attempt From Office Application",
         "id": "868955d9-697e-45d4-a3da-360cefd7c216",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects Office applications executing a child process that includes directory traversal patterns. This could be an attempt to exploit CVE-2022-30190 (MSDT RCE) or CVE-2021-40444 (MSHTML RCE)",
         "author": "Christian Burkard (Nextron Systems), @SBousseaden (idea)",
         "tags": [
@@ -10803,7 +10803,7 @@
     {
         "title": "Potential CVE-2022-26809 Exploitation Attempt",
         "id": "a7cd7306-df8b-4398-b711-6f3e4935cf16",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious remote procedure call (RPC) service anomalies based on the spawned sub processes (long shot to detect the exploitation of vulnerabilities like CVE-2022-26809)",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -10909,7 +10909,7 @@
     {
         "title": "Potential Centos Web Panel Exploitation Attempt - CVE-2022-44877",
         "id": "1b2eeb27-949b-4704-8bfa-d8e5cfa045a1",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential exploitation attempts that target the Centos Web Panel 7 Unauthenticated Remote Code Execution CVE-2022-44877",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -11379,7 +11379,7 @@
         ],
         "level": "high",
         "rule": [
-            "SELECT * FROM logs WHERE (EventID = '4688' AND Channel = 'Security' AND ParentProcessName LIKE '%\\\\ws\\_tomcatservice.exe' ESCAPE '\\' AND NewProcessName LIKE '%\\\\repadmin.exe' ESCAPE '\\')"
+            "SELECT * FROM logs WHERE ((EventID = '4688' AND Channel = 'Security') AND ParentProcessName LIKE '%\\\\ws\\_tomcatservice.exe' ESCAPE '\\' AND NOT ((NewProcessName LIKE '%\\\\repadmin.exe' ESCAPE '\\')))"
         ],
         "filename": "proc_creation_win_apt_mint_sandstorm_log4j_wstomcat_execution.yml"
     },
@@ -12156,7 +12156,7 @@
     {
         "title": "Potential Exploitation Attempt Of Undocumented WindowsServer RCE",
         "id": "6d5b8176-d87d-4402-8af4-53aee9db7b5d",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential exploitation attempt of undocumented Windows Server Pre Auth Remote Code Execution (RCE)",
         "author": "Florian Roth (Nextron Systems), Nasreddine Bencherchali",
         "tags": [
@@ -13528,7 +13528,7 @@
     {
         "title": "Suspicious AppX Package Locations",
         "id": "5cdeaf3d-1489-477c-95ab-c318559fc051",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an appx package added the pipeline of the \"to be processed\" packages which is located in suspicious locations",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -15522,7 +15522,7 @@
     {
         "title": "DNS Query for Anonfiles.com Domain - DNS Client",
         "id": "29f171d7-aa47-42c7-9c7b-3c87938164d9",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects DNS queries for anonfiles.com, which is an anonymous file upload platform often used for malicious purposes",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -16712,7 +16712,7 @@
     {
         "title": "Restricted Software Access By SRP",
         "id": "b4c8da4a-1c12-46b0-8a2b-0a8521d03442",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects restricted access to applications by the Software Restriction Policies (SRP) policy",
         "author": "frack113",
         "tags": [
@@ -17444,7 +17444,7 @@
     {
         "title": "Renamed Plink Execution",
         "id": "1c12727d-02bf-45ff-a9f3-d49806a3cf43",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed version of the Plink binary",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -18056,7 +18056,7 @@
     {
         "title": "Potential Persistence Via Powershell Search Order Hijacking - Task",
         "id": "b66474aa-bd92-4333-a16c-298155b120df",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell \"Get-Variable\" technique as seen being used in Colibri Loader",
         "author": "pH-T (Nextron Systems), Florian Roth (Nextron Systems)",
         "tags": [
@@ -18351,7 +18351,7 @@
     {
         "title": "SQLite Chromium Profile Data DB Access",
         "id": "24c77512-782b-448a-8950-eddb0785fc71",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect usage of the \"sqlite\" binary to query databases in Chromium-based browsers for potential data stealing.",
         "author": "TropChaud",
         "tags": [
@@ -18690,7 +18690,7 @@
     {
         "title": "Renamed NetSupport RAT Execution",
         "id": "0afbd410-de03-4078-8491-f132303cb67d",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed \"client32.exe\" (NetSupport RAT) via Imphash, Product and OriginalFileName strings",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -19024,7 +19024,7 @@
     {
         "title": "HackTool - Inveigh Execution",
         "id": "b99a1518-1ad5-4f65-bc95-1ffff97a8fd0",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -19224,7 +19224,7 @@
     {
         "title": "Disabled RestrictedAdminMode For RDS - ProcCreation",
         "id": "28ac00d6-22d9-4a3c-927f-bbd770104573",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect activation of DisableRestrictedAdmin to disable RestrictedAdmin mode.\nRestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.\nThis prevents your credentials from being harvested during the initial connection process if the remote server has been compromise\n",
         "author": "frack113",
         "tags": [
@@ -19421,7 +19421,7 @@
     {
         "title": "HackTool - SafetyKatz Execution",
         "id": "b1876533-4ed5-4a83-90f3-b8645840a413",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the hacktool SafetyKatz via PE information and default Image name",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -19617,7 +19617,7 @@
     {
         "title": "Potential Renamed Rundll32 Execution",
         "id": "2569ed8c-1147-498a-9b8c-2ad3656b10ed",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when 'DllRegisterServer' is called in the commandline and the image is not rundll32. This could mean that the 'rundll32' utility has been renamed in order to avoid detection",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -19730,7 +19730,7 @@
     {
         "title": "PUA - DefenderCheck Execution",
         "id": "f0ca6c24-3225-47d5-b1f5-352bf07ecfa7",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of DefenderCheck, a tool to evaluate the signatures used in Microsoft Defender. It can be used to figure out the strings / byte chains used in Microsoft Defender to detect a tool and thus used for AV evasion.",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -19999,7 +19999,7 @@
     {
         "title": "Suspicious Hacktool Execution - Imphash",
         "id": "24e3e58a-646b-4b50-adef-02ef935b9fc8",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -20389,7 +20389,7 @@
     {
         "title": "Microsoft IIS Service Account Password Dumped",
         "id": "2d3cdeec-c0db-45b4-aa86-082f7eb75701",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords",
         "author": "Tim Rauch, Janantha Marasinghe",
         "tags": [
@@ -20880,7 +20880,7 @@
     {
         "title": "Potential WinAPI Calls Via CommandLine",
         "id": "ba3f5c1b-6272-4119-9dbd-0bc8d21c2702",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -20960,7 +20960,7 @@
     {
         "title": "PUA - Seatbelt Execution",
         "id": "38646daa-e78f-4ace-9de0-55547b2d30da",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -21023,7 +21023,7 @@
     {
         "title": "Potential Arbitrary Code Execution Via Node.EXE",
         "id": "6640f31c-01ad-49b5-beb5-83498a5cd8bd",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution node.exe which is shipped with multiple software such as VMware, Adobe...etc. In order to execute arbitrary code. For example to establish reverse shell as seen in Log4j attacks...etc",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -21224,7 +21224,7 @@
     {
         "title": "HackTool - SharPersist Execution",
         "id": "26488ad0-f9fd-4536-876f-52fea846a2e4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the hacktool SharPersist - used to deploy various different kinds of persistence mechanisms",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -21266,7 +21266,7 @@
     {
         "title": "Uncommon One Time Only Scheduled Task At 00:00",
         "id": "970823b7-273b-460a-8afc-3a6811998529",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects scheduled task creation events that include suspicious actions, and is run once at 00:00",
         "author": "pH-T (Nextron Systems)",
         "tags": [
@@ -21872,7 +21872,7 @@
     {
         "title": "Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE",
         "id": "07f8bdc2-c9b3-472a-9817-5a670b872f53",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of cmdkey to look for cached credentials on the system",
         "author": "jmallette, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -21948,7 +21948,7 @@
     {
         "title": "Operator Bloopers Cobalt Strike Modules",
         "id": "4f154fb6-27d1-4813-a759-78b93e0b9c48",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects Cobalt Strike module/commands accidentally entered in CMD shell",
         "author": "_pete_0, TheDFIRReport",
         "tags": [
@@ -22590,7 +22590,7 @@
     {
         "title": "HackTool - KrbRelayUp Execution",
         "id": "12827a56-61a4-476a-a9cb-f3068f191073",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -22941,7 +22941,7 @@
     {
         "title": "Disable Windows IIS HTTP Logging",
         "id": "e4ed6030-ffe5-4e6a-8a8a-ab3c1ab9d94e",
-        "status": "experimental",
+        "status": "test",
         "description": "Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union)",
         "author": "frack113",
         "tags": [
@@ -23678,7 +23678,7 @@
     {
         "title": "HackTool - KrbRelay Execution",
         "id": "e96253b8-6b3b-4f90-9e59-3b24b99cf9b4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of KrbRelay, a Kerberos relaying tool",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -23755,7 +23755,7 @@
     {
         "title": "HackTool - PowerTool Execution",
         "id": "a34f79a3-8e5f-4cc3-b765-de00695452c2",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the tool PowerTool which has the ability to kill a process, delete its process file, unload drivers, and delete the driver files",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -23852,7 +23852,7 @@
     {
         "title": "Potential Credential Dumping Attempt Using New NetworkProvider - CLI",
         "id": "baef1ec6-2ca9-47a3-97cc-4cf2bda10b77",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -23871,7 +23871,7 @@
     {
         "title": "Potential Recon Activity Via Nltest.EXE",
         "id": "5cc90652-4cbd-4241-aa3b-4b462fa5a248",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects nltest commands that can be used for information discovery",
         "author": "Craig Young, oscd.community, Georg Lauenstein",
         "tags": [
@@ -24086,7 +24086,7 @@
     {
         "title": "HackTool - SharpLdapWhoami Execution",
         "id": "d9367cbb-c2e0-47ce-bdc0-128cb6da898d",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -24127,7 +24127,7 @@
     {
         "title": "SafeBoot Registry Key Deleted Via Reg.EXE",
         "id": "fc0e89b5-adb0-43c1-b749-c12a10ec37de",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of \"reg.exe\" commands with the \"delete\" flag on safe boot registry keys. Often used by attacker to prevent safeboot execution of security products",
         "author": "Nasreddine Bencherchali (Nextron Systems), Tim Shelton",
         "tags": [
@@ -24203,7 +24203,7 @@
     {
         "title": "Suspicious Binary In User Directory Spawned From Office Application",
         "id": "aa3a6f94-890e-4e22-b634-ffdfd54792cc",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an executable in the users directory started from one of the Microsoft Office suite applications (Word, Excel, PowerPoint, Publisher, Visio)",
         "author": "Jason Lynch",
         "tags": [
@@ -24417,7 +24417,7 @@
     {
         "title": "Suspicious Hacktool Execution - PE Metadata",
         "id": "37c1333a-a0db-48be-b64b-7393b2386e3b",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -24743,7 +24743,7 @@
     {
         "title": "PowerShell Base64 Encoded WMI Classes",
         "id": "1816994b-42e1-4fb1-afd2-134d88184f71",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects calls to base64 encoded WMI class such as \"Win32_Shadowcopy\", \"Win32_ScheduledJob\", etc.",
         "author": "Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -24784,7 +24784,7 @@
     {
         "title": "HackTool - SysmonEOP Execution",
         "id": "8a7e90c5-fe6e-45dc-889e-057fe4378bd9",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -24804,7 +24804,7 @@
     {
         "title": "PUA - Fast Reverse Proxy (FRP) Execution",
         "id": "32410e29-5f94-4568-b6a3-d91a8adad863",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet.",
         "author": "frack113, Florian Roth",
         "tags": [
@@ -25091,7 +25091,7 @@
     {
         "title": "Operator Bloopers Cobalt Strike Commands",
         "id": "647c7b9e-d784-4fda-b9a0-45c565a7b729",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects use of Cobalt Strike commands accidentally entered in the CMD shell",
         "author": "_pete_0, TheDFIRReport",
         "tags": [
@@ -25244,7 +25244,7 @@
     {
         "title": "HackTool - HandleKatz LSASS Dumper Execution",
         "id": "ca621ba5-54ab-4035-9942-d378e6fcde3c",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -25681,7 +25681,7 @@
     {
         "title": "Suspicious Shells Spawn by Java Utility Keytool",
         "id": "90fb5e62-ca1f-4e22-b42e-cc521874c938",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation)",
         "author": "Andreas Hunkeler (@Karneades)",
         "tags": [
@@ -25701,7 +25701,7 @@
     {
         "title": "PUA - NPS Tunneling Tool Execution",
         "id": "68d37776-61db-42f5-bf54-27e87072d17e",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of NPS, a port forwarding and intranet penetration proxy server",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -25798,7 +25798,7 @@
     {
         "title": "Renamed Msdt.EXE Execution",
         "id": "bd1c6866-65fc-44b2-be51-5588fcff82b9",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed \"Msdt.exe\" binary",
         "author": "pH-T (Nextron Systems)",
         "tags": [
@@ -25836,7 +25836,7 @@
     {
         "title": "Execution from Suspicious Folder",
         "id": "3dfd06d2-eaf4-4532-9555-68aca59f57c4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects a suspicious execution from an uncommon folder",
         "author": "Florian Roth (Nextron Systems), Tim Shelton",
         "tags": [
@@ -25988,7 +25988,7 @@
     {
         "title": "Renamed Mavinject.EXE Execution",
         "id": "e6474a1b-5390-49cd-ab41-8d88655f7394",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed version of the \"Mavinject\" process. Which can be abused to perform process injection using the \"/INJECTRUNNING\" flag",
         "author": "frack113, Florian Roth",
         "tags": [
@@ -26694,7 +26694,7 @@
     {
         "title": "Potential PowerShell Execution Policy Tampering - ProcCreation",
         "id": "cf2e938e-9a3e-4fe8-a347-411642b28a9f",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects changes to the PowerShell execution policy registry key in order to bypass signing requirements for script execution from the CommandLine",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -26712,7 +26712,7 @@
     {
         "title": "Renamed BrowserCore.EXE Execution",
         "id": "8a4519e8-e64a-40b6-ae85-ba8ad2177559",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects process creation with a renamed BrowserCore.exe (used to extract Azure tokens)",
         "author": "Max Altgelt (Nextron Systems)",
         "tags": [
@@ -26973,7 +26973,7 @@
     {
         "title": "Renamed Vmnat.exe Execution",
         "id": "7b4f794b-590a-4ad4-ba18-7964a2832205",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects renamed vmnat.exe or portable version that can be used for DLL side-loading",
         "author": "elhoim",
         "tags": [
@@ -26992,7 +26992,7 @@
     {
         "title": "Renamed Sysinternals Sdelete Execution",
         "id": "c1d867fe-8d95-4487-aab4-e53f2d339f90",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of a renamed SysInternals Sdelete, which is something an administrator shouldn't do (the renaming)",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -27184,7 +27184,7 @@
     {
         "title": "Potential Signing Bypass Via Windows Developer Features",
         "id": "a383dec4-deec-4e6e-913b-ed9249670848",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when a user enable developer features such as \"Developer Mode\" or \"Application Sideloading\". Which allows the user to install untrusted packages.",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -27339,7 +27339,7 @@
     {
         "title": "Root Certificate Installed From Susp Locations",
         "id": "5f6a601c-2ecb-498b-9c33-660362323afa",
-        "status": "experimental",
+        "status": "test",
         "description": "Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -27358,7 +27358,7 @@
     {
         "title": "Potential Process Injection Via Msra.EXE",
         "id": "744a188b-0415-4792-896f-11ddb0588dbc",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential process injection via Microsoft Remote Asssistance (Msra.exe) by looking at suspicious child processes spawned from the aforementioned process. It has been a target used by many threat actors and used for discovery and persistence tactics",
         "author": "Alexander McDonald",
         "tags": [
@@ -27700,7 +27700,7 @@
     {
         "title": "Potential RDP Tunneling Via SSH",
         "id": "f7d7ebd5-a016-46e2-9c54-f9932f2d386d",
-        "status": "experimental",
+        "status": "test",
         "description": "Execution of ssh.exe to perform data exfiltration and tunneling through RDP",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -27856,7 +27856,7 @@
     {
         "title": "Service Registry Key Deleted Via Reg.EXE",
         "id": "05b2aa93-1210-42c8-8d9a-2fcc13b284f5",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of \"reg.exe\" commands with the \"delete\" flag on services registry key. Often used by attacker to remove AV software services",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -28011,7 +28011,7 @@
     {
         "title": "HackTool - Htran/NATBypass Execution",
         "id": "f5e3b62f-e577-4e59-931e-0a15b2b94e1e",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass)",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -28031,7 +28031,7 @@
     {
         "title": "SQLite Firefox Profile Data DB Access",
         "id": "4833155a-4053-4c9c-a997-777fcea0baa7",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect usage of the \"sqlite\" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.",
         "author": "frack113",
         "tags": [
diff --git a/rules/rules_windows_generic_full.json b/rules/rules_windows_generic_full.json
index aab66c4..93abbd7 100644
--- a/rules/rules_windows_generic_full.json
+++ b/rules/rules_windows_generic_full.json
@@ -3488,7 +3488,7 @@
     {
         "title": "Potential PendingFileRenameOperations Tamper",
         "id": "4eec988f-7bf0-49f1-8675-1e6a510b3a2a",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect changes to the \"PendingFileRenameOperations\" registry key from uncommon or suspicious images lcoations to stage currently used files for rename after reboot.",
         "author": "frack113",
         "tags": [
@@ -3841,7 +3841,7 @@
     {
         "title": "Atbroker Registry Change",
         "id": "9577edbb-851f-4243-8c91-1d5b50c1a39b",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'",
         "author": "Mateusz Wydra, oscd.community",
         "tags": [
@@ -4764,7 +4764,7 @@
     {
         "title": "Potential Svchost Memory Access",
         "id": "166e9c50-8cd9-44af-815d-d1f0c0e90dde",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential access to svchost process memory such as that used by Invoke-Phantom to kill the winRM Windows event logging service.",
         "author": "Tim Burrell",
         "tags": [
@@ -5511,7 +5511,7 @@
     {
         "title": "Suspicious PowerShell Download - PoshModule",
         "id": "de41232e-12e8-49fa-86bc-c05c7e722df9",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious PowerShell download command",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -5589,7 +5589,7 @@
     {
         "title": "Malicious PowerShell Scripts - PoshModule",
         "id": "41025fd7-0466-4650-a813-574aaacbe7f4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of known offensive powershell scripts used for exploitation or reconnaissance",
         "author": "frack113, Nasreddine Bencherchali",
         "tags": [
@@ -5650,7 +5650,7 @@
     {
         "title": "Potential Active Directory Enumeration Using AD Module - PsModule",
         "id": "74176142-4684-4d8a-8b0a-713257e7df8e",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of the \"Import-Module\" cmdlet to load the \"Microsoft.ActiveDirectory.Management.dl\" DLL. Which is often used by attackers to perform AD enumeration.",
         "author": "Nasreddine Bencherchali (Nextron Systems), frack113",
         "tags": [
@@ -6781,7 +6781,7 @@
     {
         "title": "Usage Of Web Request Commands And Cmdlets - ScriptBlock",
         "id": "1139d2e2-84b1-4226-b445-354492eba8ba",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via PowerShell scriptblock logs",
         "author": "James Pemberton / @4A616D6573",
         "tags": [
@@ -7277,7 +7277,7 @@
     {
         "title": "Unsigned AppX Installation Attempt Using Add-AppxPackage - PsScript",
         "id": "975b2262-9a49-439d-92a6-0709cccdf0b2",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of the \"Add-AppxPackage\" or it's alias \"Add-AppPackage\" to install unsigned AppX packages",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -7659,7 +7659,7 @@
     {
         "title": "Import PowerShell Modules From Suspicious Directories",
         "id": "21f9162c-5f5d-4b01-89a8-b705bd7d10ab",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects powershell scripts that import modules from suspicious directories",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -7984,7 +7984,7 @@
     {
         "title": "Potential Data Exfiltration Via Audio File",
         "id": "e4f93c99-396f-47c8-bb0f-201b1fa69034",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential exfiltration attempt via audio file using PowerShell",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -8117,7 +8117,7 @@
     {
         "title": "Powershell XML Execute Command",
         "id": "6c6c6282-7671-4fe9-a0ce-a2dcebdc342b",
-        "status": "experimental",
+        "status": "test",
         "description": "Adversaries may abuse PowerShell commands and scripts for execution.\nPowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell)\nAdversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code\n",
         "author": "frack113",
         "tags": [
@@ -8815,7 +8815,7 @@
     {
         "title": "Potential PowerShell Obfuscation Using Alias Cmdlets",
         "id": "96cd126d-f970-49c4-848a-da3a09f55c55",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects Set-Alias or New-Alias cmdlet usage. Which can be use as a mean to obfuscate PowerShell scripts",
         "author": "frack113",
         "tags": [
@@ -8893,7 +8893,7 @@
     {
         "title": "Potential Active Directory Enumeration Using AD Module - PsScript",
         "id": "9e620995-f2d8-4630-8430-4afd89f77604",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of the \"Import-Module\" cmdlet to load the \"Microsoft.ActiveDirectory.Management.dl\" DLL. Which is often used by attackers to perform AD enumeration.",
         "author": "frack113, Nasreddine Bencherchali",
         "tags": [
@@ -9008,7 +9008,7 @@
     {
         "title": "Potential PowerShell Obfuscation Using Character Join",
         "id": "e8314f79-564d-4f79-bc13-fbc0bf2660d8",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects specific techniques often seen used inside of PowerShell scripts to obfscuate Alias creation",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -9187,7 +9187,7 @@
     {
         "title": "Malicious Nishang PowerShell Commandlets",
         "id": "f772cee9-b7c2-4cb2-8f07-49870adc02e0",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects Commandlet names and arguments from the Nishang exploitation framework",
         "author": "Alec Costello",
         "tags": [
@@ -9203,25 +9203,6 @@
         ],
         "filename": "posh_ps_nishang_malicious_commandlets.yml"
     },
-    {
-        "title": "Suspicious DNS Query for IP Lookup Service APIs",
-        "id": "ec82e2a5-81ea-4211-a1f8-37a0286df2c2",
-        "status": "test",
-        "description": "Detects DNS queries for IP lookup services such as \"api.ipify.org\" originating from a non browser process.",
-        "author": "Brandon George (blog post), Thomas Patzke",
-        "tags": [
-            "attack.reconnaissance",
-            "attack.t1590"
-        ],
-        "falsepositives": [
-            "Legitimate usage of IP lookup services such as ipify API"
-        ],
-        "level": "medium",
-        "rule": [
-            "SELECT * FROM logs WHERE ((QueryName LIKE '%api.2ip.ua%' ESCAPE '\\' OR QueryName LIKE '%api.ipify.org%' ESCAPE '\\' OR QueryName LIKE '%bot.whatismyipaddress.com%' ESCAPE '\\' OR QueryName LIKE '%canireachthe.net%' ESCAPE '\\' OR QueryName LIKE '%checkip.amazonaws.com%' ESCAPE '\\' OR QueryName LIKE '%checkip.dyndns.org%' ESCAPE '\\' OR QueryName LIKE '%curlmyip.com%' ESCAPE '\\' OR QueryName LIKE '%edns.ip-api.com%' ESCAPE '\\' OR QueryName LIKE '%eth0.me%' ESCAPE '\\' OR QueryName LIKE '%freegeoip.app%' ESCAPE '\\' OR QueryName LIKE '%geoipy.com%' ESCAPE '\\' OR QueryName LIKE '%getip.pro%' ESCAPE '\\' OR QueryName LIKE '%icanhazip.com%' ESCAPE '\\' OR QueryName LIKE '%ident.me%' ESCAPE '\\' OR QueryName LIKE '%ifconfig.io%' ESCAPE '\\' OR QueryName LIKE '%ifconfig.me%' ESCAPE '\\' OR QueryName LIKE '%ip-api.com%' ESCAPE '\\' OR QueryName LIKE '%ip.anysrc.net%' ESCAPE '\\' OR QueryName LIKE '%ip.tyk.nu%' ESCAPE '\\' OR QueryName LIKE '%ipaddressworld.com%' ESCAPE '\\' OR QueryName LIKE '%ipecho.net%' ESCAPE '\\' OR QueryName LIKE '%ipinfo.io%' ESCAPE '\\' OR QueryName LIKE '%ipof.in%' ESCAPE '\\' OR QueryName LIKE '%ipv4.icanhazip.com%' ESCAPE '\\' OR QueryName LIKE '%ipv4bot.whatismyipaddress.com%' ESCAPE '\\' OR QueryName LIKE '%ipwho.is%' ESCAPE '\\' OR QueryName LIKE '%l2.io%' ESCAPE '\\' OR QueryName LIKE '%myexternalip.com%' ESCAPE '\\' OR QueryName LIKE '%wgetip.com%' ESCAPE '\\' OR QueryName LIKE '%whatismyip.akamai.com%' ESCAPE '\\' OR QueryName LIKE '%wtfismyip.com%' ESCAPE '\\') AND NOT ((NewProcessName LIKE '%\\\\brave.exe' ESCAPE '\\') OR ((NewProcessName LIKE 'C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\')) OR ((NewProcessName LIKE 'C:\\\\Program Files\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\')) OR ((NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\')) OR (NewProcessName LIKE '%\\\\maxthon.exe' ESCAPE '\\') OR (NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\%' ESCAPE '\\' OR NewProcessName LIKE '%\\\\WindowsApps\\\\MicrosoftEdge.exe' ESCAPE '\\' OR (NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\')) OR ((NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\') AND (NewProcessName LIKE '%\\\\msedge.exe' ESCAPE '\\' OR NewProcessName LIKE '%\\\\msedgewebview2.exe' ESCAPE '\\')) OR (NewProcessName LIKE '%\\\\opera.exe' ESCAPE '\\') OR (NewProcessName LIKE '%\\\\safari.exe' ESCAPE '\\') OR (NewProcessName LIKE '%\\\\seamonkey.exe' ESCAPE '\\') OR (NewProcessName LIKE '%\\\\vivaldi.exe' ESCAPE '\\') OR (NewProcessName LIKE '%\\\\whale.exe' ESCAPE '\\')))"
-        ],
-        "filename": "dns_query_win_susp_ipify.yml"
-    },
     {
         "title": "DNS Query Request By Regsvr32.EXE",
         "id": "36e037c4-c228-4866-b6a3-48eb292b9955",
@@ -9323,7 +9304,7 @@
     {
         "title": "DNS Query for Anonfiles.com Domain - Sysmon",
         "id": "065cceea-77ec-4030-9052-fc0affea7110",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects DNS queries for \"anonfiles.com\", which is an anonymous file upload platform often used for malicious purposes",
         "author": "pH-T (Nextron Systems)",
         "tags": [
@@ -9453,6 +9434,25 @@
         ],
         "filename": "dns_query_win_vscode_tunnel_communication.yml"
     },
+    {
+        "title": "Suspicious DNS Query for IP Lookup Service APIs",
+        "id": "ec82e2a5-81ea-4211-a1f8-37a0286df2c2",
+        "status": "test",
+        "description": "Detects DNS queries for IP lookup services such as \"api.ipify.org\" originating from a non browser process.",
+        "author": "Brandon George (blog post), Thomas Patzke",
+        "tags": [
+            "attack.reconnaissance",
+            "attack.t1590"
+        ],
+        "falsepositives": [
+            "Legitimate usage of IP lookup services such as ipify API"
+        ],
+        "level": "medium",
+        "rule": [
+            "SELECT * FROM logs WHERE ((QueryName LIKE '%api.2ip.ua%' ESCAPE '\\' OR QueryName LIKE '%api.bigdatacloud.net%' ESCAPE '\\' OR QueryName LIKE '%api.ipify.org%' ESCAPE '\\' OR QueryName LIKE '%bot.whatismyipaddress.com%' ESCAPE '\\' OR QueryName LIKE '%canireachthe.net%' ESCAPE '\\' OR QueryName LIKE '%checkip.amazonaws.com%' ESCAPE '\\' OR QueryName LIKE '%checkip.dyndns.org%' ESCAPE '\\' OR QueryName LIKE '%curlmyip.com%' ESCAPE '\\' OR QueryName LIKE '%db-ip.com%' ESCAPE '\\' OR QueryName LIKE '%edns.ip-api.com%' ESCAPE '\\' OR QueryName LIKE '%eth0.me%' ESCAPE '\\' OR QueryName LIKE '%freegeoip.app%' ESCAPE '\\' OR QueryName LIKE '%geoipy.com%' ESCAPE '\\' OR QueryName LIKE '%getip.pro%' ESCAPE '\\' OR QueryName LIKE '%icanhazip.com%' ESCAPE '\\' OR QueryName LIKE '%ident.me%' ESCAPE '\\' OR QueryName LIKE '%ifconfig.io%' ESCAPE '\\' OR QueryName LIKE '%ifconfig.me%' ESCAPE '\\' OR QueryName LIKE '%ipapi.co%' ESCAPE '\\' OR QueryName LIKE '%ip-api.com%' ESCAPE '\\' OR QueryName LIKE '%ip.anysrc.net%' ESCAPE '\\' OR QueryName LIKE '%ip.tyk.nu%' ESCAPE '\\' OR QueryName LIKE '%ipaddressworld.com%' ESCAPE '\\' OR QueryName LIKE '%ipecho.net%' ESCAPE '\\' OR QueryName LIKE '%ipinfo.io%' ESCAPE '\\' OR QueryName LIKE '%ipof.in%' ESCAPE '\\' OR QueryName LIKE '%ipv4.icanhazip.com%' ESCAPE '\\' OR QueryName LIKE '%ipv4bot.whatismyipaddress.com%' ESCAPE '\\' OR QueryName LIKE '%ipwho.is%' ESCAPE '\\' OR QueryName LIKE '%l2.io%' ESCAPE '\\' OR QueryName LIKE '%myexternalip.com%' ESCAPE '\\' OR QueryName LIKE '%wgetip.com%' ESCAPE '\\' OR QueryName LIKE '%whatismyip.akamai.com%' ESCAPE '\\' OR QueryName LIKE '%wtfismyip.com%' ESCAPE '\\') AND NOT ((NewProcessName LIKE '%\\\\brave.exe' ESCAPE '\\') OR ((NewProcessName LIKE 'C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\')) OR ((NewProcessName LIKE 'C:\\\\Program Files\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\')) OR ((NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\')) OR (NewProcessName LIKE '%\\\\maxthon.exe' ESCAPE '\\') OR (NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\%' ESCAPE '\\' OR NewProcessName LIKE '%\\\\WindowsApps\\\\MicrosoftEdge.exe' ESCAPE '\\' OR (NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\')) OR ((NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\') AND (NewProcessName LIKE '%\\\\msedge.exe' ESCAPE '\\' OR NewProcessName LIKE '%\\\\msedgewebview2.exe' ESCAPE '\\')) OR (NewProcessName LIKE '%\\\\opera.exe' ESCAPE '\\') OR (NewProcessName LIKE '%\\\\safari.exe' ESCAPE '\\') OR (NewProcessName LIKE '%\\\\seamonkey.exe' ESCAPE '\\') OR (NewProcessName LIKE '%\\\\vivaldi.exe' ESCAPE '\\') OR (NewProcessName LIKE '%\\\\whale.exe' ESCAPE '\\')))"
+        ],
+        "filename": "dns_query_win_susp_external_ip_lookup.yml"
+    },
     {
         "title": "DNS Query Tor .Onion Address - Sysmon",
         "id": "b55ca2a3-7cff-4dda-8bdd-c7bfa63bf544",
@@ -11303,7 +11303,7 @@
     {
         "title": "Potential DLL Sideloading Of Non-Existent DLLs From System Folders",
         "id": "6b98b92b-4f00-4f62-b4fe-4d1920215771",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects DLL sideloading of system dlls that are not present on the system by default. Usually to achieve techniques such as UAC bypass and privilege escalation",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -11424,6 +11424,28 @@
         ],
         "filename": "registry_set_office_trusted_location.yml"
     },
+    {
+        "title": "Registry Set With Crypto-Classes From The \"Cryptography\" PowerShell Namespace",
+        "id": "1c2a3268-3881-414a-80af-a5b313b14c0e",
+        "status": "experimental",
+        "description": "Detects the setting of a registry inside the \"\\Shell\\Open\\Command\" value with PowerShell classes from the \"System.Security.Cryptography\" namespace.\nThe PowerShell namespace \"System.Security.Cryptography\" provides classes for on-the-fly encryption and decryption.\nThese can be used for example in decrypting malicious payload for defense evasion.\n",
+        "author": "Andreas Braathen (mnemonic.io)",
+        "tags": [
+            "attack.defense_evasion",
+            "attack.t1059.001",
+            "attack.t1027.010",
+            "attack.t1547.001",
+            "detection.threat_hunting"
+        ],
+        "falsepositives": [
+            "Classes are legitimately used, but less so when e.g. parents with low prevalence or decryption of content in temporary folders."
+        ],
+        "level": "medium",
+        "rule": [
+            "SELECT * FROM logs WHERE (EventID = '4657' AND (OperationType LIKE 'Existing registry value modified' ESCAPE '\\') AND Channel = 'Security' AND EventType = 'SetValue' AND TargetObject LIKE '%\\\\Shell\\\\Open\\\\Command%' ESCAPE '\\' AND (NewValue LIKE '%powershell%' ESCAPE '\\' OR NewValue LIKE '%pwsh%' ESCAPE '\\') AND NewValue LIKE '%System.Security.Cryptography.%' ESCAPE '\\' AND (NewValue LIKE '%.AesCryptoServiceProvider%' ESCAPE '\\' OR NewValue LIKE '%.DESCryptoServiceProvider%' ESCAPE '\\' OR NewValue LIKE '%.DSACryptoServiceProvider%' ESCAPE '\\' OR NewValue LIKE '%.RC2CryptoServiceProvider%' ESCAPE '\\' OR NewValue LIKE '%.Rijndael%' ESCAPE '\\' OR NewValue LIKE '%.RSACryptoServiceProvider%' ESCAPE '\\' OR NewValue LIKE '%.TripleDESCryptoServiceProvider%' ESCAPE '\\'))"
+        ],
+        "filename": "registry_set_powershell_crypto_namespace.yml"
+    },
     {
         "title": "Scheduled Task Created - Registry",
         "id": "93ff0ceb-e0ef-4586-8cd8-a6c277d738e3",
@@ -11783,7 +11805,7 @@
     {
         "title": "Scheduled Task Deletion",
         "id": "4f86b304-3e02-40e3-aa5d-e88a167c9617",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects scheduled task deletion events. Scheduled tasks are likely to be deleted if not used for persistence. Malicious Software often creates tasks directly under the root node e.g. \\TASKNAME",
         "author": "David Strassegger, Tim Shelton",
         "tags": [
@@ -12168,6 +12190,27 @@
         ],
         "filename": "proc_creation_win_susp_file_permission_modifications.yml"
     },
+    {
+        "title": "Invocation Of Crypto-Classes From The \"Cryptography\" PowerShell Namespace",
+        "id": "ad856965-f44d-42a8-945e-bbf7bd03d05a",
+        "status": "experimental",
+        "description": "Detects the invocation of PowerShell commands with references to classes from the \"System.Security.Cryptography\" namespace.\nThe PowerShell namespace \"System.Security.Cryptography\" provides classes for on-the-fly encryption and decryption.\nThese can be used for example in decrypting malicious payload for defense evasion.\n",
+        "author": "Andreas Braathen (mnemonic.io)",
+        "tags": [
+            "attack.defense_evasion",
+            "attack.t1059.001",
+            "attack.t1027.010",
+            "detection.threat_hunting"
+        ],
+        "falsepositives": [
+            "Classes are legitimately used, but less so when e.g. parents with low prevalence or decryption of content in temporary folders."
+        ],
+        "level": "medium",
+        "rule": [
+            "SELECT * FROM logs WHERE ((EventID = '4688' AND Channel = 'Security') AND ((NewProcessName LIKE '%\\\\powershell.exe' ESCAPE '\\' OR NewProcessName LIKE '%\\\\pwsh.exe' ESCAPE '\\') OR OriginalFileName IN ('PowerShell.EXE', 'pwsh.dll')) AND CommandLine LIKE '%System.Security.Cryptography.%' ESCAPE '\\' AND (CommandLine LIKE '%.AesCryptoServiceProvider%' ESCAPE '\\' OR CommandLine LIKE '%.DESCryptoServiceProvider%' ESCAPE '\\' OR CommandLine LIKE '%.DSACryptoServiceProvider%' ESCAPE '\\' OR CommandLine LIKE '%.RC2CryptoServiceProvider%' ESCAPE '\\' OR CommandLine LIKE '%.Rijndael%' ESCAPE '\\' OR CommandLine LIKE '%.RSACryptoServiceProvider%' ESCAPE '\\' OR CommandLine LIKE '%.TripleDESCryptoServiceProvider%' ESCAPE '\\'))"
+        ],
+        "filename": "proc_creation_win_powershell_crypto_namespace.yml"
+    },
     {
         "title": "ClickOnce Deployment Execution - Dfsvc.EXE Child Process",
         "id": "241d52b5-eee0-49d0-ac8a-8b9c15c7221c",
@@ -13563,7 +13606,7 @@
     {
         "title": "Suspicious Startup Folder Persistence",
         "id": "28208707-fe31-437f-9a7f-4b1108b94d2e",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when a file with a suspicious extension is created in the startup folder",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -15186,7 +15229,7 @@
     {
         "title": "VsCode Powershell Profile Modification",
         "id": "3a9fa2ec-30bc-4ebd-b49e-7c9cff225502",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the creation or modification of a vscode related powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -18214,7 +18257,7 @@
     {
         "title": "Potential Exploitation Attempt From Office Application",
         "id": "868955d9-697e-45d4-a3da-360cefd7c216",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects Office applications executing a child process that includes directory traversal patterns. This could be an attempt to exploit CVE-2022-30190 (MSDT RCE) or CVE-2021-40444 (MSHTML RCE)",
         "author": "Christian Burkard (Nextron Systems), @SBousseaden (idea)",
         "tags": [
@@ -19155,7 +19198,7 @@
     {
         "title": "Potential CVE-2022-26809 Exploitation Attempt",
         "id": "a7cd7306-df8b-4398-b711-6f3e4935cf16",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious remote procedure call (RPC) service anomalies based on the spawned sub processes (long shot to detect the exploitation of vulnerabilities like CVE-2022-26809)",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -19261,7 +19304,7 @@
     {
         "title": "Potential Centos Web Panel Exploitation Attempt - CVE-2022-44877",
         "id": "1b2eeb27-949b-4704-8bfa-d8e5cfa045a1",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential exploitation attempts that target the Centos Web Panel 7 Unauthenticated Remote Code Execution CVE-2022-44877",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -19750,7 +19793,7 @@
         ],
         "level": "high",
         "rule": [
-            "SELECT * FROM logs WHERE (EventID = '4688' AND Channel = 'Security' AND ParentProcessName LIKE '%\\\\ws\\_tomcatservice.exe' ESCAPE '\\' AND NewProcessName LIKE '%\\\\repadmin.exe' ESCAPE '\\')"
+            "SELECT * FROM logs WHERE ((EventID = '4688' AND Channel = 'Security') AND ParentProcessName LIKE '%\\\\ws\\_tomcatservice.exe' ESCAPE '\\' AND NOT ((NewProcessName LIKE '%\\\\repadmin.exe' ESCAPE '\\')))"
         ],
         "filename": "proc_creation_win_apt_mint_sandstorm_log4j_wstomcat_execution.yml"
     },
@@ -20777,7 +20820,7 @@
     {
         "title": "Potential Exploitation Attempt Of Undocumented WindowsServer RCE",
         "id": "6d5b8176-d87d-4402-8af4-53aee9db7b5d",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential exploitation attempt of undocumented Windows Server Pre Auth Remote Code Execution (RCE)",
         "author": "Florian Roth (Nextron Systems), Nasreddine Bencherchali",
         "tags": [
@@ -22311,7 +22354,7 @@
     {
         "title": "Deployment Of The AppX Package Was Blocked By The Policy",
         "id": "e021bbb5-407f-41f5-9dc9-1864c45a7a51",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an appx package deployment that was blocked by the local computer policy",
         "author": "frack113",
         "tags": [
@@ -22329,7 +22372,7 @@
     {
         "title": "Suspicious AppX Package Locations",
         "id": "5cdeaf3d-1489-477c-95ab-c318559fc051",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an appx package added the pipeline of the \"to be processed\" packages which is located in suspicious locations",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -22365,7 +22408,7 @@
     {
         "title": "Deployment AppX Package Was Blocked By AppLocker",
         "id": "6ae53108-c3a0-4bee-8f45-c7591a2c337f",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an appx package deployment that was blocked by AppLocker policy",
         "author": "frack113",
         "tags": [
@@ -22383,7 +22426,7 @@
     {
         "title": "Suspicious AppX Package Installation Attempt",
         "id": "898d5fc9-fbc3-43de-93ad-38e97237c344",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an appx package installation with the error code \"0x80073cff\" which indicates that the package didn't meet the signing requirements and could be suspicious",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -22401,7 +22444,7 @@
     {
         "title": "Uncommon AppX Package Locations",
         "id": "c977cb50-3dff-4a9f-b873-9290f56132f1",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an appx package added the pipeline of the \"to be processed\" packages which is located in uncommon locations",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -22419,7 +22462,7 @@
     {
         "title": "Potential Malicious AppX Package Installation Attempts",
         "id": "09d3b48b-be17-47f5-bf4e-94e7e75d09ce",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential installation or installation attempts of known malicious appx packages",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -22849,7 +22892,7 @@
     {
         "title": "Suspicious Digital Signature Of AppX Package",
         "id": "b5aa7d60-c17e-4538-97de-09029d6cd76b",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of AppX packages with known suspicious or malicious signature",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -25940,7 +25983,7 @@
     {
         "title": "DNS Query for Anonfiles.com Domain - DNS Client",
         "id": "29f171d7-aa47-42c7-9c7b-3c87938164d9",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects DNS queries for anonfiles.com, which is an anonymous file upload platform often used for malicious purposes",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -27956,7 +27999,7 @@
     {
         "title": "Restricted Software Access By SRP",
         "id": "b4c8da4a-1c12-46b0-8a2b-0a8521d03442",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects restricted access to applications by the Software Restriction Policies (SRP) policy",
         "author": "frack113",
         "tags": [
@@ -28132,7 +28175,7 @@
     {
         "title": "The Windows Defender Firewall Service Failed To Load Group Policy",
         "id": "7ec15688-fd24-4177-ba43-1a950537ee39",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects activity when The Windows Defender Firewall service failed to load Group Policy",
         "author": "frack113",
         "tags": [
@@ -28808,7 +28851,7 @@
         ],
         "level": "medium",
         "rule": [
-            "SELECT * FROM logs WHERE ((DestinationHostname LIKE '%api.2ip.ua%' ESCAPE '\\' OR DestinationHostname LIKE '%api.ipify.org%' ESCAPE '\\' OR DestinationHostname LIKE '%bot.whatismyipaddress.com%' ESCAPE '\\' OR DestinationHostname LIKE '%canireachthe.net%' ESCAPE '\\' OR DestinationHostname LIKE '%checkip.amazonaws.com%' ESCAPE '\\' OR DestinationHostname LIKE '%checkip.dyndns.org%' ESCAPE '\\' OR DestinationHostname LIKE '%curlmyip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%edns.ip-api.com%' ESCAPE '\\' OR DestinationHostname LIKE '%eth0.me%' ESCAPE '\\' OR DestinationHostname LIKE '%freegeoip.app%' ESCAPE '\\' OR DestinationHostname LIKE '%geoipy.com%' ESCAPE '\\' OR DestinationHostname LIKE '%getip.pro%' ESCAPE '\\' OR DestinationHostname LIKE '%icanhazip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ident.me%' ESCAPE '\\' OR DestinationHostname LIKE '%ifconfig.io%' ESCAPE '\\' OR DestinationHostname LIKE '%ifconfig.me%' ESCAPE '\\' OR DestinationHostname LIKE '%ip-api.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ip.anysrc.net%' ESCAPE '\\' OR DestinationHostname LIKE '%ip.tyk.nu%' ESCAPE '\\' OR DestinationHostname LIKE '%ipaddressworld.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ipecho.net%' ESCAPE '\\' OR DestinationHostname LIKE '%ipinfo.io%' ESCAPE '\\' OR DestinationHostname LIKE '%ipof.in%' ESCAPE '\\' OR DestinationHostname LIKE '%ipv4.icanhazip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ipv4bot.whatismyipaddress.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ipwho.is%' ESCAPE '\\' OR DestinationHostname LIKE '%l2.io%' ESCAPE '\\' OR DestinationHostname LIKE '%myexternalip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%wgetip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%whatismyip.akamai.com%' ESCAPE '\\' OR DestinationHostname LIKE '%wtfismyip.com%' ESCAPE '\\') AND NOT ((NewProcessName LIKE '%\\\\brave.exe' ESCAPE '\\') OR ((NewProcessName LIKE 'C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\')) OR ((NewProcessName LIKE 'C:\\\\Program Files\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\')) OR ((NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\')) OR (NewProcessName LIKE '%\\\\maxthon.exe' ESCAPE '\\') OR (NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\%' ESCAPE '\\' OR NewProcessName LIKE '%\\\\WindowsApps\\\\MicrosoftEdge.exe' ESCAPE '\\' OR (NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\')) OR ((NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\') AND (NewProcessName LIKE '%\\\\msedge.exe' ESCAPE '\\' OR NewProcessName LIKE '%\\\\msedgewebview2.exe' ESCAPE '\\')) OR (NewProcessName LIKE '%\\\\opera.exe' ESCAPE '\\') OR (NewProcessName LIKE '%\\\\safari.exe' ESCAPE '\\') OR (NewProcessName LIKE '%\\\\seamonkey.exe' ESCAPE '\\') OR (NewProcessName LIKE '%\\\\vivaldi.exe' ESCAPE '\\') OR (NewProcessName LIKE '%\\\\whale.exe' ESCAPE '\\')))"
+            "SELECT * FROM logs WHERE ((DestinationHostname LIKE '%api.2ip.ua%' ESCAPE '\\' OR DestinationHostname LIKE '%api.bigdatacloud.net%' ESCAPE '\\' OR DestinationHostname LIKE '%api.ipify.org%' ESCAPE '\\' OR DestinationHostname LIKE '%bot.whatismyipaddress.com%' ESCAPE '\\' OR DestinationHostname LIKE '%canireachthe.net%' ESCAPE '\\' OR DestinationHostname LIKE '%checkip.amazonaws.com%' ESCAPE '\\' OR DestinationHostname LIKE '%checkip.dyndns.org%' ESCAPE '\\' OR DestinationHostname LIKE '%curlmyip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%db-ip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%edns.ip-api.com%' ESCAPE '\\' OR DestinationHostname LIKE '%eth0.me%' ESCAPE '\\' OR DestinationHostname LIKE '%freegeoip.app%' ESCAPE '\\' OR DestinationHostname LIKE '%geoipy.com%' ESCAPE '\\' OR DestinationHostname LIKE '%getip.pro%' ESCAPE '\\' OR DestinationHostname LIKE '%icanhazip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ident.me%' ESCAPE '\\' OR DestinationHostname LIKE '%ifconfig.io%' ESCAPE '\\' OR DestinationHostname LIKE '%ifconfig.me%' ESCAPE '\\' OR DestinationHostname LIKE '%ipapi.co%' ESCAPE '\\' OR DestinationHostname LIKE '%ip-api.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ip.anysrc.net%' ESCAPE '\\' OR DestinationHostname LIKE '%ip.tyk.nu%' ESCAPE '\\' OR DestinationHostname LIKE '%ipaddressworld.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ipecho.net%' ESCAPE '\\' OR DestinationHostname LIKE '%ipinfo.io%' ESCAPE '\\' OR DestinationHostname LIKE '%ipof.in%' ESCAPE '\\' OR DestinationHostname LIKE '%ipv4.icanhazip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ipv4bot.whatismyipaddress.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ipwho.is%' ESCAPE '\\' OR DestinationHostname LIKE '%l2.io%' ESCAPE '\\' OR DestinationHostname LIKE '%myexternalip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%wgetip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%whatismyip.akamai.com%' ESCAPE '\\' OR DestinationHostname LIKE '%wtfismyip.com%' ESCAPE '\\') AND NOT ((NewProcessName LIKE '%\\\\brave.exe' ESCAPE '\\') OR ((NewProcessName LIKE 'C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\')) OR ((NewProcessName LIKE 'C:\\\\Program Files\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\')) OR ((NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\')) OR (NewProcessName LIKE '%\\\\maxthon.exe' ESCAPE '\\') OR (NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\%' ESCAPE '\\' OR NewProcessName LIKE '%\\\\WindowsApps\\\\MicrosoftEdge.exe' ESCAPE '\\' OR (NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\')) OR ((NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\') AND (NewProcessName LIKE '%\\\\msedge.exe' ESCAPE '\\' OR NewProcessName LIKE '%\\\\msedgewebview2.exe' ESCAPE '\\')) OR (NewProcessName LIKE '%\\\\opera.exe' ESCAPE '\\') OR (NewProcessName LIKE '%\\\\safari.exe' ESCAPE '\\') OR (NewProcessName LIKE '%\\\\seamonkey.exe' ESCAPE '\\') OR (NewProcessName LIKE '%\\\\vivaldi.exe' ESCAPE '\\') OR (NewProcessName LIKE '%\\\\whale.exe' ESCAPE '\\')))"
         ],
         "filename": "net_connection_win_susp_external_ip_lookup.yml"
     },
@@ -29468,7 +29511,7 @@
     {
         "title": "Renamed Plink Execution",
         "id": "1c12727d-02bf-45ff-a9f3-d49806a3cf43",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed version of the Plink binary",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -29508,7 +29551,7 @@
     {
         "title": "Potential Password Spraying Attempt Using Dsacls.EXE",
         "id": "bac9fb54-2da7-44e9-988f-11e9a5edbc0c",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects possible password spraying attempts using Dsacls",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -30347,7 +30390,7 @@
     {
         "title": "DirLister Execution",
         "id": "b4dc61f5-6cce-468e-a608-b48b469feaa2",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect the usage of \"DirLister.exe\" a utility for quickly listing folder or drive contents. It was seen used by BlackCat ransomware to create a list of accessible directories and files.",
         "author": "frack113",
         "tags": [
@@ -30660,7 +30703,7 @@
     {
         "title": "Potential Persistence Via Powershell Search Order Hijacking - Task",
         "id": "b66474aa-bd92-4333-a16c-298155b120df",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell \"Get-Variable\" technique as seen being used in Colibri Loader",
         "author": "pH-T (Nextron Systems), Florian Roth (Nextron Systems)",
         "tags": [
@@ -31237,7 +31280,7 @@
     {
         "title": "SQLite Chromium Profile Data DB Access",
         "id": "24c77512-782b-448a-8950-eddb0785fc71",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect usage of the \"sqlite\" binary to query databases in Chromium-based browsers for potential data stealing.",
         "author": "TropChaud",
         "tags": [
@@ -31640,7 +31683,7 @@
     {
         "title": "Potential Active Directory Enumeration Using AD Module - ProcCreation",
         "id": "70bc5215-526f-4477-963c-a47a5c9ebd12",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of the \"Import-Module\" cmdlet to load the \"Microsoft.ActiveDirectory.Management.dl\" DLL. Which is often used by attackers to perform AD enumeration.",
         "author": "frack113",
         "tags": [
@@ -31891,7 +31934,7 @@
     {
         "title": "Renamed NetSupport RAT Execution",
         "id": "0afbd410-de03-4078-8491-f132303cb67d",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed \"client32.exe\" (NetSupport RAT) via Imphash, Product and OriginalFileName strings",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -32150,7 +32193,7 @@
     {
         "title": "PDQ Deploy Remote Adminstartion Tool Execution",
         "id": "d679950c-abb7-43a6-80fb-2a480c4fc450",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect use of PDQ Deploy remote admin tool",
         "author": "frack113",
         "tags": [
@@ -32311,7 +32354,7 @@
     {
         "title": "Nltest.EXE Execution",
         "id": "903076ff-f442-475a-b667-4f246bcc203b",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects nltest commands that can be used for information discovery",
         "author": "Arun Chauhan",
         "tags": [
@@ -32600,7 +32643,7 @@
     {
         "title": "HackTool - Inveigh Execution",
         "id": "b99a1518-1ad5-4f65-bc95-1ffff97a8fd0",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -32954,7 +32997,7 @@
     {
         "title": "Disabled RestrictedAdminMode For RDS - ProcCreation",
         "id": "28ac00d6-22d9-4a3c-927f-bbd770104573",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect activation of DisableRestrictedAdmin to disable RestrictedAdmin mode.\nRestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.\nThis prevents your credentials from being harvested during the initial connection process if the remote server has been compromise\n",
         "author": "frack113",
         "tags": [
@@ -33014,7 +33057,7 @@
     {
         "title": "Unsigned AppX Installation Attempt Using Add-AppxPackage",
         "id": "37651c2a-42cd-4a69-ae0d-22a4349aa04a",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of the \"Add-AppxPackage\" or it's alias \"Add-AppPackage\" to install unsigned AppX packages",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -33307,7 +33350,7 @@
     {
         "title": "HackTool - SafetyKatz Execution",
         "id": "b1876533-4ed5-4a83-90f3-b8645840a413",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the hacktool SafetyKatz via PE information and default Image name",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -33716,7 +33759,7 @@
     {
         "title": "Potential Renamed Rundll32 Execution",
         "id": "2569ed8c-1147-498a-9b8c-2ad3656b10ed",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when 'DllRegisterServer' is called in the commandline and the image is not rundll32. This could mean that the 'rundll32' utility has been renamed in order to avoid detection",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -33848,7 +33891,7 @@
     {
         "title": "PUA - DefenderCheck Execution",
         "id": "f0ca6c24-3225-47d5-b1f5-352bf07ecfa7",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of DefenderCheck, a tool to evaluate the signatures used in Microsoft Defender. It can be used to figure out the strings / byte chains used in Microsoft Defender to detect a tool and thus used for AV evasion.",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -34366,7 +34409,7 @@
     {
         "title": "Suspicious Hacktool Execution - Imphash",
         "id": "24e3e58a-646b-4b50-adef-02ef935b9fc8",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -35044,7 +35087,7 @@
     {
         "title": "Microsoft IIS Service Account Password Dumped",
         "id": "2d3cdeec-c0db-45b4-aa86-082f7eb75701",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords",
         "author": "Tim Rauch, Janantha Marasinghe",
         "tags": [
@@ -35959,7 +36002,7 @@
     {
         "title": "Potential WinAPI Calls Via CommandLine",
         "id": "ba3f5c1b-6272-4119-9dbd-0bc8d21c2702",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -36079,7 +36122,7 @@
     {
         "title": "PUA - Seatbelt Execution",
         "id": "38646daa-e78f-4ace-9de0-55547b2d30da",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -36142,7 +36185,7 @@
     {
         "title": "Potential Arbitrary Code Execution Via Node.EXE",
         "id": "6640f31c-01ad-49b5-beb5-83498a5cd8bd",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution node.exe which is shipped with multiple software such as VMware, Adobe...etc. In order to execute arbitrary code. For example to establish reverse shell as seen in Log4j attacks...etc",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -36444,7 +36487,7 @@
     {
         "title": "HackTool - SharPersist Execution",
         "id": "26488ad0-f9fd-4536-876f-52fea846a2e4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the hacktool SharPersist - used to deploy various different kinds of persistence mechanisms",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -36547,7 +36590,7 @@
     {
         "title": "Uncommon One Time Only Scheduled Task At 00:00",
         "id": "970823b7-273b-460a-8afc-3a6811998529",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects scheduled task creation events that include suspicious actions, and is run once at 00:00",
         "author": "pH-T (Nextron Systems)",
         "tags": [
@@ -36721,7 +36764,7 @@
     {
         "title": "Suspicious New Instance Of An Office COM Object",
         "id": "9bdaf1e9-fdef-443b-8081-4341b74a7e28",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an svchost process spawning an instance of an office application. This happens when the initial word application creates an instance of one of the Office COM objects such as 'Word.Application', 'Excel.Application', etc.\nThis can be used by malicious actors to create malicious Office documents with macros on the fly. (See vba2clr project in the references)\n",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -37497,7 +37540,7 @@
     {
         "title": "Potential DLL Sideloading Via DeviceEnroller.EXE",
         "id": "e173ad47-4388-4012-ae62-bd13f71c18a8",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of the PhoneDeepLink parameter to potentially sideload a DLL file that does not exist. This non-existent DLL file is named \"ShellChromeAPI.dll\".\nAdversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter\n",
         "author": "@gott_cyber",
         "tags": [
@@ -37691,7 +37734,7 @@
     {
         "title": "Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE",
         "id": "07f8bdc2-c9b3-472a-9817-5a670b872f53",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of cmdkey to look for cached credentials on the system",
         "author": "jmallette, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -37867,7 +37910,7 @@
     {
         "title": "Operator Bloopers Cobalt Strike Modules",
         "id": "4f154fb6-27d1-4813-a759-78b93e0b9c48",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects Cobalt Strike module/commands accidentally entered in CMD shell",
         "author": "_pete_0, TheDFIRReport",
         "tags": [
@@ -39084,7 +39127,7 @@
     {
         "title": "HackTool - KrbRelayUp Execution",
         "id": "12827a56-61a4-476a-a9cb-f3068f191073",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -39689,7 +39732,7 @@
     {
         "title": "Disable Windows IIS HTTP Logging",
         "id": "e4ed6030-ffe5-4e6a-8a8a-ab3c1ab9d94e",
-        "status": "experimental",
+        "status": "test",
         "description": "Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union)",
         "author": "frack113",
         "tags": [
@@ -39816,7 +39859,7 @@
     {
         "title": "Suspicious IIS URL GlobalRules Rewrite Via AppCmd",
         "id": "7c8af9b2-dcae-41a2-a9db-b28c288b5f08",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of \"appcmd\" to create new global URL rewrite rules. This behaviour has been observed being used by threat actors to add new rules so they can access their webshells.",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -40965,7 +41008,7 @@
     {
         "title": "Suspicious Git Clone",
         "id": "aef9d1f1-7396-4e92-a927-4567c7a495c1",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of \"git\" in order to clone a remote repository that contain suspicious keywords which might be suspicious",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -41022,7 +41065,7 @@
     {
         "title": "HackTool - KrbRelay Execution",
         "id": "e96253b8-6b3b-4f90-9e59-3b24b99cf9b4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of KrbRelay, a Kerberos relaying tool",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -41060,7 +41103,7 @@
     {
         "title": "New Remote Desktop Connection Initiated Via Mstsc.EXE",
         "id": "954f0af7-62dd-418f-b3df-a84bc2c7a774",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the usage of \"mstsc.exe\" with the \"/v\" flag to initiate a connection to a remote server.\nAdversaries may use valid accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.\n",
         "author": "frack113",
         "tags": [
@@ -41255,7 +41298,7 @@
     {
         "title": "HackTool - PowerTool Execution",
         "id": "a34f79a3-8e5f-4cc3-b765-de00695452c2",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the tool PowerTool which has the ability to kill a process, delete its process file, unload drivers, and delete the driver files",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -41293,7 +41336,7 @@
     {
         "title": "Potentially Over Permissive Permissions Granted Using Dsacls.EXE",
         "id": "01c42d3c-242d-4655-85b2-34f1739632f7",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of Dsacls to grant over permissive permissions",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -41447,7 +41490,7 @@
     {
         "title": "Potential Credential Dumping Attempt Using New NetworkProvider - CLI",
         "id": "baef1ec6-2ca9-47a3-97cc-4cf2bda10b77",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -41507,7 +41550,7 @@
     {
         "title": "Potential Recon Activity Via Nltest.EXE",
         "id": "5cc90652-4cbd-4241-aa3b-4b462fa5a248",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects nltest commands that can be used for information discovery",
         "author": "Craig Young, oscd.community, Georg Lauenstein",
         "tags": [
@@ -41873,7 +41916,7 @@
     {
         "title": "HackTool - SharpLdapWhoami Execution",
         "id": "d9367cbb-c2e0-47ce-bdc0-128cb6da898d",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -41914,7 +41957,7 @@
     {
         "title": "SafeBoot Registry Key Deleted Via Reg.EXE",
         "id": "fc0e89b5-adb0-43c1-b749-c12a10ec37de",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of \"reg.exe\" commands with the \"delete\" flag on safe boot registry keys. Often used by attacker to prevent safeboot execution of security products",
         "author": "Nasreddine Bencherchali (Nextron Systems), Tim Shelton",
         "tags": [
@@ -42085,7 +42128,7 @@
     {
         "title": "Suspicious Binary In User Directory Spawned From Office Application",
         "id": "aa3a6f94-890e-4e22-b634-ffdfd54792cc",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an executable in the users directory started from one of the Microsoft Office suite applications (Word, Excel, PowerPoint, Publisher, Visio)",
         "author": "Jason Lynch",
         "tags": [
@@ -42166,7 +42209,7 @@
     {
         "title": "Fsutil Behavior Set SymlinkEvaluation",
         "id": "c0b2768a-dd06-4671-8339-b16ca8d1f27f",
-        "status": "experimental",
+        "status": "test",
         "description": "A symbolic link is a type of file that contains a reference to another file.\nThis is probably done to make sure that the ransomware is able to follow shortcuts on the machine in order to find the original file to encrypt\n",
         "author": "frack113",
         "tags": [
@@ -42438,7 +42481,7 @@
     {
         "title": "Suspicious Hacktool Execution - PE Metadata",
         "id": "37c1333a-a0db-48be-b64b-7393b2386e3b",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -42499,7 +42542,7 @@
     {
         "title": "Suspicious Rundll32 Script in CommandLine",
         "id": "73fcad2e-ff14-4c38-b11d-4172c8ac86c7",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious process related to rundll32 based on arguments",
         "author": "frack113, Zaw Min Htun (ZETA)",
         "tags": [
@@ -43134,7 +43177,7 @@
     {
         "title": "PowerShell Base64 Encoded WMI Classes",
         "id": "1816994b-42e1-4fb1-afd2-134d88184f71",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects calls to base64 encoded WMI class such as \"Win32_Shadowcopy\", \"Win32_ScheduledJob\", etc.",
         "author": "Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -43253,7 +43296,7 @@
     {
         "title": "HackTool - SysmonEOP Execution",
         "id": "8a7e90c5-fe6e-45dc-889e-057fe4378bd9",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -43331,7 +43374,7 @@
     {
         "title": "PUA - Fast Reverse Proxy (FRP) Execution",
         "id": "32410e29-5f94-4568-b6a3-d91a8adad863",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet.",
         "author": "frack113, Florian Roth",
         "tags": [
@@ -43394,7 +43437,7 @@
     {
         "title": "Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE",
         "id": "48917adc-a28e-4f5d-b729-11e75da8941f",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the usage of \"reg.exe\" to add Defender folder exclusions. Qbot has been seen using this technique to add exclusions for folders within AppData and ProgramData.",
         "author": "frack113",
         "tags": [
@@ -43834,7 +43877,7 @@
     {
         "title": "Operator Bloopers Cobalt Strike Commands",
         "id": "647c7b9e-d784-4fda-b9a0-45c565a7b729",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects use of Cobalt Strike commands accidentally entered in the CMD shell",
         "author": "_pete_0, TheDFIRReport",
         "tags": [
@@ -44278,7 +44321,7 @@
     {
         "title": "HackTool - HandleKatz LSASS Dumper Execution",
         "id": "ca621ba5-54ab-4035-9942-d378e6fcde3c",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -44727,7 +44770,7 @@
     {
         "title": "New Generic Credentials Added Via Cmdkey.EXE",
         "id": "b1ec66c6-f4d1-4b5c-96dd-af28ccae7727",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of cmdkey to add generic credentials. As an example, this has to be used before connecting to an RDP session via command line interface.",
         "author": "frack113, Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -45099,7 +45142,7 @@
     {
         "title": "Suspicious Shells Spawn by Java Utility Keytool",
         "id": "90fb5e62-ca1f-4e22-b42e-cc521874c938",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation)",
         "author": "Andreas Hunkeler (@Karneades)",
         "tags": [
@@ -45119,7 +45162,7 @@
     {
         "title": "PUA - NPS Tunneling Tool Execution",
         "id": "68d37776-61db-42f5-bf54-27e87072d17e",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of NPS, a port forwarding and intranet penetration proxy server",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -45275,7 +45318,7 @@
     {
         "title": "Renamed Msdt.EXE Execution",
         "id": "bd1c6866-65fc-44b2-be51-5588fcff82b9",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed \"Msdt.exe\" binary",
         "author": "pH-T (Nextron Systems)",
         "tags": [
@@ -45313,7 +45356,7 @@
     {
         "title": "Execution from Suspicious Folder",
         "id": "3dfd06d2-eaf4-4532-9555-68aca59f57c4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects a suspicious execution from an uncommon folder",
         "author": "Florian Roth (Nextron Systems), Tim Shelton",
         "tags": [
@@ -45468,7 +45511,7 @@
     {
         "title": "Lolbin Ssh.exe Use As Proxy",
         "id": "7d6d30b8-5b91-4b90-a891-46cccaf29598",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect usage of the \"ssh.exe\" binary as a proxy to launch other programs",
         "author": "frack113, Nasreddine Bencherchali",
         "tags": [
@@ -45565,7 +45608,7 @@
     {
         "title": "Renamed Mavinject.EXE Execution",
         "id": "e6474a1b-5390-49cd-ab41-8d88655f7394",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed version of the \"Mavinject\" process. Which can be abused to perform process injection using the \"/INJECTRUNNING\" flag",
         "author": "frack113, Florian Roth",
         "tags": [
@@ -46741,7 +46784,7 @@
     {
         "title": "Query Usage To Exfil Data",
         "id": "53ef0cef-fa24-4f25-a34a-6c72dfa2e6e2",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of \"query.exe\" a system binary to exfil information such as \"sessions\" and \"processes\" for later use",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -46856,7 +46899,7 @@
     {
         "title": "Potential PowerShell Execution Policy Tampering - ProcCreation",
         "id": "cf2e938e-9a3e-4fe8-a347-411642b28a9f",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects changes to the PowerShell execution policy registry key in order to bypass signing requirements for script execution from the CommandLine",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -46874,7 +46917,7 @@
     {
         "title": "Renamed BrowserCore.EXE Execution",
         "id": "8a4519e8-e64a-40b6-ae85-ba8ad2177559",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects process creation with a renamed BrowserCore.exe (used to extract Azure tokens)",
         "author": "Max Altgelt (Nextron Systems)",
         "tags": [
@@ -47145,7 +47188,7 @@
     {
         "title": "Suspicious Use of PsLogList",
         "id": "aae1243f-d8af-40d8-ab20-33fc6d0c55bc",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of the PsLogList utility to dump event log in order to extract admin accounts and perform account discovery or delete events logs",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -47352,7 +47395,7 @@
     {
         "title": "Renamed Vmnat.exe Execution",
         "id": "7b4f794b-590a-4ad4-ba18-7964a2832205",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects renamed vmnat.exe or portable version that can be used for DLL side-loading",
         "author": "elhoim",
         "tags": [
@@ -47371,7 +47414,7 @@
     {
         "title": "Renamed Sysinternals Sdelete Execution",
         "id": "c1d867fe-8d95-4487-aab4-e53f2d339f90",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of a renamed SysInternals Sdelete, which is something an administrator shouldn't do (the renaming)",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -47844,7 +47887,7 @@
     {
         "title": "Potential Signing Bypass Via Windows Developer Features",
         "id": "a383dec4-deec-4e6e-913b-ed9249670848",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when a user enable developer features such as \"Developer Mode\" or \"Application Sideloading\". Which allows the user to install untrusted packages.",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -47900,7 +47943,7 @@
     {
         "title": "Renamed Remote Utilities RAT (RURAT) Execution",
         "id": "9ef27c24-4903-4192-881a-3adde7ff92a5",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of renamed Remote Utilities (RURAT) via Product PE header field",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -48275,7 +48318,7 @@
     {
         "title": "Root Certificate Installed From Susp Locations",
         "id": "5f6a601c-2ecb-498b-9c33-660362323afa",
-        "status": "experimental",
+        "status": "test",
         "description": "Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -48294,7 +48337,7 @@
     {
         "title": "Potential Process Injection Via Msra.EXE",
         "id": "744a188b-0415-4792-896f-11ddb0588dbc",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential process injection via Microsoft Remote Asssistance (Msra.exe) by looking at suspicious child processes spawned from the aforementioned process. It has been a target used by many threat actors and used for discovery and persistence tactics",
         "author": "Alexander McDonald",
         "tags": [
@@ -48807,7 +48850,7 @@
     {
         "title": "Import PowerShell Modules From Suspicious Directories - ProcCreation",
         "id": "c31364f7-8be6-4b77-8483-dd2b5a7b69a3",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects powershell scripts that import modules from suspicious directories",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -48907,7 +48950,7 @@
     {
         "title": "Potential RDP Tunneling Via SSH",
         "id": "f7d7ebd5-a016-46e2-9c54-f9932f2d386d",
-        "status": "experimental",
+        "status": "test",
         "description": "Execution of ssh.exe to perform data exfiltration and tunneling through RDP",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -49218,7 +49261,7 @@
     {
         "title": "Potential Discovery Activity Via Dnscmd.EXE",
         "id": "b6457d63-d2a2-4e29-859d-4e7affc153d1",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an attempt to leverage dnscmd.exe to enumerate the DNS zones of a domain. DNS zones used to host the DNS records for a particular domain.",
         "author": "@gott_cyber",
         "tags": [
@@ -49278,7 +49321,7 @@
     {
         "title": "Service Registry Key Deleted Via Reg.EXE",
         "id": "05b2aa93-1210-42c8-8d9a-2fcc13b284f5",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of \"reg.exe\" commands with the \"delete\" flag on services registry key. Often used by attacker to remove AV software services",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -49587,7 +49630,7 @@
     {
         "title": "HackTool - Htran/NATBypass Execution",
         "id": "f5e3b62f-e577-4e59-931e-0a15b2b94e1e",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass)",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -49626,7 +49669,7 @@
     {
         "title": "SQLite Firefox Profile Data DB Access",
         "id": "4833155a-4053-4c9c-a997-777fcea0baa7",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect usage of the \"sqlite\" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.",
         "author": "frack113",
         "tags": [
diff --git a/rules/rules_windows_generic_high.json b/rules/rules_windows_generic_high.json
index f6c0db9..d4dcefe 100644
--- a/rules/rules_windows_generic_high.json
+++ b/rules/rules_windows_generic_high.json
@@ -2880,7 +2880,7 @@
     {
         "title": "Potential Svchost Memory Access",
         "id": "166e9c50-8cd9-44af-815d-d1f0c0e90dde",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential access to svchost process memory such as that used by Invoke-Phantom to kill the winRM Windows event logging service.",
         "author": "Tim Burrell",
         "tags": [
@@ -3375,7 +3375,7 @@
     {
         "title": "Malicious PowerShell Scripts - PoshModule",
         "id": "41025fd7-0466-4650-a813-574aaacbe7f4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of known offensive powershell scripts used for exploitation or reconnaissance",
         "author": "frack113, Nasreddine Bencherchali",
         "tags": [
@@ -4654,7 +4654,7 @@
     {
         "title": "Malicious Nishang PowerShell Commandlets",
         "id": "f772cee9-b7c2-4cb2-8f07-49870adc02e0",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects Commandlet names and arguments from the Nishang exploitation framework",
         "author": "Alec Costello",
         "tags": [
@@ -4692,7 +4692,7 @@
     {
         "title": "DNS Query for Anonfiles.com Domain - Sysmon",
         "id": "065cceea-77ec-4030-9052-fc0affea7110",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects DNS queries for \"anonfiles.com\", which is an anonymous file upload platform often used for malicious purposes",
         "author": "pH-T (Nextron Systems)",
         "tags": [
@@ -5641,7 +5641,7 @@
     {
         "title": "Potential DLL Sideloading Of Non-Existent DLLs From System Folders",
         "id": "6b98b92b-4f00-4f62-b4fe-4d1920215771",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects DLL sideloading of system dlls that are not present on the system by default. Usually to achieve techniques such as UAC bypass and privilege escalation",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -6529,7 +6529,7 @@
     {
         "title": "Suspicious Startup Folder Persistence",
         "id": "28208707-fe31-437f-9a7f-4b1108b94d2e",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when a file with a suspicious extension is created in the startup folder",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -9905,7 +9905,7 @@
     {
         "title": "Potential Exploitation Attempt From Office Application",
         "id": "868955d9-697e-45d4-a3da-360cefd7c216",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects Office applications executing a child process that includes directory traversal patterns. This could be an attempt to exploit CVE-2022-30190 (MSDT RCE) or CVE-2021-40444 (MSHTML RCE)",
         "author": "Christian Burkard (Nextron Systems), @SBousseaden (idea)",
         "tags": [
@@ -10803,7 +10803,7 @@
     {
         "title": "Potential CVE-2022-26809 Exploitation Attempt",
         "id": "a7cd7306-df8b-4398-b711-6f3e4935cf16",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious remote procedure call (RPC) service anomalies based on the spawned sub processes (long shot to detect the exploitation of vulnerabilities like CVE-2022-26809)",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -10909,7 +10909,7 @@
     {
         "title": "Potential Centos Web Panel Exploitation Attempt - CVE-2022-44877",
         "id": "1b2eeb27-949b-4704-8bfa-d8e5cfa045a1",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential exploitation attempts that target the Centos Web Panel 7 Unauthenticated Remote Code Execution CVE-2022-44877",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -11379,7 +11379,7 @@
         ],
         "level": "high",
         "rule": [
-            "SELECT * FROM logs WHERE (EventID = '4688' AND Channel = 'Security' AND ParentProcessName LIKE '%\\\\ws\\_tomcatservice.exe' ESCAPE '\\' AND NewProcessName LIKE '%\\\\repadmin.exe' ESCAPE '\\')"
+            "SELECT * FROM logs WHERE ((EventID = '4688' AND Channel = 'Security') AND ParentProcessName LIKE '%\\\\ws\\_tomcatservice.exe' ESCAPE '\\' AND NOT ((NewProcessName LIKE '%\\\\repadmin.exe' ESCAPE '\\')))"
         ],
         "filename": "proc_creation_win_apt_mint_sandstorm_log4j_wstomcat_execution.yml"
     },
@@ -12156,7 +12156,7 @@
     {
         "title": "Potential Exploitation Attempt Of Undocumented WindowsServer RCE",
         "id": "6d5b8176-d87d-4402-8af4-53aee9db7b5d",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential exploitation attempt of undocumented Windows Server Pre Auth Remote Code Execution (RCE)",
         "author": "Florian Roth (Nextron Systems), Nasreddine Bencherchali",
         "tags": [
@@ -13528,7 +13528,7 @@
     {
         "title": "Suspicious AppX Package Locations",
         "id": "5cdeaf3d-1489-477c-95ab-c318559fc051",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an appx package added the pipeline of the \"to be processed\" packages which is located in suspicious locations",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -15522,7 +15522,7 @@
     {
         "title": "DNS Query for Anonfiles.com Domain - DNS Client",
         "id": "29f171d7-aa47-42c7-9c7b-3c87938164d9",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects DNS queries for anonfiles.com, which is an anonymous file upload platform often used for malicious purposes",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -16712,7 +16712,7 @@
     {
         "title": "Restricted Software Access By SRP",
         "id": "b4c8da4a-1c12-46b0-8a2b-0a8521d03442",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects restricted access to applications by the Software Restriction Policies (SRP) policy",
         "author": "frack113",
         "tags": [
@@ -17444,7 +17444,7 @@
     {
         "title": "Renamed Plink Execution",
         "id": "1c12727d-02bf-45ff-a9f3-d49806a3cf43",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed version of the Plink binary",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -18056,7 +18056,7 @@
     {
         "title": "Potential Persistence Via Powershell Search Order Hijacking - Task",
         "id": "b66474aa-bd92-4333-a16c-298155b120df",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell \"Get-Variable\" technique as seen being used in Colibri Loader",
         "author": "pH-T (Nextron Systems), Florian Roth (Nextron Systems)",
         "tags": [
@@ -18351,7 +18351,7 @@
     {
         "title": "SQLite Chromium Profile Data DB Access",
         "id": "24c77512-782b-448a-8950-eddb0785fc71",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect usage of the \"sqlite\" binary to query databases in Chromium-based browsers for potential data stealing.",
         "author": "TropChaud",
         "tags": [
@@ -18690,7 +18690,7 @@
     {
         "title": "Renamed NetSupport RAT Execution",
         "id": "0afbd410-de03-4078-8491-f132303cb67d",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed \"client32.exe\" (NetSupport RAT) via Imphash, Product and OriginalFileName strings",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -19024,7 +19024,7 @@
     {
         "title": "HackTool - Inveigh Execution",
         "id": "b99a1518-1ad5-4f65-bc95-1ffff97a8fd0",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -19224,7 +19224,7 @@
     {
         "title": "Disabled RestrictedAdminMode For RDS - ProcCreation",
         "id": "28ac00d6-22d9-4a3c-927f-bbd770104573",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect activation of DisableRestrictedAdmin to disable RestrictedAdmin mode.\nRestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.\nThis prevents your credentials from being harvested during the initial connection process if the remote server has been compromise\n",
         "author": "frack113",
         "tags": [
@@ -19421,7 +19421,7 @@
     {
         "title": "HackTool - SafetyKatz Execution",
         "id": "b1876533-4ed5-4a83-90f3-b8645840a413",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the hacktool SafetyKatz via PE information and default Image name",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -19617,7 +19617,7 @@
     {
         "title": "Potential Renamed Rundll32 Execution",
         "id": "2569ed8c-1147-498a-9b8c-2ad3656b10ed",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when 'DllRegisterServer' is called in the commandline and the image is not rundll32. This could mean that the 'rundll32' utility has been renamed in order to avoid detection",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -19730,7 +19730,7 @@
     {
         "title": "PUA - DefenderCheck Execution",
         "id": "f0ca6c24-3225-47d5-b1f5-352bf07ecfa7",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of DefenderCheck, a tool to evaluate the signatures used in Microsoft Defender. It can be used to figure out the strings / byte chains used in Microsoft Defender to detect a tool and thus used for AV evasion.",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -19999,7 +19999,7 @@
     {
         "title": "Suspicious Hacktool Execution - Imphash",
         "id": "24e3e58a-646b-4b50-adef-02ef935b9fc8",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -20389,7 +20389,7 @@
     {
         "title": "Microsoft IIS Service Account Password Dumped",
         "id": "2d3cdeec-c0db-45b4-aa86-082f7eb75701",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords",
         "author": "Tim Rauch, Janantha Marasinghe",
         "tags": [
@@ -20880,7 +20880,7 @@
     {
         "title": "Potential WinAPI Calls Via CommandLine",
         "id": "ba3f5c1b-6272-4119-9dbd-0bc8d21c2702",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -20960,7 +20960,7 @@
     {
         "title": "PUA - Seatbelt Execution",
         "id": "38646daa-e78f-4ace-9de0-55547b2d30da",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -21023,7 +21023,7 @@
     {
         "title": "Potential Arbitrary Code Execution Via Node.EXE",
         "id": "6640f31c-01ad-49b5-beb5-83498a5cd8bd",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution node.exe which is shipped with multiple software such as VMware, Adobe...etc. In order to execute arbitrary code. For example to establish reverse shell as seen in Log4j attacks...etc",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -21224,7 +21224,7 @@
     {
         "title": "HackTool - SharPersist Execution",
         "id": "26488ad0-f9fd-4536-876f-52fea846a2e4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the hacktool SharPersist - used to deploy various different kinds of persistence mechanisms",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -21266,7 +21266,7 @@
     {
         "title": "Uncommon One Time Only Scheduled Task At 00:00",
         "id": "970823b7-273b-460a-8afc-3a6811998529",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects scheduled task creation events that include suspicious actions, and is run once at 00:00",
         "author": "pH-T (Nextron Systems)",
         "tags": [
@@ -21872,7 +21872,7 @@
     {
         "title": "Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE",
         "id": "07f8bdc2-c9b3-472a-9817-5a670b872f53",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of cmdkey to look for cached credentials on the system",
         "author": "jmallette, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -21948,7 +21948,7 @@
     {
         "title": "Operator Bloopers Cobalt Strike Modules",
         "id": "4f154fb6-27d1-4813-a759-78b93e0b9c48",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects Cobalt Strike module/commands accidentally entered in CMD shell",
         "author": "_pete_0, TheDFIRReport",
         "tags": [
@@ -22590,7 +22590,7 @@
     {
         "title": "HackTool - KrbRelayUp Execution",
         "id": "12827a56-61a4-476a-a9cb-f3068f191073",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -22941,7 +22941,7 @@
     {
         "title": "Disable Windows IIS HTTP Logging",
         "id": "e4ed6030-ffe5-4e6a-8a8a-ab3c1ab9d94e",
-        "status": "experimental",
+        "status": "test",
         "description": "Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union)",
         "author": "frack113",
         "tags": [
@@ -23678,7 +23678,7 @@
     {
         "title": "HackTool - KrbRelay Execution",
         "id": "e96253b8-6b3b-4f90-9e59-3b24b99cf9b4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of KrbRelay, a Kerberos relaying tool",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -23755,7 +23755,7 @@
     {
         "title": "HackTool - PowerTool Execution",
         "id": "a34f79a3-8e5f-4cc3-b765-de00695452c2",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the tool PowerTool which has the ability to kill a process, delete its process file, unload drivers, and delete the driver files",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -23852,7 +23852,7 @@
     {
         "title": "Potential Credential Dumping Attempt Using New NetworkProvider - CLI",
         "id": "baef1ec6-2ca9-47a3-97cc-4cf2bda10b77",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -23871,7 +23871,7 @@
     {
         "title": "Potential Recon Activity Via Nltest.EXE",
         "id": "5cc90652-4cbd-4241-aa3b-4b462fa5a248",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects nltest commands that can be used for information discovery",
         "author": "Craig Young, oscd.community, Georg Lauenstein",
         "tags": [
@@ -24086,7 +24086,7 @@
     {
         "title": "HackTool - SharpLdapWhoami Execution",
         "id": "d9367cbb-c2e0-47ce-bdc0-128cb6da898d",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -24127,7 +24127,7 @@
     {
         "title": "SafeBoot Registry Key Deleted Via Reg.EXE",
         "id": "fc0e89b5-adb0-43c1-b749-c12a10ec37de",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of \"reg.exe\" commands with the \"delete\" flag on safe boot registry keys. Often used by attacker to prevent safeboot execution of security products",
         "author": "Nasreddine Bencherchali (Nextron Systems), Tim Shelton",
         "tags": [
@@ -24203,7 +24203,7 @@
     {
         "title": "Suspicious Binary In User Directory Spawned From Office Application",
         "id": "aa3a6f94-890e-4e22-b634-ffdfd54792cc",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an executable in the users directory started from one of the Microsoft Office suite applications (Word, Excel, PowerPoint, Publisher, Visio)",
         "author": "Jason Lynch",
         "tags": [
@@ -24417,7 +24417,7 @@
     {
         "title": "Suspicious Hacktool Execution - PE Metadata",
         "id": "37c1333a-a0db-48be-b64b-7393b2386e3b",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -24743,7 +24743,7 @@
     {
         "title": "PowerShell Base64 Encoded WMI Classes",
         "id": "1816994b-42e1-4fb1-afd2-134d88184f71",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects calls to base64 encoded WMI class such as \"Win32_Shadowcopy\", \"Win32_ScheduledJob\", etc.",
         "author": "Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -24784,7 +24784,7 @@
     {
         "title": "HackTool - SysmonEOP Execution",
         "id": "8a7e90c5-fe6e-45dc-889e-057fe4378bd9",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -24804,7 +24804,7 @@
     {
         "title": "PUA - Fast Reverse Proxy (FRP) Execution",
         "id": "32410e29-5f94-4568-b6a3-d91a8adad863",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet.",
         "author": "frack113, Florian Roth",
         "tags": [
@@ -25091,7 +25091,7 @@
     {
         "title": "Operator Bloopers Cobalt Strike Commands",
         "id": "647c7b9e-d784-4fda-b9a0-45c565a7b729",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects use of Cobalt Strike commands accidentally entered in the CMD shell",
         "author": "_pete_0, TheDFIRReport",
         "tags": [
@@ -25244,7 +25244,7 @@
     {
         "title": "HackTool - HandleKatz LSASS Dumper Execution",
         "id": "ca621ba5-54ab-4035-9942-d378e6fcde3c",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -25681,7 +25681,7 @@
     {
         "title": "Suspicious Shells Spawn by Java Utility Keytool",
         "id": "90fb5e62-ca1f-4e22-b42e-cc521874c938",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation)",
         "author": "Andreas Hunkeler (@Karneades)",
         "tags": [
@@ -25701,7 +25701,7 @@
     {
         "title": "PUA - NPS Tunneling Tool Execution",
         "id": "68d37776-61db-42f5-bf54-27e87072d17e",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of NPS, a port forwarding and intranet penetration proxy server",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -25798,7 +25798,7 @@
     {
         "title": "Renamed Msdt.EXE Execution",
         "id": "bd1c6866-65fc-44b2-be51-5588fcff82b9",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed \"Msdt.exe\" binary",
         "author": "pH-T (Nextron Systems)",
         "tags": [
@@ -25836,7 +25836,7 @@
     {
         "title": "Execution from Suspicious Folder",
         "id": "3dfd06d2-eaf4-4532-9555-68aca59f57c4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects a suspicious execution from an uncommon folder",
         "author": "Florian Roth (Nextron Systems), Tim Shelton",
         "tags": [
@@ -25988,7 +25988,7 @@
     {
         "title": "Renamed Mavinject.EXE Execution",
         "id": "e6474a1b-5390-49cd-ab41-8d88655f7394",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed version of the \"Mavinject\" process. Which can be abused to perform process injection using the \"/INJECTRUNNING\" flag",
         "author": "frack113, Florian Roth",
         "tags": [
@@ -26694,7 +26694,7 @@
     {
         "title": "Potential PowerShell Execution Policy Tampering - ProcCreation",
         "id": "cf2e938e-9a3e-4fe8-a347-411642b28a9f",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects changes to the PowerShell execution policy registry key in order to bypass signing requirements for script execution from the CommandLine",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -26712,7 +26712,7 @@
     {
         "title": "Renamed BrowserCore.EXE Execution",
         "id": "8a4519e8-e64a-40b6-ae85-ba8ad2177559",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects process creation with a renamed BrowserCore.exe (used to extract Azure tokens)",
         "author": "Max Altgelt (Nextron Systems)",
         "tags": [
@@ -26973,7 +26973,7 @@
     {
         "title": "Renamed Vmnat.exe Execution",
         "id": "7b4f794b-590a-4ad4-ba18-7964a2832205",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects renamed vmnat.exe or portable version that can be used for DLL side-loading",
         "author": "elhoim",
         "tags": [
@@ -26992,7 +26992,7 @@
     {
         "title": "Renamed Sysinternals Sdelete Execution",
         "id": "c1d867fe-8d95-4487-aab4-e53f2d339f90",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of a renamed SysInternals Sdelete, which is something an administrator shouldn't do (the renaming)",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -27184,7 +27184,7 @@
     {
         "title": "Potential Signing Bypass Via Windows Developer Features",
         "id": "a383dec4-deec-4e6e-913b-ed9249670848",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when a user enable developer features such as \"Developer Mode\" or \"Application Sideloading\". Which allows the user to install untrusted packages.",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -27339,7 +27339,7 @@
     {
         "title": "Root Certificate Installed From Susp Locations",
         "id": "5f6a601c-2ecb-498b-9c33-660362323afa",
-        "status": "experimental",
+        "status": "test",
         "description": "Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -27358,7 +27358,7 @@
     {
         "title": "Potential Process Injection Via Msra.EXE",
         "id": "744a188b-0415-4792-896f-11ddb0588dbc",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential process injection via Microsoft Remote Asssistance (Msra.exe) by looking at suspicious child processes spawned from the aforementioned process. It has been a target used by many threat actors and used for discovery and persistence tactics",
         "author": "Alexander McDonald",
         "tags": [
@@ -27700,7 +27700,7 @@
     {
         "title": "Potential RDP Tunneling Via SSH",
         "id": "f7d7ebd5-a016-46e2-9c54-f9932f2d386d",
-        "status": "experimental",
+        "status": "test",
         "description": "Execution of ssh.exe to perform data exfiltration and tunneling through RDP",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -27856,7 +27856,7 @@
     {
         "title": "Service Registry Key Deleted Via Reg.EXE",
         "id": "05b2aa93-1210-42c8-8d9a-2fcc13b284f5",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of \"reg.exe\" commands with the \"delete\" flag on services registry key. Often used by attacker to remove AV software services",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -28011,7 +28011,7 @@
     {
         "title": "HackTool - Htran/NATBypass Execution",
         "id": "f5e3b62f-e577-4e59-931e-0a15b2b94e1e",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass)",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -28031,7 +28031,7 @@
     {
         "title": "SQLite Firefox Profile Data DB Access",
         "id": "4833155a-4053-4c9c-a997-777fcea0baa7",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect usage of the \"sqlite\" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.",
         "author": "frack113",
         "tags": [
diff --git a/rules/rules_windows_generic_medium.json b/rules/rules_windows_generic_medium.json
index 04ef5e0..a5349c7 100644
--- a/rules/rules_windows_generic_medium.json
+++ b/rules/rules_windows_generic_medium.json
@@ -3333,7 +3333,7 @@
     {
         "title": "Potential PendingFileRenameOperations Tamper",
         "id": "4eec988f-7bf0-49f1-8675-1e6a510b3a2a",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect changes to the \"PendingFileRenameOperations\" registry key from uncommon or suspicious images lcoations to stage currently used files for rename after reboot.",
         "author": "frack113",
         "tags": [
@@ -3686,7 +3686,7 @@
     {
         "title": "Atbroker Registry Change",
         "id": "9577edbb-851f-4243-8c91-1d5b50c1a39b",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'",
         "author": "Mateusz Wydra, oscd.community",
         "tags": [
@@ -4609,7 +4609,7 @@
     {
         "title": "Potential Svchost Memory Access",
         "id": "166e9c50-8cd9-44af-815d-d1f0c0e90dde",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential access to svchost process memory such as that used by Invoke-Phantom to kill the winRM Windows event logging service.",
         "author": "Tim Burrell",
         "tags": [
@@ -5261,7 +5261,7 @@
     {
         "title": "Suspicious PowerShell Download - PoshModule",
         "id": "de41232e-12e8-49fa-86bc-c05c7e722df9",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious PowerShell download command",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -5339,7 +5339,7 @@
     {
         "title": "Malicious PowerShell Scripts - PoshModule",
         "id": "41025fd7-0466-4650-a813-574aaacbe7f4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of known offensive powershell scripts used for exploitation or reconnaissance",
         "author": "frack113, Nasreddine Bencherchali",
         "tags": [
@@ -5400,7 +5400,7 @@
     {
         "title": "Potential Active Directory Enumeration Using AD Module - PsModule",
         "id": "74176142-4684-4d8a-8b0a-713257e7df8e",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of the \"Import-Module\" cmdlet to load the \"Microsoft.ActiveDirectory.Management.dl\" DLL. Which is often used by attackers to perform AD enumeration.",
         "author": "Nasreddine Bencherchali (Nextron Systems), frack113",
         "tags": [
@@ -6416,7 +6416,7 @@
     {
         "title": "Usage Of Web Request Commands And Cmdlets - ScriptBlock",
         "id": "1139d2e2-84b1-4226-b445-354492eba8ba",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via PowerShell scriptblock logs",
         "author": "James Pemberton / @4A616D6573",
         "tags": [
@@ -6855,7 +6855,7 @@
     {
         "title": "Unsigned AppX Installation Attempt Using Add-AppxPackage - PsScript",
         "id": "975b2262-9a49-439d-92a6-0709cccdf0b2",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of the \"Add-AppxPackage\" or it's alias \"Add-AppPackage\" to install unsigned AppX packages",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -7199,7 +7199,7 @@
     {
         "title": "Import PowerShell Modules From Suspicious Directories",
         "id": "21f9162c-5f5d-4b01-89a8-b705bd7d10ab",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects powershell scripts that import modules from suspicious directories",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -7467,7 +7467,7 @@
     {
         "title": "Potential Data Exfiltration Via Audio File",
         "id": "e4f93c99-396f-47c8-bb0f-201b1fa69034",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential exfiltration attempt via audio file using PowerShell",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -7600,7 +7600,7 @@
     {
         "title": "Powershell XML Execute Command",
         "id": "6c6c6282-7671-4fe9-a0ce-a2dcebdc342b",
-        "status": "experimental",
+        "status": "test",
         "description": "Adversaries may abuse PowerShell commands and scripts for execution.\nPowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell)\nAdversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code\n",
         "author": "frack113",
         "tags": [
@@ -8260,7 +8260,7 @@
     {
         "title": "Potential Active Directory Enumeration Using AD Module - PsScript",
         "id": "9e620995-f2d8-4630-8430-4afd89f77604",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of the \"Import-Module\" cmdlet to load the \"Microsoft.ActiveDirectory.Management.dl\" DLL. Which is often used by attackers to perform AD enumeration.",
         "author": "frack113, Nasreddine Bencherchali",
         "tags": [
@@ -8457,7 +8457,7 @@
     {
         "title": "Malicious Nishang PowerShell Commandlets",
         "id": "f772cee9-b7c2-4cb2-8f07-49870adc02e0",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects Commandlet names and arguments from the Nishang exploitation framework",
         "author": "Alec Costello",
         "tags": [
@@ -8473,25 +8473,6 @@
         ],
         "filename": "posh_ps_nishang_malicious_commandlets.yml"
     },
-    {
-        "title": "Suspicious DNS Query for IP Lookup Service APIs",
-        "id": "ec82e2a5-81ea-4211-a1f8-37a0286df2c2",
-        "status": "test",
-        "description": "Detects DNS queries for IP lookup services such as \"api.ipify.org\" originating from a non browser process.",
-        "author": "Brandon George (blog post), Thomas Patzke",
-        "tags": [
-            "attack.reconnaissance",
-            "attack.t1590"
-        ],
-        "falsepositives": [
-            "Legitimate usage of IP lookup services such as ipify API"
-        ],
-        "level": "medium",
-        "rule": [
-            "SELECT * FROM logs WHERE ((QueryName LIKE '%api.2ip.ua%' ESCAPE '\\' OR QueryName LIKE '%api.ipify.org%' ESCAPE '\\' OR QueryName LIKE '%bot.whatismyipaddress.com%' ESCAPE '\\' OR QueryName LIKE '%canireachthe.net%' ESCAPE '\\' OR QueryName LIKE '%checkip.amazonaws.com%' ESCAPE '\\' OR QueryName LIKE '%checkip.dyndns.org%' ESCAPE '\\' OR QueryName LIKE '%curlmyip.com%' ESCAPE '\\' OR QueryName LIKE '%edns.ip-api.com%' ESCAPE '\\' OR QueryName LIKE '%eth0.me%' ESCAPE '\\' OR QueryName LIKE '%freegeoip.app%' ESCAPE '\\' OR QueryName LIKE '%geoipy.com%' ESCAPE '\\' OR QueryName LIKE '%getip.pro%' ESCAPE '\\' OR QueryName LIKE '%icanhazip.com%' ESCAPE '\\' OR QueryName LIKE '%ident.me%' ESCAPE '\\' OR QueryName LIKE '%ifconfig.io%' ESCAPE '\\' OR QueryName LIKE '%ifconfig.me%' ESCAPE '\\' OR QueryName LIKE '%ip-api.com%' ESCAPE '\\' OR QueryName LIKE '%ip.anysrc.net%' ESCAPE '\\' OR QueryName LIKE '%ip.tyk.nu%' ESCAPE '\\' OR QueryName LIKE '%ipaddressworld.com%' ESCAPE '\\' OR QueryName LIKE '%ipecho.net%' ESCAPE '\\' OR QueryName LIKE '%ipinfo.io%' ESCAPE '\\' OR QueryName LIKE '%ipof.in%' ESCAPE '\\' OR QueryName LIKE '%ipv4.icanhazip.com%' ESCAPE '\\' OR QueryName LIKE '%ipv4bot.whatismyipaddress.com%' ESCAPE '\\' OR QueryName LIKE '%ipwho.is%' ESCAPE '\\' OR QueryName LIKE '%l2.io%' ESCAPE '\\' OR QueryName LIKE '%myexternalip.com%' ESCAPE '\\' OR QueryName LIKE '%wgetip.com%' ESCAPE '\\' OR QueryName LIKE '%whatismyip.akamai.com%' ESCAPE '\\' OR QueryName LIKE '%wtfismyip.com%' ESCAPE '\\') AND NOT ((NewProcessName LIKE '%\\\\brave.exe' ESCAPE '\\') OR ((NewProcessName LIKE 'C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\')) OR ((NewProcessName LIKE 'C:\\\\Program Files\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\')) OR ((NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\')) OR (NewProcessName LIKE '%\\\\maxthon.exe' ESCAPE '\\') OR (NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\%' ESCAPE '\\' OR NewProcessName LIKE '%\\\\WindowsApps\\\\MicrosoftEdge.exe' ESCAPE '\\' OR (NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\')) OR ((NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\') AND (NewProcessName LIKE '%\\\\msedge.exe' ESCAPE '\\' OR NewProcessName LIKE '%\\\\msedgewebview2.exe' ESCAPE '\\')) OR (NewProcessName LIKE '%\\\\opera.exe' ESCAPE '\\') OR (NewProcessName LIKE '%\\\\safari.exe' ESCAPE '\\') OR (NewProcessName LIKE '%\\\\seamonkey.exe' ESCAPE '\\') OR (NewProcessName LIKE '%\\\\vivaldi.exe' ESCAPE '\\') OR (NewProcessName LIKE '%\\\\whale.exe' ESCAPE '\\')))"
-        ],
-        "filename": "dns_query_win_susp_ipify.yml"
-    },
     {
         "title": "DNS Query Request By Regsvr32.EXE",
         "id": "36e037c4-c228-4866-b6a3-48eb292b9955",
@@ -8574,7 +8555,7 @@
     {
         "title": "DNS Query for Anonfiles.com Domain - Sysmon",
         "id": "065cceea-77ec-4030-9052-fc0affea7110",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects DNS queries for \"anonfiles.com\", which is an anonymous file upload platform often used for malicious purposes",
         "author": "pH-T (Nextron Systems)",
         "tags": [
@@ -8685,6 +8666,25 @@
         ],
         "filename": "dns_query_win_vscode_tunnel_communication.yml"
     },
+    {
+        "title": "Suspicious DNS Query for IP Lookup Service APIs",
+        "id": "ec82e2a5-81ea-4211-a1f8-37a0286df2c2",
+        "status": "test",
+        "description": "Detects DNS queries for IP lookup services such as \"api.ipify.org\" originating from a non browser process.",
+        "author": "Brandon George (blog post), Thomas Patzke",
+        "tags": [
+            "attack.reconnaissance",
+            "attack.t1590"
+        ],
+        "falsepositives": [
+            "Legitimate usage of IP lookup services such as ipify API"
+        ],
+        "level": "medium",
+        "rule": [
+            "SELECT * FROM logs WHERE ((QueryName LIKE '%api.2ip.ua%' ESCAPE '\\' OR QueryName LIKE '%api.bigdatacloud.net%' ESCAPE '\\' OR QueryName LIKE '%api.ipify.org%' ESCAPE '\\' OR QueryName LIKE '%bot.whatismyipaddress.com%' ESCAPE '\\' OR QueryName LIKE '%canireachthe.net%' ESCAPE '\\' OR QueryName LIKE '%checkip.amazonaws.com%' ESCAPE '\\' OR QueryName LIKE '%checkip.dyndns.org%' ESCAPE '\\' OR QueryName LIKE '%curlmyip.com%' ESCAPE '\\' OR QueryName LIKE '%db-ip.com%' ESCAPE '\\' OR QueryName LIKE '%edns.ip-api.com%' ESCAPE '\\' OR QueryName LIKE '%eth0.me%' ESCAPE '\\' OR QueryName LIKE '%freegeoip.app%' ESCAPE '\\' OR QueryName LIKE '%geoipy.com%' ESCAPE '\\' OR QueryName LIKE '%getip.pro%' ESCAPE '\\' OR QueryName LIKE '%icanhazip.com%' ESCAPE '\\' OR QueryName LIKE '%ident.me%' ESCAPE '\\' OR QueryName LIKE '%ifconfig.io%' ESCAPE '\\' OR QueryName LIKE '%ifconfig.me%' ESCAPE '\\' OR QueryName LIKE '%ipapi.co%' ESCAPE '\\' OR QueryName LIKE '%ip-api.com%' ESCAPE '\\' OR QueryName LIKE '%ip.anysrc.net%' ESCAPE '\\' OR QueryName LIKE '%ip.tyk.nu%' ESCAPE '\\' OR QueryName LIKE '%ipaddressworld.com%' ESCAPE '\\' OR QueryName LIKE '%ipecho.net%' ESCAPE '\\' OR QueryName LIKE '%ipinfo.io%' ESCAPE '\\' OR QueryName LIKE '%ipof.in%' ESCAPE '\\' OR QueryName LIKE '%ipv4.icanhazip.com%' ESCAPE '\\' OR QueryName LIKE '%ipv4bot.whatismyipaddress.com%' ESCAPE '\\' OR QueryName LIKE '%ipwho.is%' ESCAPE '\\' OR QueryName LIKE '%l2.io%' ESCAPE '\\' OR QueryName LIKE '%myexternalip.com%' ESCAPE '\\' OR QueryName LIKE '%wgetip.com%' ESCAPE '\\' OR QueryName LIKE '%whatismyip.akamai.com%' ESCAPE '\\' OR QueryName LIKE '%wtfismyip.com%' ESCAPE '\\') AND NOT ((NewProcessName LIKE '%\\\\brave.exe' ESCAPE '\\') OR ((NewProcessName LIKE 'C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\')) OR ((NewProcessName LIKE 'C:\\\\Program Files\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\')) OR ((NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\')) OR (NewProcessName LIKE '%\\\\maxthon.exe' ESCAPE '\\') OR (NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\%' ESCAPE '\\' OR NewProcessName LIKE '%\\\\WindowsApps\\\\MicrosoftEdge.exe' ESCAPE '\\' OR (NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\')) OR ((NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\') AND (NewProcessName LIKE '%\\\\msedge.exe' ESCAPE '\\' OR NewProcessName LIKE '%\\\\msedgewebview2.exe' ESCAPE '\\')) OR (NewProcessName LIKE '%\\\\opera.exe' ESCAPE '\\') OR (NewProcessName LIKE '%\\\\safari.exe' ESCAPE '\\') OR (NewProcessName LIKE '%\\\\seamonkey.exe' ESCAPE '\\') OR (NewProcessName LIKE '%\\\\vivaldi.exe' ESCAPE '\\') OR (NewProcessName LIKE '%\\\\whale.exe' ESCAPE '\\')))"
+        ],
+        "filename": "dns_query_win_susp_external_ip_lookup.yml"
+    },
     {
         "title": "DNS Query Tor .Onion Address - Sysmon",
         "id": "b55ca2a3-7cff-4dda-8bdd-c7bfa63bf544",
@@ -10431,7 +10431,7 @@
     {
         "title": "Potential DLL Sideloading Of Non-Existent DLLs From System Folders",
         "id": "6b98b92b-4f00-4f62-b4fe-4d1920215771",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects DLL sideloading of system dlls that are not present on the system by default. Usually to achieve techniques such as UAC bypass and privilege escalation",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -10509,6 +10509,28 @@
         ],
         "filename": "registry_set_office_trusted_location.yml"
     },
+    {
+        "title": "Registry Set With Crypto-Classes From The \"Cryptography\" PowerShell Namespace",
+        "id": "1c2a3268-3881-414a-80af-a5b313b14c0e",
+        "status": "experimental",
+        "description": "Detects the setting of a registry inside the \"\\Shell\\Open\\Command\" value with PowerShell classes from the \"System.Security.Cryptography\" namespace.\nThe PowerShell namespace \"System.Security.Cryptography\" provides classes for on-the-fly encryption and decryption.\nThese can be used for example in decrypting malicious payload for defense evasion.\n",
+        "author": "Andreas Braathen (mnemonic.io)",
+        "tags": [
+            "attack.defense_evasion",
+            "attack.t1059.001",
+            "attack.t1027.010",
+            "attack.t1547.001",
+            "detection.threat_hunting"
+        ],
+        "falsepositives": [
+            "Classes are legitimately used, but less so when e.g. parents with low prevalence or decryption of content in temporary folders."
+        ],
+        "level": "medium",
+        "rule": [
+            "SELECT * FROM logs WHERE (EventID = '4657' AND (OperationType LIKE 'Existing registry value modified' ESCAPE '\\') AND Channel = 'Security' AND EventType = 'SetValue' AND TargetObject LIKE '%\\\\Shell\\\\Open\\\\Command%' ESCAPE '\\' AND (NewValue LIKE '%powershell%' ESCAPE '\\' OR NewValue LIKE '%pwsh%' ESCAPE '\\') AND NewValue LIKE '%System.Security.Cryptography.%' ESCAPE '\\' AND (NewValue LIKE '%.AesCryptoServiceProvider%' ESCAPE '\\' OR NewValue LIKE '%.DESCryptoServiceProvider%' ESCAPE '\\' OR NewValue LIKE '%.DSACryptoServiceProvider%' ESCAPE '\\' OR NewValue LIKE '%.RC2CryptoServiceProvider%' ESCAPE '\\' OR NewValue LIKE '%.Rijndael%' ESCAPE '\\' OR NewValue LIKE '%.RSACryptoServiceProvider%' ESCAPE '\\' OR NewValue LIKE '%.TripleDESCryptoServiceProvider%' ESCAPE '\\'))"
+        ],
+        "filename": "registry_set_powershell_crypto_namespace.yml"
+    },
     {
         "title": "WinAPI Library Calls Via PowerShell Scripts",
         "id": "19d65a1c-8540-4140-8062-8eb00db0bba5",
@@ -10979,6 +11001,27 @@
         ],
         "filename": "proc_creation_win_susp_file_permission_modifications.yml"
     },
+    {
+        "title": "Invocation Of Crypto-Classes From The \"Cryptography\" PowerShell Namespace",
+        "id": "ad856965-f44d-42a8-945e-bbf7bd03d05a",
+        "status": "experimental",
+        "description": "Detects the invocation of PowerShell commands with references to classes from the \"System.Security.Cryptography\" namespace.\nThe PowerShell namespace \"System.Security.Cryptography\" provides classes for on-the-fly encryption and decryption.\nThese can be used for example in decrypting malicious payload for defense evasion.\n",
+        "author": "Andreas Braathen (mnemonic.io)",
+        "tags": [
+            "attack.defense_evasion",
+            "attack.t1059.001",
+            "attack.t1027.010",
+            "detection.threat_hunting"
+        ],
+        "falsepositives": [
+            "Classes are legitimately used, but less so when e.g. parents with low prevalence or decryption of content in temporary folders."
+        ],
+        "level": "medium",
+        "rule": [
+            "SELECT * FROM logs WHERE ((EventID = '4688' AND Channel = 'Security') AND ((NewProcessName LIKE '%\\\\powershell.exe' ESCAPE '\\' OR NewProcessName LIKE '%\\\\pwsh.exe' ESCAPE '\\') OR OriginalFileName IN ('PowerShell.EXE', 'pwsh.dll')) AND CommandLine LIKE '%System.Security.Cryptography.%' ESCAPE '\\' AND (CommandLine LIKE '%.AesCryptoServiceProvider%' ESCAPE '\\' OR CommandLine LIKE '%.DESCryptoServiceProvider%' ESCAPE '\\' OR CommandLine LIKE '%.DSACryptoServiceProvider%' ESCAPE '\\' OR CommandLine LIKE '%.RC2CryptoServiceProvider%' ESCAPE '\\' OR CommandLine LIKE '%.Rijndael%' ESCAPE '\\' OR CommandLine LIKE '%.RSACryptoServiceProvider%' ESCAPE '\\' OR CommandLine LIKE '%.TripleDESCryptoServiceProvider%' ESCAPE '\\'))"
+        ],
+        "filename": "proc_creation_win_powershell_crypto_namespace.yml"
+    },
     {
         "title": "ClickOnce Deployment Execution - Dfsvc.EXE Child Process",
         "id": "241d52b5-eee0-49d0-ac8a-8b9c15c7221c",
@@ -12335,7 +12378,7 @@
     {
         "title": "Suspicious Startup Folder Persistence",
         "id": "28208707-fe31-437f-9a7f-4b1108b94d2e",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when a file with a suspicious extension is created in the startup folder",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -13865,7 +13908,7 @@
     {
         "title": "VsCode Powershell Profile Modification",
         "id": "3a9fa2ec-30bc-4ebd-b49e-7c9cff225502",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the creation or modification of a vscode related powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -16777,7 +16820,7 @@
     {
         "title": "Potential Exploitation Attempt From Office Application",
         "id": "868955d9-697e-45d4-a3da-360cefd7c216",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects Office applications executing a child process that includes directory traversal patterns. This could be an attempt to exploit CVE-2022-30190 (MSDT RCE) or CVE-2021-40444 (MSHTML RCE)",
         "author": "Christian Burkard (Nextron Systems), @SBousseaden (idea)",
         "tags": [
@@ -17718,7 +17761,7 @@
     {
         "title": "Potential CVE-2022-26809 Exploitation Attempt",
         "id": "a7cd7306-df8b-4398-b711-6f3e4935cf16",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious remote procedure call (RPC) service anomalies based on the spawned sub processes (long shot to detect the exploitation of vulnerabilities like CVE-2022-26809)",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -17824,7 +17867,7 @@
     {
         "title": "Potential Centos Web Panel Exploitation Attempt - CVE-2022-44877",
         "id": "1b2eeb27-949b-4704-8bfa-d8e5cfa045a1",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential exploitation attempts that target the Centos Web Panel 7 Unauthenticated Remote Code Execution CVE-2022-44877",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -18313,7 +18356,7 @@
         ],
         "level": "high",
         "rule": [
-            "SELECT * FROM logs WHERE (EventID = '4688' AND Channel = 'Security' AND ParentProcessName LIKE '%\\\\ws\\_tomcatservice.exe' ESCAPE '\\' AND NewProcessName LIKE '%\\\\repadmin.exe' ESCAPE '\\')"
+            "SELECT * FROM logs WHERE ((EventID = '4688' AND Channel = 'Security') AND ParentProcessName LIKE '%\\\\ws\\_tomcatservice.exe' ESCAPE '\\' AND NOT ((NewProcessName LIKE '%\\\\repadmin.exe' ESCAPE '\\')))"
         ],
         "filename": "proc_creation_win_apt_mint_sandstorm_log4j_wstomcat_execution.yml"
     },
@@ -19299,7 +19342,7 @@
     {
         "title": "Potential Exploitation Attempt Of Undocumented WindowsServer RCE",
         "id": "6d5b8176-d87d-4402-8af4-53aee9db7b5d",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential exploitation attempt of undocumented Windows Server Pre Auth Remote Code Execution (RCE)",
         "author": "Florian Roth (Nextron Systems), Nasreddine Bencherchali",
         "tags": [
@@ -20814,7 +20857,7 @@
     {
         "title": "Deployment Of The AppX Package Was Blocked By The Policy",
         "id": "e021bbb5-407f-41f5-9dc9-1864c45a7a51",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an appx package deployment that was blocked by the local computer policy",
         "author": "frack113",
         "tags": [
@@ -20832,7 +20875,7 @@
     {
         "title": "Suspicious AppX Package Locations",
         "id": "5cdeaf3d-1489-477c-95ab-c318559fc051",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an appx package added the pipeline of the \"to be processed\" packages which is located in suspicious locations",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -20868,7 +20911,7 @@
     {
         "title": "Deployment AppX Package Was Blocked By AppLocker",
         "id": "6ae53108-c3a0-4bee-8f45-c7591a2c337f",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an appx package deployment that was blocked by AppLocker policy",
         "author": "frack113",
         "tags": [
@@ -20886,7 +20929,7 @@
     {
         "title": "Suspicious AppX Package Installation Attempt",
         "id": "898d5fc9-fbc3-43de-93ad-38e97237c344",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an appx package installation with the error code \"0x80073cff\" which indicates that the package didn't meet the signing requirements and could be suspicious",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -20904,7 +20947,7 @@
     {
         "title": "Uncommon AppX Package Locations",
         "id": "c977cb50-3dff-4a9f-b873-9290f56132f1",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an appx package added the pipeline of the \"to be processed\" packages which is located in uncommon locations",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -20922,7 +20965,7 @@
     {
         "title": "Potential Malicious AppX Package Installation Attempts",
         "id": "09d3b48b-be17-47f5-bf4e-94e7e75d09ce",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential installation or installation attempts of known malicious appx packages",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -21333,7 +21376,7 @@
     {
         "title": "Suspicious Digital Signature Of AppX Package",
         "id": "b5aa7d60-c17e-4538-97de-09029d6cd76b",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of AppX packages with known suspicious or malicious signature",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -24017,7 +24060,7 @@
     {
         "title": "DNS Query for Anonfiles.com Domain - DNS Client",
         "id": "29f171d7-aa47-42c7-9c7b-3c87938164d9",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects DNS queries for anonfiles.com, which is an anonymous file upload platform often used for malicious purposes",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -25862,7 +25905,7 @@
     {
         "title": "Restricted Software Access By SRP",
         "id": "b4c8da4a-1c12-46b0-8a2b-0a8521d03442",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects restricted access to applications by the Software Restriction Policies (SRP) policy",
         "author": "frack113",
         "tags": [
@@ -26593,7 +26636,7 @@
         ],
         "level": "medium",
         "rule": [
-            "SELECT * FROM logs WHERE ((DestinationHostname LIKE '%api.2ip.ua%' ESCAPE '\\' OR DestinationHostname LIKE '%api.ipify.org%' ESCAPE '\\' OR DestinationHostname LIKE '%bot.whatismyipaddress.com%' ESCAPE '\\' OR DestinationHostname LIKE '%canireachthe.net%' ESCAPE '\\' OR DestinationHostname LIKE '%checkip.amazonaws.com%' ESCAPE '\\' OR DestinationHostname LIKE '%checkip.dyndns.org%' ESCAPE '\\' OR DestinationHostname LIKE '%curlmyip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%edns.ip-api.com%' ESCAPE '\\' OR DestinationHostname LIKE '%eth0.me%' ESCAPE '\\' OR DestinationHostname LIKE '%freegeoip.app%' ESCAPE '\\' OR DestinationHostname LIKE '%geoipy.com%' ESCAPE '\\' OR DestinationHostname LIKE '%getip.pro%' ESCAPE '\\' OR DestinationHostname LIKE '%icanhazip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ident.me%' ESCAPE '\\' OR DestinationHostname LIKE '%ifconfig.io%' ESCAPE '\\' OR DestinationHostname LIKE '%ifconfig.me%' ESCAPE '\\' OR DestinationHostname LIKE '%ip-api.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ip.anysrc.net%' ESCAPE '\\' OR DestinationHostname LIKE '%ip.tyk.nu%' ESCAPE '\\' OR DestinationHostname LIKE '%ipaddressworld.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ipecho.net%' ESCAPE '\\' OR DestinationHostname LIKE '%ipinfo.io%' ESCAPE '\\' OR DestinationHostname LIKE '%ipof.in%' ESCAPE '\\' OR DestinationHostname LIKE '%ipv4.icanhazip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ipv4bot.whatismyipaddress.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ipwho.is%' ESCAPE '\\' OR DestinationHostname LIKE '%l2.io%' ESCAPE '\\' OR DestinationHostname LIKE '%myexternalip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%wgetip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%whatismyip.akamai.com%' ESCAPE '\\' OR DestinationHostname LIKE '%wtfismyip.com%' ESCAPE '\\') AND NOT ((NewProcessName LIKE '%\\\\brave.exe' ESCAPE '\\') OR ((NewProcessName LIKE 'C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\')) OR ((NewProcessName LIKE 'C:\\\\Program Files\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\')) OR ((NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\')) OR (NewProcessName LIKE '%\\\\maxthon.exe' ESCAPE '\\') OR (NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\%' ESCAPE '\\' OR NewProcessName LIKE '%\\\\WindowsApps\\\\MicrosoftEdge.exe' ESCAPE '\\' OR (NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\')) OR ((NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\') AND (NewProcessName LIKE '%\\\\msedge.exe' ESCAPE '\\' OR NewProcessName LIKE '%\\\\msedgewebview2.exe' ESCAPE '\\')) OR (NewProcessName LIKE '%\\\\opera.exe' ESCAPE '\\') OR (NewProcessName LIKE '%\\\\safari.exe' ESCAPE '\\') OR (NewProcessName LIKE '%\\\\seamonkey.exe' ESCAPE '\\') OR (NewProcessName LIKE '%\\\\vivaldi.exe' ESCAPE '\\') OR (NewProcessName LIKE '%\\\\whale.exe' ESCAPE '\\')))"
+            "SELECT * FROM logs WHERE ((DestinationHostname LIKE '%api.2ip.ua%' ESCAPE '\\' OR DestinationHostname LIKE '%api.bigdatacloud.net%' ESCAPE '\\' OR DestinationHostname LIKE '%api.ipify.org%' ESCAPE '\\' OR DestinationHostname LIKE '%bot.whatismyipaddress.com%' ESCAPE '\\' OR DestinationHostname LIKE '%canireachthe.net%' ESCAPE '\\' OR DestinationHostname LIKE '%checkip.amazonaws.com%' ESCAPE '\\' OR DestinationHostname LIKE '%checkip.dyndns.org%' ESCAPE '\\' OR DestinationHostname LIKE '%curlmyip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%db-ip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%edns.ip-api.com%' ESCAPE '\\' OR DestinationHostname LIKE '%eth0.me%' ESCAPE '\\' OR DestinationHostname LIKE '%freegeoip.app%' ESCAPE '\\' OR DestinationHostname LIKE '%geoipy.com%' ESCAPE '\\' OR DestinationHostname LIKE '%getip.pro%' ESCAPE '\\' OR DestinationHostname LIKE '%icanhazip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ident.me%' ESCAPE '\\' OR DestinationHostname LIKE '%ifconfig.io%' ESCAPE '\\' OR DestinationHostname LIKE '%ifconfig.me%' ESCAPE '\\' OR DestinationHostname LIKE '%ipapi.co%' ESCAPE '\\' OR DestinationHostname LIKE '%ip-api.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ip.anysrc.net%' ESCAPE '\\' OR DestinationHostname LIKE '%ip.tyk.nu%' ESCAPE '\\' OR DestinationHostname LIKE '%ipaddressworld.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ipecho.net%' ESCAPE '\\' OR DestinationHostname LIKE '%ipinfo.io%' ESCAPE '\\' OR DestinationHostname LIKE '%ipof.in%' ESCAPE '\\' OR DestinationHostname LIKE '%ipv4.icanhazip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ipv4bot.whatismyipaddress.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ipwho.is%' ESCAPE '\\' OR DestinationHostname LIKE '%l2.io%' ESCAPE '\\' OR DestinationHostname LIKE '%myexternalip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%wgetip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%whatismyip.akamai.com%' ESCAPE '\\' OR DestinationHostname LIKE '%wtfismyip.com%' ESCAPE '\\') AND NOT ((NewProcessName LIKE '%\\\\brave.exe' ESCAPE '\\') OR ((NewProcessName LIKE 'C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\')) OR ((NewProcessName LIKE 'C:\\\\Program Files\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\')) OR ((NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\')) OR (NewProcessName LIKE '%\\\\maxthon.exe' ESCAPE '\\') OR (NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\%' ESCAPE '\\' OR NewProcessName LIKE '%\\\\WindowsApps\\\\MicrosoftEdge.exe' ESCAPE '\\' OR (NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\')) OR ((NewProcessName LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\' OR NewProcessName LIKE 'C:\\\\Program Files\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\') AND (NewProcessName LIKE '%\\\\msedge.exe' ESCAPE '\\' OR NewProcessName LIKE '%\\\\msedgewebview2.exe' ESCAPE '\\')) OR (NewProcessName LIKE '%\\\\opera.exe' ESCAPE '\\') OR (NewProcessName LIKE '%\\\\safari.exe' ESCAPE '\\') OR (NewProcessName LIKE '%\\\\seamonkey.exe' ESCAPE '\\') OR (NewProcessName LIKE '%\\\\vivaldi.exe' ESCAPE '\\') OR (NewProcessName LIKE '%\\\\whale.exe' ESCAPE '\\')))"
         ],
         "filename": "net_connection_win_susp_external_ip_lookup.yml"
     },
@@ -27211,7 +27254,7 @@
     {
         "title": "Renamed Plink Execution",
         "id": "1c12727d-02bf-45ff-a9f3-d49806a3cf43",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed version of the Plink binary",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -27251,7 +27294,7 @@
     {
         "title": "Potential Password Spraying Attempt Using Dsacls.EXE",
         "id": "bac9fb54-2da7-44e9-988f-11e9a5edbc0c",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects possible password spraying attempts using Dsacls",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -28365,7 +28408,7 @@
     {
         "title": "Potential Persistence Via Powershell Search Order Hijacking - Task",
         "id": "b66474aa-bd92-4333-a16c-298155b120df",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell \"Get-Variable\" technique as seen being used in Colibri Loader",
         "author": "pH-T (Nextron Systems), Florian Roth (Nextron Systems)",
         "tags": [
@@ -28912,7 +28955,7 @@
     {
         "title": "SQLite Chromium Profile Data DB Access",
         "id": "24c77512-782b-448a-8950-eddb0785fc71",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect usage of the \"sqlite\" binary to query databases in Chromium-based browsers for potential data stealing.",
         "author": "TropChaud",
         "tags": [
@@ -29293,7 +29336,7 @@
     {
         "title": "Potential Active Directory Enumeration Using AD Module - ProcCreation",
         "id": "70bc5215-526f-4477-963c-a47a5c9ebd12",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of the \"Import-Module\" cmdlet to load the \"Microsoft.ActiveDirectory.Management.dl\" DLL. Which is often used by attackers to perform AD enumeration.",
         "author": "frack113",
         "tags": [
@@ -29504,7 +29547,7 @@
     {
         "title": "Renamed NetSupport RAT Execution",
         "id": "0afbd410-de03-4078-8491-f132303cb67d",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed \"client32.exe\" (NetSupport RAT) via Imphash, Product and OriginalFileName strings",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -29744,7 +29787,7 @@
     {
         "title": "PDQ Deploy Remote Adminstartion Tool Execution",
         "id": "d679950c-abb7-43a6-80fb-2a480c4fc450",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect use of PDQ Deploy remote admin tool",
         "author": "frack113",
         "tags": [
@@ -30133,7 +30176,7 @@
     {
         "title": "HackTool - Inveigh Execution",
         "id": "b99a1518-1ad5-4f65-bc95-1ffff97a8fd0",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -30468,7 +30511,7 @@
     {
         "title": "Disabled RestrictedAdminMode For RDS - ProcCreation",
         "id": "28ac00d6-22d9-4a3c-927f-bbd770104573",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect activation of DisableRestrictedAdmin to disable RestrictedAdmin mode.\nRestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.\nThis prevents your credentials from being harvested during the initial connection process if the remote server has been compromise\n",
         "author": "frack113",
         "tags": [
@@ -30528,7 +30571,7 @@
     {
         "title": "Unsigned AppX Installation Attempt Using Add-AppxPackage",
         "id": "37651c2a-42cd-4a69-ae0d-22a4349aa04a",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of the \"Add-AppxPackage\" or it's alias \"Add-AppPackage\" to install unsigned AppX packages",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -30821,7 +30864,7 @@
     {
         "title": "HackTool - SafetyKatz Execution",
         "id": "b1876533-4ed5-4a83-90f3-b8645840a413",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the hacktool SafetyKatz via PE information and default Image name",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -31211,7 +31254,7 @@
     {
         "title": "Potential Renamed Rundll32 Execution",
         "id": "2569ed8c-1147-498a-9b8c-2ad3656b10ed",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when 'DllRegisterServer' is called in the commandline and the image is not rundll32. This could mean that the 'rundll32' utility has been renamed in order to avoid detection",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -31343,7 +31386,7 @@
     {
         "title": "PUA - DefenderCheck Execution",
         "id": "f0ca6c24-3225-47d5-b1f5-352bf07ecfa7",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of DefenderCheck, a tool to evaluate the signatures used in Microsoft Defender. It can be used to figure out the strings / byte chains used in Microsoft Defender to detect a tool and thus used for AV evasion.",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -31842,7 +31885,7 @@
     {
         "title": "Suspicious Hacktool Execution - Imphash",
         "id": "24e3e58a-646b-4b50-adef-02ef935b9fc8",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -32499,7 +32542,7 @@
     {
         "title": "Microsoft IIS Service Account Password Dumped",
         "id": "2d3cdeec-c0db-45b4-aa86-082f7eb75701",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords",
         "author": "Tim Rauch, Janantha Marasinghe",
         "tags": [
@@ -33395,7 +33438,7 @@
     {
         "title": "Potential WinAPI Calls Via CommandLine",
         "id": "ba3f5c1b-6272-4119-9dbd-0bc8d21c2702",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -33515,7 +33558,7 @@
     {
         "title": "PUA - Seatbelt Execution",
         "id": "38646daa-e78f-4ace-9de0-55547b2d30da",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -33578,7 +33621,7 @@
     {
         "title": "Potential Arbitrary Code Execution Via Node.EXE",
         "id": "6640f31c-01ad-49b5-beb5-83498a5cd8bd",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution node.exe which is shipped with multiple software such as VMware, Adobe...etc. In order to execute arbitrary code. For example to establish reverse shell as seen in Log4j attacks...etc",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -33880,7 +33923,7 @@
     {
         "title": "HackTool - SharPersist Execution",
         "id": "26488ad0-f9fd-4536-876f-52fea846a2e4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the hacktool SharPersist - used to deploy various different kinds of persistence mechanisms",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -33983,7 +34026,7 @@
     {
         "title": "Uncommon One Time Only Scheduled Task At 00:00",
         "id": "970823b7-273b-460a-8afc-3a6811998529",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects scheduled task creation events that include suspicious actions, and is run once at 00:00",
         "author": "pH-T (Nextron Systems)",
         "tags": [
@@ -34157,7 +34200,7 @@
     {
         "title": "Suspicious New Instance Of An Office COM Object",
         "id": "9bdaf1e9-fdef-443b-8081-4341b74a7e28",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an svchost process spawning an instance of an office application. This happens when the initial word application creates an instance of one of the Office COM objects such as 'Word.Application', 'Excel.Application', etc.\nThis can be used by malicious actors to create malicious Office documents with macros on the fly. (See vba2clr project in the references)\n",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -34914,7 +34957,7 @@
     {
         "title": "Potential DLL Sideloading Via DeviceEnroller.EXE",
         "id": "e173ad47-4388-4012-ae62-bd13f71c18a8",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of the PhoneDeepLink parameter to potentially sideload a DLL file that does not exist. This non-existent DLL file is named \"ShellChromeAPI.dll\".\nAdversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter\n",
         "author": "@gott_cyber",
         "tags": [
@@ -35108,7 +35151,7 @@
     {
         "title": "Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE",
         "id": "07f8bdc2-c9b3-472a-9817-5a670b872f53",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of cmdkey to look for cached credentials on the system",
         "author": "jmallette, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -35264,7 +35307,7 @@
     {
         "title": "Operator Bloopers Cobalt Strike Modules",
         "id": "4f154fb6-27d1-4813-a759-78b93e0b9c48",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects Cobalt Strike module/commands accidentally entered in CMD shell",
         "author": "_pete_0, TheDFIRReport",
         "tags": [
@@ -36423,7 +36466,7 @@
     {
         "title": "HackTool - KrbRelayUp Execution",
         "id": "12827a56-61a4-476a-a9cb-f3068f191073",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -37009,7 +37052,7 @@
     {
         "title": "Disable Windows IIS HTTP Logging",
         "id": "e4ed6030-ffe5-4e6a-8a8a-ab3c1ab9d94e",
-        "status": "experimental",
+        "status": "test",
         "description": "Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union)",
         "author": "frack113",
         "tags": [
@@ -37136,7 +37179,7 @@
     {
         "title": "Suspicious IIS URL GlobalRules Rewrite Via AppCmd",
         "id": "7c8af9b2-dcae-41a2-a9db-b28c288b5f08",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of \"appcmd\" to create new global URL rewrite rules. This behaviour has been observed being used by threat actors to add new rules so they can access their webshells.",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -38168,7 +38211,7 @@
     {
         "title": "Suspicious Git Clone",
         "id": "aef9d1f1-7396-4e92-a927-4567c7a495c1",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of \"git\" in order to clone a remote repository that contain suspicious keywords which might be suspicious",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -38225,7 +38268,7 @@
     {
         "title": "HackTool - KrbRelay Execution",
         "id": "e96253b8-6b3b-4f90-9e59-3b24b99cf9b4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of KrbRelay, a Kerberos relaying tool",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -38263,7 +38306,7 @@
     {
         "title": "New Remote Desktop Connection Initiated Via Mstsc.EXE",
         "id": "954f0af7-62dd-418f-b3df-a84bc2c7a774",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the usage of \"mstsc.exe\" with the \"/v\" flag to initiate a connection to a remote server.\nAdversaries may use valid accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.\n",
         "author": "frack113",
         "tags": [
@@ -38439,7 +38482,7 @@
     {
         "title": "HackTool - PowerTool Execution",
         "id": "a34f79a3-8e5f-4cc3-b765-de00695452c2",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the tool PowerTool which has the ability to kill a process, delete its process file, unload drivers, and delete the driver files",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -38477,7 +38520,7 @@
     {
         "title": "Potentially Over Permissive Permissions Granted Using Dsacls.EXE",
         "id": "01c42d3c-242d-4655-85b2-34f1739632f7",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of Dsacls to grant over permissive permissions",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -38631,7 +38674,7 @@
     {
         "title": "Potential Credential Dumping Attempt Using New NetworkProvider - CLI",
         "id": "baef1ec6-2ca9-47a3-97cc-4cf2bda10b77",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -38691,7 +38734,7 @@
     {
         "title": "Potential Recon Activity Via Nltest.EXE",
         "id": "5cc90652-4cbd-4241-aa3b-4b462fa5a248",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects nltest commands that can be used for information discovery",
         "author": "Craig Young, oscd.community, Georg Lauenstein",
         "tags": [
@@ -39038,7 +39081,7 @@
     {
         "title": "HackTool - SharpLdapWhoami Execution",
         "id": "d9367cbb-c2e0-47ce-bdc0-128cb6da898d",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -39079,7 +39122,7 @@
     {
         "title": "SafeBoot Registry Key Deleted Via Reg.EXE",
         "id": "fc0e89b5-adb0-43c1-b749-c12a10ec37de",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of \"reg.exe\" commands with the \"delete\" flag on safe boot registry keys. Often used by attacker to prevent safeboot execution of security products",
         "author": "Nasreddine Bencherchali (Nextron Systems), Tim Shelton",
         "tags": [
@@ -39250,7 +39293,7 @@
     {
         "title": "Suspicious Binary In User Directory Spawned From Office Application",
         "id": "aa3a6f94-890e-4e22-b634-ffdfd54792cc",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an executable in the users directory started from one of the Microsoft Office suite applications (Word, Excel, PowerPoint, Publisher, Visio)",
         "author": "Jason Lynch",
         "tags": [
@@ -39331,7 +39374,7 @@
     {
         "title": "Fsutil Behavior Set SymlinkEvaluation",
         "id": "c0b2768a-dd06-4671-8339-b16ca8d1f27f",
-        "status": "experimental",
+        "status": "test",
         "description": "A symbolic link is a type of file that contains a reference to another file.\nThis is probably done to make sure that the ransomware is able to follow shortcuts on the machine in order to find the original file to encrypt\n",
         "author": "frack113",
         "tags": [
@@ -39603,7 +39646,7 @@
     {
         "title": "Suspicious Hacktool Execution - PE Metadata",
         "id": "37c1333a-a0db-48be-b64b-7393b2386e3b",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -39664,7 +39707,7 @@
     {
         "title": "Suspicious Rundll32 Script in CommandLine",
         "id": "73fcad2e-ff14-4c38-b11d-4172c8ac86c7",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious process related to rundll32 based on arguments",
         "author": "frack113, Zaw Min Htun (ZETA)",
         "tags": [
@@ -40299,7 +40342,7 @@
     {
         "title": "PowerShell Base64 Encoded WMI Classes",
         "id": "1816994b-42e1-4fb1-afd2-134d88184f71",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects calls to base64 encoded WMI class such as \"Win32_Shadowcopy\", \"Win32_ScheduledJob\", etc.",
         "author": "Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -40418,7 +40461,7 @@
     {
         "title": "HackTool - SysmonEOP Execution",
         "id": "8a7e90c5-fe6e-45dc-889e-057fe4378bd9",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -40477,7 +40520,7 @@
     {
         "title": "PUA - Fast Reverse Proxy (FRP) Execution",
         "id": "32410e29-5f94-4568-b6a3-d91a8adad863",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet.",
         "author": "frack113, Florian Roth",
         "tags": [
@@ -40540,7 +40583,7 @@
     {
         "title": "Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE",
         "id": "48917adc-a28e-4f5d-b729-11e75da8941f",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the usage of \"reg.exe\" to add Defender folder exclusions. Qbot has been seen using this technique to add exclusions for folders within AppData and ProgramData.",
         "author": "frack113",
         "tags": [
@@ -40961,7 +41004,7 @@
     {
         "title": "Operator Bloopers Cobalt Strike Commands",
         "id": "647c7b9e-d784-4fda-b9a0-45c565a7b729",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects use of Cobalt Strike commands accidentally entered in the CMD shell",
         "author": "_pete_0, TheDFIRReport",
         "tags": [
@@ -41385,7 +41428,7 @@
     {
         "title": "HackTool - HandleKatz LSASS Dumper Execution",
         "id": "ca621ba5-54ab-4035-9942-d378e6fcde3c",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -41816,7 +41859,7 @@
     {
         "title": "New Generic Credentials Added Via Cmdkey.EXE",
         "id": "b1ec66c6-f4d1-4b5c-96dd-af28ccae7727",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of cmdkey to add generic credentials. As an example, this has to be used before connecting to an RDP session via command line interface.",
         "author": "frack113, Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -42188,7 +42231,7 @@
     {
         "title": "Suspicious Shells Spawn by Java Utility Keytool",
         "id": "90fb5e62-ca1f-4e22-b42e-cc521874c938",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation)",
         "author": "Andreas Hunkeler (@Karneades)",
         "tags": [
@@ -42208,7 +42251,7 @@
     {
         "title": "PUA - NPS Tunneling Tool Execution",
         "id": "68d37776-61db-42f5-bf54-27e87072d17e",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of NPS, a port forwarding and intranet penetration proxy server",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -42364,7 +42407,7 @@
     {
         "title": "Renamed Msdt.EXE Execution",
         "id": "bd1c6866-65fc-44b2-be51-5588fcff82b9",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed \"Msdt.exe\" binary",
         "author": "pH-T (Nextron Systems)",
         "tags": [
@@ -42402,7 +42445,7 @@
     {
         "title": "Execution from Suspicious Folder",
         "id": "3dfd06d2-eaf4-4532-9555-68aca59f57c4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects a suspicious execution from an uncommon folder",
         "author": "Florian Roth (Nextron Systems), Tim Shelton",
         "tags": [
@@ -42557,7 +42600,7 @@
     {
         "title": "Lolbin Ssh.exe Use As Proxy",
         "id": "7d6d30b8-5b91-4b90-a891-46cccaf29598",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect usage of the \"ssh.exe\" binary as a proxy to launch other programs",
         "author": "frack113, Nasreddine Bencherchali",
         "tags": [
@@ -42654,7 +42697,7 @@
     {
         "title": "Renamed Mavinject.EXE Execution",
         "id": "e6474a1b-5390-49cd-ab41-8d88655f7394",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed version of the \"Mavinject\" process. Which can be abused to perform process injection using the \"/INJECTRUNNING\" flag",
         "author": "frack113, Florian Roth",
         "tags": [
@@ -43792,7 +43835,7 @@
     {
         "title": "Query Usage To Exfil Data",
         "id": "53ef0cef-fa24-4f25-a34a-6c72dfa2e6e2",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of \"query.exe\" a system binary to exfil information such as \"sessions\" and \"processes\" for later use",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -43907,7 +43950,7 @@
     {
         "title": "Potential PowerShell Execution Policy Tampering - ProcCreation",
         "id": "cf2e938e-9a3e-4fe8-a347-411642b28a9f",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects changes to the PowerShell execution policy registry key in order to bypass signing requirements for script execution from the CommandLine",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -43925,7 +43968,7 @@
     {
         "title": "Renamed BrowserCore.EXE Execution",
         "id": "8a4519e8-e64a-40b6-ae85-ba8ad2177559",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects process creation with a renamed BrowserCore.exe (used to extract Azure tokens)",
         "author": "Max Altgelt (Nextron Systems)",
         "tags": [
@@ -44139,7 +44182,7 @@
     {
         "title": "Suspicious Use of PsLogList",
         "id": "aae1243f-d8af-40d8-ab20-33fc6d0c55bc",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of the PsLogList utility to dump event log in order to extract admin accounts and perform account discovery or delete events logs",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -44346,7 +44389,7 @@
     {
         "title": "Renamed Vmnat.exe Execution",
         "id": "7b4f794b-590a-4ad4-ba18-7964a2832205",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects renamed vmnat.exe or portable version that can be used for DLL side-loading",
         "author": "elhoim",
         "tags": [
@@ -44365,7 +44408,7 @@
     {
         "title": "Renamed Sysinternals Sdelete Execution",
         "id": "c1d867fe-8d95-4487-aab4-e53f2d339f90",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of a renamed SysInternals Sdelete, which is something an administrator shouldn't do (the renaming)",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -44813,7 +44856,7 @@
     {
         "title": "Potential Signing Bypass Via Windows Developer Features",
         "id": "a383dec4-deec-4e6e-913b-ed9249670848",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when a user enable developer features such as \"Developer Mode\" or \"Application Sideloading\". Which allows the user to install untrusted packages.",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -44869,7 +44912,7 @@
     {
         "title": "Renamed Remote Utilities RAT (RURAT) Execution",
         "id": "9ef27c24-4903-4192-881a-3adde7ff92a5",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of renamed Remote Utilities (RURAT) via Product PE header field",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -45149,7 +45192,7 @@
     {
         "title": "Root Certificate Installed From Susp Locations",
         "id": "5f6a601c-2ecb-498b-9c33-660362323afa",
-        "status": "experimental",
+        "status": "test",
         "description": "Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -45168,7 +45211,7 @@
     {
         "title": "Potential Process Injection Via Msra.EXE",
         "id": "744a188b-0415-4792-896f-11ddb0588dbc",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential process injection via Microsoft Remote Asssistance (Msra.exe) by looking at suspicious child processes spawned from the aforementioned process. It has been a target used by many threat actors and used for discovery and persistence tactics",
         "author": "Alexander McDonald",
         "tags": [
@@ -45661,7 +45704,7 @@
     {
         "title": "Import PowerShell Modules From Suspicious Directories - ProcCreation",
         "id": "c31364f7-8be6-4b77-8483-dd2b5a7b69a3",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects powershell scripts that import modules from suspicious directories",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -45761,7 +45804,7 @@
     {
         "title": "Potential RDP Tunneling Via SSH",
         "id": "f7d7ebd5-a016-46e2-9c54-f9932f2d386d",
-        "status": "experimental",
+        "status": "test",
         "description": "Execution of ssh.exe to perform data exfiltration and tunneling through RDP",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -46053,7 +46096,7 @@
     {
         "title": "Potential Discovery Activity Via Dnscmd.EXE",
         "id": "b6457d63-d2a2-4e29-859d-4e7affc153d1",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an attempt to leverage dnscmd.exe to enumerate the DNS zones of a domain. DNS zones used to host the DNS records for a particular domain.",
         "author": "@gott_cyber",
         "tags": [
@@ -46094,7 +46137,7 @@
     {
         "title": "Service Registry Key Deleted Via Reg.EXE",
         "id": "05b2aa93-1210-42c8-8d9a-2fcc13b284f5",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of \"reg.exe\" commands with the \"delete\" flag on services registry key. Often used by attacker to remove AV software services",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -46384,7 +46427,7 @@
     {
         "title": "HackTool - Htran/NATBypass Execution",
         "id": "f5e3b62f-e577-4e59-931e-0a15b2b94e1e",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass)",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -46423,7 +46466,7 @@
     {
         "title": "SQLite Firefox Profile Data DB Access",
         "id": "4833155a-4053-4c9c-a997-777fcea0baa7",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect usage of the \"sqlite\" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.",
         "author": "frack113",
         "tags": [
diff --git a/rules/rules_windows_generic_pysigma.json b/rules/rules_windows_generic_pysigma.json
index c005f51..84ca0a8 100644
--- a/rules/rules_windows_generic_pysigma.json
+++ b/rules/rules_windows_generic_pysigma.json
@@ -2837,7 +2837,7 @@
     {
         "title": "HackTool - Inveigh Execution",
         "id": "b99a1518-1ad5-4f65-bc95-1ffff97a8fd0",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -2856,7 +2856,7 @@
     {
         "title": "HackTool - SafetyKatz Execution",
         "id": "b1876533-4ed5-4a83-90f3-b8645840a413",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the hacktool SafetyKatz via PE information and default Image name",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -2894,7 +2894,7 @@
     {
         "title": "Suspicious Hacktool Execution - Imphash",
         "id": "24e3e58a-646b-4b50-adef-02ef935b9fc8",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -3166,7 +3166,7 @@
     {
         "title": "HackTool - SysmonEOP Execution",
         "id": "8a7e90c5-fe6e-45dc-889e-057fe4378bd9",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -5887,7 +5887,7 @@
     {
         "title": "Potential Svchost Memory Access",
         "id": "166e9c50-8cd9-44af-815d-d1f0c0e90dde",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential access to svchost process memory such as that used by Invoke-Phantom to kill the winRM Windows event logging service.",
         "author": "Tim Burrell",
         "tags": [
@@ -6324,7 +6324,7 @@
     {
         "title": "Malicious PowerShell Scripts - PoshModule",
         "id": "41025fd7-0466-4650-a813-574aaacbe7f4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of known offensive powershell scripts used for exploitation or reconnaissance",
         "author": "frack113, Nasreddine Bencherchali",
         "tags": [
@@ -7538,7 +7538,7 @@
     {
         "title": "Malicious Nishang PowerShell Commandlets",
         "id": "f772cee9-b7c2-4cb2-8f07-49870adc02e0",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects Commandlet names and arguments from the Nishang exploitation framework",
         "author": "Alec Costello",
         "tags": [
@@ -7576,7 +7576,7 @@
     {
         "title": "DNS Query for Anonfiles.com Domain - Sysmon",
         "id": "065cceea-77ec-4030-9052-fc0affea7110",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects DNS queries for \"anonfiles.com\", which is an anonymous file upload platform often used for malicious purposes",
         "author": "pH-T (Nextron Systems)",
         "tags": [
@@ -8486,7 +8486,7 @@
     {
         "title": "Potential DLL Sideloading Of Non-Existent DLLs From System Folders",
         "id": "6b98b92b-4f00-4f62-b4fe-4d1920215771",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects DLL sideloading of system dlls that are not present on the system by default. Usually to achieve techniques such as UAC bypass and privilege escalation",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -9232,7 +9232,7 @@
     {
         "title": "Suspicious Startup Folder Persistence",
         "id": "28208707-fe31-437f-9a7f-4b1108b94d2e",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when a file with a suspicious extension is created in the startup folder",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -11527,7 +11527,7 @@
     {
         "title": "Potential Exploitation Attempt From Office Application",
         "id": "868955d9-697e-45d4-a3da-360cefd7c216",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects Office applications executing a child process that includes directory traversal patterns. This could be an attempt to exploit CVE-2022-30190 (MSDT RCE) or CVE-2021-40444 (MSHTML RCE)",
         "author": "Christian Burkard (Nextron Systems), @SBousseaden (idea)",
         "tags": [
@@ -12136,7 +12136,7 @@
     {
         "title": "Potential CVE-2022-26809 Exploitation Attempt",
         "id": "a7cd7306-df8b-4398-b711-6f3e4935cf16",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious remote procedure call (RPC) service anomalies based on the spawned sub processes (long shot to detect the exploitation of vulnerabilities like CVE-2022-26809)",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -12222,7 +12222,7 @@
     {
         "title": "Potential Centos Web Panel Exploitation Attempt - CVE-2022-44877",
         "id": "1b2eeb27-949b-4704-8bfa-d8e5cfa045a1",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential exploitation attempts that target the Centos Web Panel 7 Unauthenticated Remote Code Execution CVE-2022-44877",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -12632,7 +12632,7 @@
         ],
         "level": "high",
         "rule": [
-            "SELECT * FROM logs WHERE Channel='Security' AND (EventID=4688 AND (ParentProcessName LIKE '%\\\\ws\\_tomcatservice.exe' ESCAPE '\\' AND NewProcessName LIKE '%\\\\repadmin.exe' ESCAPE '\\'))"
+            "SELECT * FROM logs WHERE Channel='Security' AND (EventID=4688 AND (ParentProcessName LIKE '%\\\\ws\\_tomcatservice.exe' ESCAPE '\\' AND (NOT NewProcessName LIKE '%\\\\repadmin.exe' ESCAPE '\\')))"
         ],
         "filename": ""
     },
@@ -13330,7 +13330,7 @@
     {
         "title": "Potential Exploitation Attempt Of Undocumented WindowsServer RCE",
         "id": "6d5b8176-d87d-4402-8af4-53aee9db7b5d",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential exploitation attempt of undocumented Windows Server Pre Auth Remote Code Execution (RCE)",
         "author": "Florian Roth (Nextron Systems), Nasreddine Bencherchali",
         "tags": [
@@ -14196,7 +14196,7 @@
     {
         "title": "Suspicious AppX Package Locations",
         "id": "5cdeaf3d-1489-477c-95ab-c318559fc051",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an appx package added the pipeline of the \"to be processed\" packages which is located in suspicious locations",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -15995,7 +15995,7 @@
     {
         "title": "DNS Query for Anonfiles.com Domain - DNS Client",
         "id": "29f171d7-aa47-42c7-9c7b-3c87938164d9",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects DNS queries for anonfiles.com, which is an anonymous file upload platform often used for malicious purposes",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -17039,7 +17039,7 @@
     {
         "title": "Restricted Software Access By SRP",
         "id": "b4c8da4a-1c12-46b0-8a2b-0a8521d03442",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects restricted access to applications by the Software Restriction Policies (SRP) policy",
         "author": "frack113",
         "tags": [
@@ -17746,7 +17746,7 @@
     {
         "title": "Renamed Plink Execution",
         "id": "1c12727d-02bf-45ff-a9f3-d49806a3cf43",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed version of the Plink binary",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -18359,7 +18359,7 @@
     {
         "title": "Potential Persistence Via Powershell Search Order Hijacking - Task",
         "id": "b66474aa-bd92-4333-a16c-298155b120df",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell \"Get-Variable\" technique as seen being used in Colibri Loader",
         "author": "pH-T (Nextron Systems), Florian Roth (Nextron Systems)",
         "tags": [
@@ -18616,7 +18616,7 @@
     {
         "title": "SQLite Chromium Profile Data DB Access",
         "id": "24c77512-782b-448a-8950-eddb0785fc71",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect usage of the \"sqlite\" binary to query databases in Chromium-based browsers for potential data stealing.",
         "author": "TropChaud",
         "tags": [
@@ -18936,7 +18936,7 @@
     {
         "title": "Renamed NetSupport RAT Execution",
         "id": "0afbd410-de03-4078-8491-f132303cb67d",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed \"client32.exe\" (NetSupport RAT) via Imphash, Product and OriginalFileName strings",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -19452,7 +19452,7 @@
     {
         "title": "Disabled RestrictedAdminMode For RDS - ProcCreation",
         "id": "28ac00d6-22d9-4a3c-927f-bbd770104573",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect activation of DisableRestrictedAdmin to disable RestrictedAdmin mode.\nRestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.\nThis prevents your credentials from being harvested during the initial connection process if the remote server has been compromise\n",
         "author": "frack113",
         "tags": [
@@ -19846,7 +19846,7 @@
     {
         "title": "Potential Renamed Rundll32 Execution",
         "id": "2569ed8c-1147-498a-9b8c-2ad3656b10ed",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when 'DllRegisterServer' is called in the commandline and the image is not rundll32. This could mean that the 'rundll32' utility has been renamed in order to avoid detection",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -19940,7 +19940,7 @@
     {
         "title": "PUA - DefenderCheck Execution",
         "id": "f0ca6c24-3225-47d5-b1f5-352bf07ecfa7",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of DefenderCheck, a tool to evaluate the signatures used in Microsoft Defender. It can be used to figure out the strings / byte chains used in Microsoft Defender to detect a tool and thus used for AV evasion.",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -20561,7 +20561,7 @@
     {
         "title": "Microsoft IIS Service Account Password Dumped",
         "id": "2d3cdeec-c0db-45b4-aa86-082f7eb75701",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords",
         "author": "Tim Rauch, Janantha Marasinghe",
         "tags": [
@@ -21030,7 +21030,7 @@
     {
         "title": "Potential WinAPI Calls Via CommandLine",
         "id": "ba3f5c1b-6272-4119-9dbd-0bc8d21c2702",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -21110,7 +21110,7 @@
     {
         "title": "PUA - Seatbelt Execution",
         "id": "38646daa-e78f-4ace-9de0-55547b2d30da",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -21173,7 +21173,7 @@
     {
         "title": "Potential Arbitrary Code Execution Via Node.EXE",
         "id": "6640f31c-01ad-49b5-beb5-83498a5cd8bd",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution node.exe which is shipped with multiple software such as VMware, Adobe...etc. In order to execute arbitrary code. For example to establish reverse shell as seen in Log4j attacks...etc",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -21393,7 +21393,7 @@
     {
         "title": "HackTool - SharPersist Execution",
         "id": "26488ad0-f9fd-4536-876f-52fea846a2e4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the hacktool SharPersist - used to deploy various different kinds of persistence mechanisms",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -21435,7 +21435,7 @@
     {
         "title": "Uncommon One Time Only Scheduled Task At 00:00",
         "id": "970823b7-273b-460a-8afc-3a6811998529",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects scheduled task creation events that include suspicious actions, and is run once at 00:00",
         "author": "pH-T (Nextron Systems)",
         "tags": [
@@ -21966,7 +21966,7 @@
     {
         "title": "Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE",
         "id": "07f8bdc2-c9b3-472a-9817-5a670b872f53",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of cmdkey to look for cached credentials on the system",
         "author": "jmallette, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -22042,7 +22042,7 @@
     {
         "title": "Operator Bloopers Cobalt Strike Modules",
         "id": "4f154fb6-27d1-4813-a759-78b93e0b9c48",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects Cobalt Strike module/commands accidentally entered in CMD shell",
         "author": "_pete_0, TheDFIRReport",
         "tags": [
@@ -22685,7 +22685,7 @@
     {
         "title": "HackTool - KrbRelayUp Execution",
         "id": "12827a56-61a4-476a-a9cb-f3068f191073",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -22976,7 +22976,7 @@
     {
         "title": "Disable Windows IIS HTTP Logging",
         "id": "e4ed6030-ffe5-4e6a-8a8a-ab3c1ab9d94e",
-        "status": "experimental",
+        "status": "test",
         "description": "Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union)",
         "author": "frack113",
         "tags": [
@@ -23460,7 +23460,7 @@
     {
         "title": "Powershell Base64 Encoded MpPreference Cmdlet",
         "id": "c6fb44c6-71f5-49e6-9462-1425d328aee3",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects base64 encoded \"MpPreference\" PowerShell cmdlet code that tries to modifies or tamper with Windows Defender AV",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -23694,7 +23694,7 @@
     {
         "title": "HackTool - KrbRelay Execution",
         "id": "e96253b8-6b3b-4f90-9e59-3b24b99cf9b4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of KrbRelay, a Kerberos relaying tool",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -23771,7 +23771,7 @@
     {
         "title": "HackTool - PowerTool Execution",
         "id": "a34f79a3-8e5f-4cc3-b765-de00695452c2",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the tool PowerTool which has the ability to kill a process, delete its process file, unload drivers, and delete the driver files",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -23868,7 +23868,7 @@
     {
         "title": "Potential Credential Dumping Attempt Using New NetworkProvider - CLI",
         "id": "baef1ec6-2ca9-47a3-97cc-4cf2bda10b77",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -23887,7 +23887,7 @@
     {
         "title": "Potential Recon Activity Via Nltest.EXE",
         "id": "5cc90652-4cbd-4241-aa3b-4b462fa5a248",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects nltest commands that can be used for information discovery",
         "author": "Craig Young, oscd.community, Georg Lauenstein",
         "tags": [
@@ -24102,7 +24102,7 @@
     {
         "title": "HackTool - SharpLdapWhoami Execution",
         "id": "d9367cbb-c2e0-47ce-bdc0-128cb6da898d",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -24143,7 +24143,7 @@
     {
         "title": "SafeBoot Registry Key Deleted Via Reg.EXE",
         "id": "fc0e89b5-adb0-43c1-b749-c12a10ec37de",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of \"reg.exe\" commands with the \"delete\" flag on safe boot registry keys. Often used by attacker to prevent safeboot execution of security products",
         "author": "Nasreddine Bencherchali (Nextron Systems), Tim Shelton",
         "tags": [
@@ -24199,7 +24199,7 @@
     {
         "title": "Suspicious Binary In User Directory Spawned From Office Application",
         "id": "aa3a6f94-890e-4e22-b634-ffdfd54792cc",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an executable in the users directory started from one of the Microsoft Office suite applications (Word, Excel, PowerPoint, Publisher, Visio)",
         "author": "Jason Lynch",
         "tags": [
@@ -24395,7 +24395,7 @@
     {
         "title": "Suspicious Hacktool Execution - PE Metadata",
         "id": "37c1333a-a0db-48be-b64b-7393b2386e3b",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -24721,7 +24721,7 @@
     {
         "title": "PowerShell Base64 Encoded WMI Classes",
         "id": "1816994b-42e1-4fb1-afd2-134d88184f71",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects calls to base64 encoded WMI class such as \"Win32_Shadowcopy\", \"Win32_ScheduledJob\", etc.",
         "author": "Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -24762,7 +24762,7 @@
     {
         "title": "PUA - Fast Reverse Proxy (FRP) Execution",
         "id": "32410e29-5f94-4568-b6a3-d91a8adad863",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet.",
         "author": "frack113, Florian Roth",
         "tags": [
@@ -25049,7 +25049,7 @@
     {
         "title": "Operator Bloopers Cobalt Strike Commands",
         "id": "647c7b9e-d784-4fda-b9a0-45c565a7b729",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects use of Cobalt Strike commands accidentally entered in the CMD shell",
         "author": "_pete_0, TheDFIRReport",
         "tags": [
@@ -25202,7 +25202,7 @@
     {
         "title": "HackTool - HandleKatz LSASS Dumper Execution",
         "id": "ca621ba5-54ab-4035-9942-d378e6fcde3c",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -25639,7 +25639,7 @@
     {
         "title": "Suspicious Shells Spawn by Java Utility Keytool",
         "id": "90fb5e62-ca1f-4e22-b42e-cc521874c938",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation)",
         "author": "Andreas Hunkeler (@Karneades)",
         "tags": [
@@ -25659,7 +25659,7 @@
     {
         "title": "PUA - NPS Tunneling Tool Execution",
         "id": "68d37776-61db-42f5-bf54-27e87072d17e",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of NPS, a port forwarding and intranet penetration proxy server",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -25756,7 +25756,7 @@
     {
         "title": "Renamed Msdt.EXE Execution",
         "id": "bd1c6866-65fc-44b2-be51-5588fcff82b9",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed \"Msdt.exe\" binary",
         "author": "pH-T (Nextron Systems)",
         "tags": [
@@ -25794,7 +25794,7 @@
     {
         "title": "Execution from Suspicious Folder",
         "id": "3dfd06d2-eaf4-4532-9555-68aca59f57c4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects a suspicious execution from an uncommon folder",
         "author": "Florian Roth (Nextron Systems), Tim Shelton",
         "tags": [
@@ -25946,7 +25946,7 @@
     {
         "title": "Renamed Mavinject.EXE Execution",
         "id": "e6474a1b-5390-49cd-ab41-8d88655f7394",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed version of the \"Mavinject\" process. Which can be abused to perform process injection using the \"/INJECTRUNNING\" flag",
         "author": "frack113, Florian Roth",
         "tags": [
@@ -26636,7 +26636,7 @@
     {
         "title": "Potential PowerShell Execution Policy Tampering - ProcCreation",
         "id": "cf2e938e-9a3e-4fe8-a347-411642b28a9f",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects changes to the PowerShell execution policy registry key in order to bypass signing requirements for script execution from the CommandLine",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -26654,7 +26654,7 @@
     {
         "title": "Renamed BrowserCore.EXE Execution",
         "id": "8a4519e8-e64a-40b6-ae85-ba8ad2177559",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects process creation with a renamed BrowserCore.exe (used to extract Azure tokens)",
         "author": "Max Altgelt (Nextron Systems)",
         "tags": [
@@ -26915,7 +26915,7 @@
     {
         "title": "Renamed Vmnat.exe Execution",
         "id": "7b4f794b-590a-4ad4-ba18-7964a2832205",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects renamed vmnat.exe or portable version that can be used for DLL side-loading",
         "author": "elhoim",
         "tags": [
@@ -26934,7 +26934,7 @@
     {
         "title": "Renamed Sysinternals Sdelete Execution",
         "id": "c1d867fe-8d95-4487-aab4-e53f2d339f90",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of a renamed SysInternals Sdelete, which is something an administrator shouldn't do (the renaming)",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -27126,7 +27126,7 @@
     {
         "title": "Potential Signing Bypass Via Windows Developer Features",
         "id": "a383dec4-deec-4e6e-913b-ed9249670848",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when a user enable developer features such as \"Developer Mode\" or \"Application Sideloading\". Which allows the user to install untrusted packages.",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -27238,7 +27238,7 @@
     {
         "title": "Root Certificate Installed From Susp Locations",
         "id": "5f6a601c-2ecb-498b-9c33-660362323afa",
-        "status": "experimental",
+        "status": "test",
         "description": "Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -27257,7 +27257,7 @@
     {
         "title": "Potential Process Injection Via Msra.EXE",
         "id": "744a188b-0415-4792-896f-11ddb0588dbc",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential process injection via Microsoft Remote Asssistance (Msra.exe) by looking at suspicious child processes spawned from the aforementioned process. It has been a target used by many threat actors and used for discovery and persistence tactics",
         "author": "Alexander McDonald",
         "tags": [
@@ -27579,7 +27579,7 @@
     {
         "title": "Potential RDP Tunneling Via SSH",
         "id": "f7d7ebd5-a016-46e2-9c54-f9932f2d386d",
-        "status": "experimental",
+        "status": "test",
         "description": "Execution of ssh.exe to perform data exfiltration and tunneling through RDP",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -27735,7 +27735,7 @@
     {
         "title": "Service Registry Key Deleted Via Reg.EXE",
         "id": "05b2aa93-1210-42c8-8d9a-2fcc13b284f5",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of \"reg.exe\" commands with the \"delete\" flag on services registry key. Often used by attacker to remove AV software services",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -27890,7 +27890,7 @@
     {
         "title": "HackTool - Htran/NATBypass Execution",
         "id": "f5e3b62f-e577-4e59-931e-0a15b2b94e1e",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass)",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -27910,7 +27910,7 @@
     {
         "title": "SQLite Firefox Profile Data DB Access",
         "id": "4833155a-4053-4c9c-a997-777fcea0baa7",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect usage of the \"sqlite\" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.",
         "author": "frack113",
         "tags": [
@@ -28774,7 +28774,7 @@
     {
         "title": "Potential PowerShell Obfuscation Using Alias Cmdlets",
         "id": "96cd126d-f970-49c4-848a-da3a09f55c55",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects Set-Alias or New-Alias cmdlet usage. Which can be use as a mean to obfuscate PowerShell scripts",
         "author": "frack113",
         "tags": [
@@ -28852,7 +28852,7 @@
     {
         "title": "Potential PowerShell Obfuscation Using Character Join",
         "id": "e8314f79-564d-4f79-bc13-fbc0bf2660d8",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects specific techniques often seen used inside of PowerShell scripts to obfscuate Alias creation",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -29226,7 +29226,7 @@
     {
         "title": "Scheduled Task Deletion",
         "id": "4f86b304-3e02-40e3-aa5d-e88a167c9617",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects scheduled task deletion events. Scheduled tasks are likely to be deleted if not used for persistence. Malicious Software often creates tasks directly under the root node e.g. \\TASKNAME",
         "author": "David Strassegger, Tim Shelton",
         "tags": [
@@ -30233,7 +30233,7 @@
     {
         "title": "The Windows Defender Firewall Service Failed To Load Group Policy",
         "id": "7ec15688-fd24-4177-ba43-1a950537ee39",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects activity when The Windows Defender Firewall service failed to load Group Policy",
         "author": "frack113",
         "tags": [
@@ -30347,7 +30347,7 @@
     {
         "title": "DirLister Execution",
         "id": "b4dc61f5-6cce-468e-a608-b48b469feaa2",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect the usage of \"DirLister.exe\" a utility for quickly listing folder or drive contents. It was seen used by BlackCat ransomware to create a list of accessible directories and files.",
         "author": "frack113",
         "tags": [
@@ -30496,7 +30496,7 @@
     {
         "title": "Nltest.EXE Execution",
         "id": "903076ff-f442-475a-b667-4f246bcc203b",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects nltest commands that can be used for information discovery",
         "author": "Arun Chauhan",
         "tags": [
@@ -32636,7 +32636,7 @@
     {
         "title": "Potential PendingFileRenameOperations Tamper",
         "id": "4eec988f-7bf0-49f1-8675-1e6a510b3a2a",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect changes to the \"PendingFileRenameOperations\" registry key from uncommon or suspicious images lcoations to stage currently used files for rename after reboot.",
         "author": "frack113",
         "tags": [
@@ -32812,7 +32812,7 @@
     {
         "title": "Atbroker Registry Change",
         "id": "9577edbb-851f-4243-8c91-1d5b50c1a39b",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'",
         "author": "Mateusz Wydra, oscd.community",
         "tags": [
@@ -33220,7 +33220,7 @@
     {
         "title": "Suspicious PowerShell Download - PoshModule",
         "id": "de41232e-12e8-49fa-86bc-c05c7e722df9",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious PowerShell download command",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -33239,7 +33239,7 @@
     {
         "title": "Potential Active Directory Enumeration Using AD Module - PsModule",
         "id": "74176142-4684-4d8a-8b0a-713257e7df8e",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of the \"Import-Module\" cmdlet to load the \"Microsoft.ActiveDirectory.Management.dl\" DLL. Which is often used by attackers to perform AD enumeration.",
         "author": "Nasreddine Bencherchali (Nextron Systems), frack113",
         "tags": [
@@ -33797,7 +33797,7 @@
     {
         "title": "Usage Of Web Request Commands And Cmdlets - ScriptBlock",
         "id": "1139d2e2-84b1-4226-b445-354492eba8ba",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via PowerShell scriptblock logs",
         "author": "James Pemberton / @4A616D6573",
         "tags": [
@@ -34030,7 +34030,7 @@
     {
         "title": "Unsigned AppX Installation Attempt Using Add-AppxPackage - PsScript",
         "id": "975b2262-9a49-439d-92a6-0709cccdf0b2",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of the \"Add-AppxPackage\" or it's alias \"Add-AppPackage\" to install unsigned AppX packages",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -34220,7 +34220,7 @@
     {
         "title": "Import PowerShell Modules From Suspicious Directories",
         "id": "21f9162c-5f5d-4b01-89a8-b705bd7d10ab",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects powershell scripts that import modules from suspicious directories",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -34428,7 +34428,7 @@
     {
         "title": "Potential Data Exfiltration Via Audio File",
         "id": "e4f93c99-396f-47c8-bb0f-201b1fa69034",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential exfiltration attempt via audio file using PowerShell",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -34522,7 +34522,7 @@
     {
         "title": "Powershell XML Execute Command",
         "id": "6c6c6282-7671-4fe9-a0ce-a2dcebdc342b",
-        "status": "experimental",
+        "status": "test",
         "description": "Adversaries may abuse PowerShell commands and scripts for execution.\nPowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell)\nAdversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code\n",
         "author": "frack113",
         "tags": [
@@ -34962,7 +34962,7 @@
     {
         "title": "Potential Active Directory Enumeration Using AD Module - PsScript",
         "id": "9e620995-f2d8-4630-8430-4afd89f77604",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of the \"Import-Module\" cmdlet to load the \"Microsoft.ActiveDirectory.Management.dl\" DLL. Which is often used by attackers to perform AD enumeration.",
         "author": "frack113, Nasreddine Bencherchali",
         "tags": [
@@ -35075,25 +35075,6 @@
         ],
         "filename": ""
     },
-    {
-        "title": "Suspicious DNS Query for IP Lookup Service APIs",
-        "id": "ec82e2a5-81ea-4211-a1f8-37a0286df2c2",
-        "status": "test",
-        "description": "Detects DNS queries for IP lookup services such as \"api.ipify.org\" originating from a non browser process.",
-        "author": "Brandon George (blog post), Thomas Patzke",
-        "tags": [
-            "attack.reconnaissance",
-            "attack.t1590"
-        ],
-        "falsepositives": [
-            "Legitimate usage of IP lookup services such as ipify API"
-        ],
-        "level": "medium",
-        "rule": [
-            "SELECT * FROM logs WHERE (QueryName LIKE '%api.2ip.ua%' ESCAPE '\\' OR QueryName LIKE '%api.ipify.org%' ESCAPE '\\' OR QueryName LIKE '%bot.whatismyipaddress.com%' ESCAPE '\\' OR QueryName LIKE '%canireachthe.net%' ESCAPE '\\' OR QueryName LIKE '%checkip.amazonaws.com%' ESCAPE '\\' OR QueryName LIKE '%checkip.dyndns.org%' ESCAPE '\\' OR QueryName LIKE '%curlmyip.com%' ESCAPE '\\' OR QueryName LIKE '%edns.ip-api.com%' ESCAPE '\\' OR QueryName LIKE '%eth0.me%' ESCAPE '\\' OR QueryName LIKE '%freegeoip.app%' ESCAPE '\\' OR QueryName LIKE '%geoipy.com%' ESCAPE '\\' OR QueryName LIKE '%getip.pro%' ESCAPE '\\' OR QueryName LIKE '%icanhazip.com%' ESCAPE '\\' OR QueryName LIKE '%ident.me%' ESCAPE '\\' OR QueryName LIKE '%ifconfig.io%' ESCAPE '\\' OR QueryName LIKE '%ifconfig.me%' ESCAPE '\\' OR QueryName LIKE '%ip-api.com%' ESCAPE '\\' OR QueryName LIKE '%ip.anysrc.net%' ESCAPE '\\' OR QueryName LIKE '%ip.tyk.nu%' ESCAPE '\\' OR QueryName LIKE '%ipaddressworld.com%' ESCAPE '\\' OR QueryName LIKE '%ipecho.net%' ESCAPE '\\' OR QueryName LIKE '%ipinfo.io%' ESCAPE '\\' OR QueryName LIKE '%ipof.in%' ESCAPE '\\' OR QueryName LIKE '%ipv4.icanhazip.com%' ESCAPE '\\' OR QueryName LIKE '%ipv4bot.whatismyipaddress.com%' ESCAPE '\\' OR QueryName LIKE '%ipwho.is%' ESCAPE '\\' OR QueryName LIKE '%l2.io%' ESCAPE '\\' OR QueryName LIKE '%myexternalip.com%' ESCAPE '\\' OR QueryName LIKE '%wgetip.com%' ESCAPE '\\' OR QueryName LIKE '%whatismyip.akamai.com%' ESCAPE '\\' OR QueryName LIKE '%wtfismyip.com%' ESCAPE '\\') AND (NOT (Image LIKE '%\\\\brave.exe' ESCAPE '\\' OR (Image LIKE 'C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files (x86)\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\') OR (Image LIKE 'C:\\\\Program Files\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\') OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\') OR Image LIKE '%\\\\maxthon.exe' ESCAPE '\\' OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\%' ESCAPE '\\' OR Image LIKE '%\\\\WindowsApps\\\\MicrosoftEdge.exe' ESCAPE '\\' OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\')) OR ((Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\') AND (Image LIKE '%\\\\msedge.exe' ESCAPE '\\' OR Image LIKE '%\\\\msedgewebview2.exe' ESCAPE '\\')) OR Image LIKE '%\\\\opera.exe' ESCAPE '\\' OR Image LIKE '%\\\\safari.exe' ESCAPE '\\' OR Image LIKE '%\\\\seamonkey.exe' ESCAPE '\\' OR Image LIKE '%\\\\vivaldi.exe' ESCAPE '\\' OR Image LIKE '%\\\\whale.exe' ESCAPE '\\'))"
-        ],
-        "filename": ""
-    },
     {
         "title": "DNS Query Request By Regsvr32.EXE",
         "id": "36e037c4-c228-4866-b6a3-48eb292b9955",
@@ -35230,6 +35211,25 @@
         ],
         "filename": ""
     },
+    {
+        "title": "Suspicious DNS Query for IP Lookup Service APIs",
+        "id": "ec82e2a5-81ea-4211-a1f8-37a0286df2c2",
+        "status": "test",
+        "description": "Detects DNS queries for IP lookup services such as \"api.ipify.org\" originating from a non browser process.",
+        "author": "Brandon George (blog post), Thomas Patzke",
+        "tags": [
+            "attack.reconnaissance",
+            "attack.t1590"
+        ],
+        "falsepositives": [
+            "Legitimate usage of IP lookup services such as ipify API"
+        ],
+        "level": "medium",
+        "rule": [
+            "SELECT * FROM logs WHERE (QueryName LIKE '%api.2ip.ua%' ESCAPE '\\' OR QueryName LIKE '%api.bigdatacloud.net%' ESCAPE '\\' OR QueryName LIKE '%api.ipify.org%' ESCAPE '\\' OR QueryName LIKE '%bot.whatismyipaddress.com%' ESCAPE '\\' OR QueryName LIKE '%canireachthe.net%' ESCAPE '\\' OR QueryName LIKE '%checkip.amazonaws.com%' ESCAPE '\\' OR QueryName LIKE '%checkip.dyndns.org%' ESCAPE '\\' OR QueryName LIKE '%curlmyip.com%' ESCAPE '\\' OR QueryName LIKE '%db-ip.com%' ESCAPE '\\' OR QueryName LIKE '%edns.ip-api.com%' ESCAPE '\\' OR QueryName LIKE '%eth0.me%' ESCAPE '\\' OR QueryName LIKE '%freegeoip.app%' ESCAPE '\\' OR QueryName LIKE '%geoipy.com%' ESCAPE '\\' OR QueryName LIKE '%getip.pro%' ESCAPE '\\' OR QueryName LIKE '%icanhazip.com%' ESCAPE '\\' OR QueryName LIKE '%ident.me%' ESCAPE '\\' OR QueryName LIKE '%ifconfig.io%' ESCAPE '\\' OR QueryName LIKE '%ifconfig.me%' ESCAPE '\\' OR QueryName LIKE '%ipapi.co%' ESCAPE '\\' OR QueryName LIKE '%ip-api.com%' ESCAPE '\\' OR QueryName LIKE '%ip.anysrc.net%' ESCAPE '\\' OR QueryName LIKE '%ip.tyk.nu%' ESCAPE '\\' OR QueryName LIKE '%ipaddressworld.com%' ESCAPE '\\' OR QueryName LIKE '%ipecho.net%' ESCAPE '\\' OR QueryName LIKE '%ipinfo.io%' ESCAPE '\\' OR QueryName LIKE '%ipof.in%' ESCAPE '\\' OR QueryName LIKE '%ipv4.icanhazip.com%' ESCAPE '\\' OR QueryName LIKE '%ipv4bot.whatismyipaddress.com%' ESCAPE '\\' OR QueryName LIKE '%ipwho.is%' ESCAPE '\\' OR QueryName LIKE '%l2.io%' ESCAPE '\\' OR QueryName LIKE '%myexternalip.com%' ESCAPE '\\' OR QueryName LIKE '%wgetip.com%' ESCAPE '\\' OR QueryName LIKE '%whatismyip.akamai.com%' ESCAPE '\\' OR QueryName LIKE '%wtfismyip.com%' ESCAPE '\\') AND (NOT (Image LIKE '%\\\\brave.exe' ESCAPE '\\' OR (Image LIKE 'C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files (x86)\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\') OR (Image LIKE 'C:\\\\Program Files\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\') OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\') OR Image LIKE '%\\\\maxthon.exe' ESCAPE '\\' OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\%' ESCAPE '\\' OR Image LIKE '%\\\\WindowsApps\\\\MicrosoftEdge.exe' ESCAPE '\\' OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\')) OR ((Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\') AND (Image LIKE '%\\\\msedge.exe' ESCAPE '\\' OR Image LIKE '%\\\\msedgewebview2.exe' ESCAPE '\\')) OR Image LIKE '%\\\\opera.exe' ESCAPE '\\' OR Image LIKE '%\\\\safari.exe' ESCAPE '\\' OR Image LIKE '%\\\\seamonkey.exe' ESCAPE '\\' OR Image LIKE '%\\\\vivaldi.exe' ESCAPE '\\' OR Image LIKE '%\\\\whale.exe' ESCAPE '\\'))"
+        ],
+        "filename": ""
+    },
     {
         "title": "Potential DLL Sideloading Using Coregen.exe",
         "id": "0fa66f66-e3f6-4a9c-93f8-4f2610b00171",
@@ -36121,6 +36121,28 @@
         ],
         "filename": ""
     },
+    {
+        "title": "Registry Set With Crypto-Classes From The \"Cryptography\" PowerShell Namespace",
+        "id": "1c2a3268-3881-414a-80af-a5b313b14c0e",
+        "status": "experimental",
+        "description": "Detects the setting of a registry inside the \"\\Shell\\Open\\Command\" value with PowerShell classes from the \"System.Security.Cryptography\" namespace.\nThe PowerShell namespace \"System.Security.Cryptography\" provides classes for on-the-fly encryption and decryption.\nThese can be used for example in decrypting malicious payload for defense evasion.\n",
+        "author": "Andreas Braathen (mnemonic.io)",
+        "tags": [
+            "attack.defense_evasion",
+            "attack.t1059.001",
+            "attack.t1027.010",
+            "attack.t1547.001",
+            "detection.threat_hunting"
+        ],
+        "falsepositives": [
+            "Classes are legitimately used, but less so when e.g. parents with low prevalence or decryption of content in temporary folders."
+        ],
+        "level": "medium",
+        "rule": [
+            "SELECT * FROM logs WHERE Channel='Security' AND ((EventID=4657 AND OperationType='Existing registry value modified') AND ((EventType='SetValue' AND TargetObject LIKE '%\\\\Shell\\\\Open\\\\Command%' ESCAPE '\\') AND (NewValue LIKE '%powershell%' ESCAPE '\\' OR NewValue LIKE '%pwsh%' ESCAPE '\\') AND NewValue LIKE '%System.Security.Cryptography.%' ESCAPE '\\' AND (NewValue LIKE '%.AesCryptoServiceProvider%' ESCAPE '\\' OR NewValue LIKE '%.DESCryptoServiceProvider%' ESCAPE '\\' OR NewValue LIKE '%.DSACryptoServiceProvider%' ESCAPE '\\' OR NewValue LIKE '%.RC2CryptoServiceProvider%' ESCAPE '\\' OR NewValue LIKE '%.Rijndael%' ESCAPE '\\' OR NewValue LIKE '%.RSACryptoServiceProvider%' ESCAPE '\\' OR NewValue LIKE '%.TripleDESCryptoServiceProvider%' ESCAPE '\\')))"
+        ],
+        "filename": ""
+    },
     {
         "title": "WinAPI Library Calls Via PowerShell Scripts",
         "id": "19d65a1c-8540-4140-8062-8eb00db0bba5",
@@ -36591,6 +36613,27 @@
         ],
         "filename": ""
     },
+    {
+        "title": "Invocation Of Crypto-Classes From The \"Cryptography\" PowerShell Namespace",
+        "id": "ad856965-f44d-42a8-945e-bbf7bd03d05a",
+        "status": "experimental",
+        "description": "Detects the invocation of PowerShell commands with references to classes from the \"System.Security.Cryptography\" namespace.\nThe PowerShell namespace \"System.Security.Cryptography\" provides classes for on-the-fly encryption and decryption.\nThese can be used for example in decrypting malicious payload for defense evasion.\n",
+        "author": "Andreas Braathen (mnemonic.io)",
+        "tags": [
+            "attack.defense_evasion",
+            "attack.t1059.001",
+            "attack.t1027.010",
+            "detection.threat_hunting"
+        ],
+        "falsepositives": [
+            "Classes are legitimately used, but less so when e.g. parents with low prevalence or decryption of content in temporary folders."
+        ],
+        "level": "medium",
+        "rule": [
+            "SELECT * FROM logs WHERE Channel='Security' AND (EventID=4688 AND (((NewProcessName LIKE '%\\\\powershell.exe' ESCAPE '\\' OR NewProcessName LIKE '%\\\\pwsh.exe' ESCAPE '\\') OR (OriginalFileName='PowerShell.EXE' OR OriginalFileName='pwsh.dll')) AND CommandLine LIKE '%System.Security.Cryptography.%' ESCAPE '\\' AND (CommandLine LIKE '%.AesCryptoServiceProvider%' ESCAPE '\\' OR CommandLine LIKE '%.DESCryptoServiceProvider%' ESCAPE '\\' OR CommandLine LIKE '%.DSACryptoServiceProvider%' ESCAPE '\\' OR CommandLine LIKE '%.RC2CryptoServiceProvider%' ESCAPE '\\' OR CommandLine LIKE '%.Rijndael%' ESCAPE '\\' OR CommandLine LIKE '%.RSACryptoServiceProvider%' ESCAPE '\\' OR CommandLine LIKE '%.TripleDESCryptoServiceProvider%' ESCAPE '\\')))"
+        ],
+        "filename": ""
+    },
     {
         "title": "ClickOnce Deployment Execution - Dfsvc.EXE Child Process",
         "id": "241d52b5-eee0-49d0-ac8a-8b9c15c7221c",
@@ -37654,7 +37697,7 @@
     {
         "title": "VsCode Powershell Profile Modification",
         "id": "3a9fa2ec-30bc-4ebd-b49e-7c9cff225502",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the creation or modification of a vscode related powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -38519,7 +38562,7 @@
     {
         "title": "Deployment Of The AppX Package Was Blocked By The Policy",
         "id": "e021bbb5-407f-41f5-9dc9-1864c45a7a51",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an appx package deployment that was blocked by the local computer policy",
         "author": "frack113",
         "tags": [
@@ -38537,7 +38580,7 @@
     {
         "title": "Deployment AppX Package Was Blocked By AppLocker",
         "id": "6ae53108-c3a0-4bee-8f45-c7591a2c337f",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an appx package deployment that was blocked by AppLocker policy",
         "author": "frack113",
         "tags": [
@@ -38555,7 +38598,7 @@
     {
         "title": "Suspicious AppX Package Installation Attempt",
         "id": "898d5fc9-fbc3-43de-93ad-38e97237c344",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an appx package installation with the error code \"0x80073cff\" which indicates that the package didn't meet the signing requirements and could be suspicious",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -38573,7 +38616,7 @@
     {
         "title": "Uncommon AppX Package Locations",
         "id": "c977cb50-3dff-4a9f-b873-9290f56132f1",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an appx package added the pipeline of the \"to be processed\" packages which is located in uncommon locations",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -38591,7 +38634,7 @@
     {
         "title": "Potential Malicious AppX Package Installation Attempts",
         "id": "09d3b48b-be17-47f5-bf4e-94e7e75d09ce",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential installation or installation attempts of known malicious appx packages",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -38724,7 +38767,7 @@
     {
         "title": "Suspicious Digital Signature Of AppX Package",
         "id": "b5aa7d60-c17e-4538-97de-09029d6cd76b",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of AppX packages with known suspicious or malicious signature",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -40727,7 +40770,7 @@
         ],
         "level": "medium",
         "rule": [
-            "SELECT * FROM logs WHERE (DestinationHostname LIKE '%api.2ip.ua%' ESCAPE '\\' OR DestinationHostname LIKE '%api.ipify.org%' ESCAPE '\\' OR DestinationHostname LIKE '%bot.whatismyipaddress.com%' ESCAPE '\\' OR DestinationHostname LIKE '%canireachthe.net%' ESCAPE '\\' OR DestinationHostname LIKE '%checkip.amazonaws.com%' ESCAPE '\\' OR DestinationHostname LIKE '%checkip.dyndns.org%' ESCAPE '\\' OR DestinationHostname LIKE '%curlmyip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%edns.ip-api.com%' ESCAPE '\\' OR DestinationHostname LIKE '%eth0.me%' ESCAPE '\\' OR DestinationHostname LIKE '%freegeoip.app%' ESCAPE '\\' OR DestinationHostname LIKE '%geoipy.com%' ESCAPE '\\' OR DestinationHostname LIKE '%getip.pro%' ESCAPE '\\' OR DestinationHostname LIKE '%icanhazip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ident.me%' ESCAPE '\\' OR DestinationHostname LIKE '%ifconfig.io%' ESCAPE '\\' OR DestinationHostname LIKE '%ifconfig.me%' ESCAPE '\\' OR DestinationHostname LIKE '%ip-api.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ip.anysrc.net%' ESCAPE '\\' OR DestinationHostname LIKE '%ip.tyk.nu%' ESCAPE '\\' OR DestinationHostname LIKE '%ipaddressworld.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ipecho.net%' ESCAPE '\\' OR DestinationHostname LIKE '%ipinfo.io%' ESCAPE '\\' OR DestinationHostname LIKE '%ipof.in%' ESCAPE '\\' OR DestinationHostname LIKE '%ipv4.icanhazip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ipv4bot.whatismyipaddress.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ipwho.is%' ESCAPE '\\' OR DestinationHostname LIKE '%l2.io%' ESCAPE '\\' OR DestinationHostname LIKE '%myexternalip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%wgetip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%whatismyip.akamai.com%' ESCAPE '\\' OR DestinationHostname LIKE '%wtfismyip.com%' ESCAPE '\\') AND (NOT (Image LIKE '%\\\\brave.exe' ESCAPE '\\' OR (Image LIKE 'C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files (x86)\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\') OR (Image LIKE 'C:\\\\Program Files\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\') OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\') OR Image LIKE '%\\\\maxthon.exe' ESCAPE '\\' OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\%' ESCAPE '\\' OR Image LIKE '%\\\\WindowsApps\\\\MicrosoftEdge.exe' ESCAPE '\\' OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\')) OR ((Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\') AND (Image LIKE '%\\\\msedge.exe' ESCAPE '\\' OR Image LIKE '%\\\\msedgewebview2.exe' ESCAPE '\\')) OR Image LIKE '%\\\\opera.exe' ESCAPE '\\' OR Image LIKE '%\\\\safari.exe' ESCAPE '\\' OR Image LIKE '%\\\\seamonkey.exe' ESCAPE '\\' OR Image LIKE '%\\\\vivaldi.exe' ESCAPE '\\' OR Image LIKE '%\\\\whale.exe' ESCAPE '\\'))"
+            "SELECT * FROM logs WHERE (DestinationHostname LIKE '%api.2ip.ua%' ESCAPE '\\' OR DestinationHostname LIKE '%api.bigdatacloud.net%' ESCAPE '\\' OR DestinationHostname LIKE '%api.ipify.org%' ESCAPE '\\' OR DestinationHostname LIKE '%bot.whatismyipaddress.com%' ESCAPE '\\' OR DestinationHostname LIKE '%canireachthe.net%' ESCAPE '\\' OR DestinationHostname LIKE '%checkip.amazonaws.com%' ESCAPE '\\' OR DestinationHostname LIKE '%checkip.dyndns.org%' ESCAPE '\\' OR DestinationHostname LIKE '%curlmyip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%db-ip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%edns.ip-api.com%' ESCAPE '\\' OR DestinationHostname LIKE '%eth0.me%' ESCAPE '\\' OR DestinationHostname LIKE '%freegeoip.app%' ESCAPE '\\' OR DestinationHostname LIKE '%geoipy.com%' ESCAPE '\\' OR DestinationHostname LIKE '%getip.pro%' ESCAPE '\\' OR DestinationHostname LIKE '%icanhazip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ident.me%' ESCAPE '\\' OR DestinationHostname LIKE '%ifconfig.io%' ESCAPE '\\' OR DestinationHostname LIKE '%ifconfig.me%' ESCAPE '\\' OR DestinationHostname LIKE '%ipapi.co%' ESCAPE '\\' OR DestinationHostname LIKE '%ip-api.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ip.anysrc.net%' ESCAPE '\\' OR DestinationHostname LIKE '%ip.tyk.nu%' ESCAPE '\\' OR DestinationHostname LIKE '%ipaddressworld.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ipecho.net%' ESCAPE '\\' OR DestinationHostname LIKE '%ipinfo.io%' ESCAPE '\\' OR DestinationHostname LIKE '%ipof.in%' ESCAPE '\\' OR DestinationHostname LIKE '%ipv4.icanhazip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ipv4bot.whatismyipaddress.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ipwho.is%' ESCAPE '\\' OR DestinationHostname LIKE '%l2.io%' ESCAPE '\\' OR DestinationHostname LIKE '%myexternalip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%wgetip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%whatismyip.akamai.com%' ESCAPE '\\' OR DestinationHostname LIKE '%wtfismyip.com%' ESCAPE '\\') AND (NOT (Image LIKE '%\\\\brave.exe' ESCAPE '\\' OR (Image LIKE 'C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files (x86)\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\') OR (Image LIKE 'C:\\\\Program Files\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\') OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\') OR Image LIKE '%\\\\maxthon.exe' ESCAPE '\\' OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\%' ESCAPE '\\' OR Image LIKE '%\\\\WindowsApps\\\\MicrosoftEdge.exe' ESCAPE '\\' OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\')) OR ((Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\') AND (Image LIKE '%\\\\msedge.exe' ESCAPE '\\' OR Image LIKE '%\\\\msedgewebview2.exe' ESCAPE '\\')) OR Image LIKE '%\\\\opera.exe' ESCAPE '\\' OR Image LIKE '%\\\\safari.exe' ESCAPE '\\' OR Image LIKE '%\\\\seamonkey.exe' ESCAPE '\\' OR Image LIKE '%\\\\vivaldi.exe' ESCAPE '\\' OR Image LIKE '%\\\\whale.exe' ESCAPE '\\'))"
         ],
         "filename": ""
     },
@@ -41008,7 +41051,7 @@
     {
         "title": "Potential Password Spraying Attempt Using Dsacls.EXE",
         "id": "bac9fb54-2da7-44e9-988f-11e9a5edbc0c",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects possible password spraying attempts using Dsacls",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -41899,7 +41942,7 @@
     {
         "title": "Potential Active Directory Enumeration Using AD Module - ProcCreation",
         "id": "70bc5215-526f-4477-963c-a47a5c9ebd12",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of the \"Import-Module\" cmdlet to load the \"Microsoft.ActiveDirectory.Management.dl\" DLL. Which is often used by attackers to perform AD enumeration.",
         "author": "frack113",
         "tags": [
@@ -42099,7 +42142,7 @@
     {
         "title": "PDQ Deploy Remote Adminstartion Tool Execution",
         "id": "d679950c-abb7-43a6-80fb-2a480c4fc450",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect use of PDQ Deploy remote admin tool",
         "author": "frack113",
         "tags": [
@@ -42485,7 +42528,7 @@
     {
         "title": "Unsigned AppX Installation Attempt Using Add-AppxPackage",
         "id": "37651c2a-42cd-4a69-ae0d-22a4349aa04a",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of the \"Add-AppxPackage\" or it's alias \"Add-AppPackage\" to install unsigned AppX packages",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -44033,7 +44076,7 @@
     {
         "title": "Suspicious New Instance Of An Office COM Object",
         "id": "9bdaf1e9-fdef-443b-8081-4341b74a7e28",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an svchost process spawning an instance of an office application. This happens when the initial word application creates an instance of one of the Office COM objects such as 'Word.Application', 'Excel.Application', etc.\nThis can be used by malicious actors to create malicious Office documents with macros on the fly. (See vba2clr project in the references)\n",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -44399,7 +44442,7 @@
     {
         "title": "Potential DLL Sideloading Via DeviceEnroller.EXE",
         "id": "e173ad47-4388-4012-ae62-bd13f71c18a8",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of the PhoneDeepLink parameter to potentially sideload a DLL file that does not exist. This non-existent DLL file is named \"ShellChromeAPI.dll\".\nAdversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter\n",
         "author": "@gott_cyber",
         "tags": [
@@ -45288,7 +45331,7 @@
     {
         "title": "Suspicious IIS URL GlobalRules Rewrite Via AppCmd",
         "id": "7c8af9b2-dcae-41a2-a9db-b28c288b5f08",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of \"appcmd\" to create new global URL rewrite rules. This behaviour has been observed being used by threat actors to add new rules so they can access their webshells.",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -45729,7 +45772,7 @@
     {
         "title": "Suspicious Git Clone",
         "id": "aef9d1f1-7396-4e92-a927-4567c7a495c1",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of \"git\" in order to clone a remote repository that contain suspicious keywords which might be suspicious",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -45786,7 +45829,7 @@
     {
         "title": "New Remote Desktop Connection Initiated Via Mstsc.EXE",
         "id": "954f0af7-62dd-418f-b3df-a84bc2c7a774",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the usage of \"mstsc.exe\" with the \"/v\" flag to initiate a connection to a remote server.\nAdversaries may use valid accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.\n",
         "author": "frack113",
         "tags": [
@@ -45904,7 +45947,7 @@
     {
         "title": "Potentially Over Permissive Permissions Granted Using Dsacls.EXE",
         "id": "01c42d3c-242d-4655-85b2-34f1739632f7",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of Dsacls to grant over permissive permissions",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -46327,7 +46370,7 @@
     {
         "title": "Fsutil Behavior Set SymlinkEvaluation",
         "id": "c0b2768a-dd06-4671-8339-b16ca8d1f27f",
-        "status": "experimental",
+        "status": "test",
         "description": "A symbolic link is a type of file that contains a reference to another file.\nThis is probably done to make sure that the ransomware is able to follow shortcuts on the machine in order to find the original file to encrypt\n",
         "author": "frack113",
         "tags": [
@@ -46447,7 +46490,7 @@
     {
         "title": "Suspicious Rundll32 Script in CommandLine",
         "id": "73fcad2e-ff14-4c38-b11d-4172c8ac86c7",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious process related to rundll32 based on arguments",
         "author": "frack113, Zaw Min Htun (ZETA)",
         "tags": [
@@ -46915,7 +46958,7 @@
     {
         "title": "Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE",
         "id": "48917adc-a28e-4f5d-b729-11e75da8941f",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the usage of \"reg.exe\" to add Defender folder exclusions. Qbot has been seen using this technique to add exclusions for folders within AppData and ProgramData.",
         "author": "frack113",
         "tags": [
@@ -47537,7 +47580,7 @@
     {
         "title": "New Generic Credentials Added Via Cmdkey.EXE",
         "id": "b1ec66c6-f4d1-4b5c-96dd-af28ccae7727",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of cmdkey to add generic credentials. As an example, this has to be used before connecting to an RDP session via command line interface.",
         "author": "frack113, Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -47847,7 +47890,7 @@
     {
         "title": "Lolbin Ssh.exe Use As Proxy",
         "id": "7d6d30b8-5b91-4b90-a891-46cccaf29598",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect usage of the \"ssh.exe\" binary as a proxy to launch other programs",
         "author": "frack113, Nasreddine Bencherchali",
         "tags": [
@@ -48357,7 +48400,7 @@
     {
         "title": "Query Usage To Exfil Data",
         "id": "53ef0cef-fa24-4f25-a34a-6c72dfa2e6e2",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of \"query.exe\" a system binary to exfil information such as \"sessions\" and \"processes\" for later use",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -48513,7 +48556,7 @@
     {
         "title": "Suspicious Use of PsLogList",
         "id": "aae1243f-d8af-40d8-ab20-33fc6d0c55bc",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of the PsLogList utility to dump event log in order to extract admin accounts and perform account discovery or delete events logs",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -48851,7 +48894,7 @@
     {
         "title": "Renamed Remote Utilities RAT (RURAT) Execution",
         "id": "9ef27c24-4903-4192-881a-3adde7ff92a5",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of renamed Remote Utilities (RURAT) via Product PE header field",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -49225,7 +49268,7 @@
     {
         "title": "Import PowerShell Modules From Suspicious Directories - ProcCreation",
         "id": "c31364f7-8be6-4b77-8483-dd2b5a7b69a3",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects powershell scripts that import modules from suspicious directories",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -49419,7 +49462,7 @@
     {
         "title": "Potential Discovery Activity Via Dnscmd.EXE",
         "id": "b6457d63-d2a2-4e29-859d-4e7affc153d1",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an attempt to leverage dnscmd.exe to enumerate the DNS zones of a domain. DNS zones used to host the DNS records for a particular domain.",
         "author": "@gott_cyber",
         "tags": [
diff --git a/rules/rules_windows_sysmon.json b/rules/rules_windows_sysmon.json
index fe37081..766a1f5 100644
--- a/rules/rules_windows_sysmon.json
+++ b/rules/rules_windows_sysmon.json
@@ -2880,7 +2880,7 @@
     {
         "title": "Potential Svchost Memory Access",
         "id": "166e9c50-8cd9-44af-815d-d1f0c0e90dde",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential access to svchost process memory such as that used by Invoke-Phantom to kill the winRM Windows event logging service.",
         "author": "Tim Burrell",
         "tags": [
@@ -3375,7 +3375,7 @@
     {
         "title": "Malicious PowerShell Scripts - PoshModule",
         "id": "41025fd7-0466-4650-a813-574aaacbe7f4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of known offensive powershell scripts used for exploitation or reconnaissance",
         "author": "frack113, Nasreddine Bencherchali",
         "tags": [
@@ -4654,7 +4654,7 @@
     {
         "title": "Malicious Nishang PowerShell Commandlets",
         "id": "f772cee9-b7c2-4cb2-8f07-49870adc02e0",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects Commandlet names and arguments from the Nishang exploitation framework",
         "author": "Alec Costello",
         "tags": [
@@ -4692,7 +4692,7 @@
     {
         "title": "DNS Query for Anonfiles.com Domain - Sysmon",
         "id": "065cceea-77ec-4030-9052-fc0affea7110",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects DNS queries for \"anonfiles.com\", which is an anonymous file upload platform often used for malicious purposes",
         "author": "pH-T (Nextron Systems)",
         "tags": [
@@ -5641,7 +5641,7 @@
     {
         "title": "Potential DLL Sideloading Of Non-Existent DLLs From System Folders",
         "id": "6b98b92b-4f00-4f62-b4fe-4d1920215771",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects DLL sideloading of system dlls that are not present on the system by default. Usually to achieve techniques such as UAC bypass and privilege escalation",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -6529,7 +6529,7 @@
     {
         "title": "Suspicious Startup Folder Persistence",
         "id": "28208707-fe31-437f-9a7f-4b1108b94d2e",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when a file with a suspicious extension is created in the startup folder",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -9905,7 +9905,7 @@
     {
         "title": "Potential Exploitation Attempt From Office Application",
         "id": "868955d9-697e-45d4-a3da-360cefd7c216",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects Office applications executing a child process that includes directory traversal patterns. This could be an attempt to exploit CVE-2022-30190 (MSDT RCE) or CVE-2021-40444 (MSHTML RCE)",
         "author": "Christian Burkard (Nextron Systems), @SBousseaden (idea)",
         "tags": [
@@ -10803,7 +10803,7 @@
     {
         "title": "Potential CVE-2022-26809 Exploitation Attempt",
         "id": "a7cd7306-df8b-4398-b711-6f3e4935cf16",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious remote procedure call (RPC) service anomalies based on the spawned sub processes (long shot to detect the exploitation of vulnerabilities like CVE-2022-26809)",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -10909,7 +10909,7 @@
     {
         "title": "Potential Centos Web Panel Exploitation Attempt - CVE-2022-44877",
         "id": "1b2eeb27-949b-4704-8bfa-d8e5cfa045a1",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential exploitation attempts that target the Centos Web Panel 7 Unauthenticated Remote Code Execution CVE-2022-44877",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -11379,7 +11379,7 @@
         ],
         "level": "high",
         "rule": [
-            "SELECT * FROM logs WHERE (EventID = '1' AND Channel = 'Microsoft-Windows-Sysmon/Operational' AND ParentImage LIKE '%\\\\ws\\_tomcatservice.exe' ESCAPE '\\' AND Image LIKE '%\\\\repadmin.exe' ESCAPE '\\')"
+            "SELECT * FROM logs WHERE ((EventID = '1' AND Channel = 'Microsoft-Windows-Sysmon/Operational') AND ParentImage LIKE '%\\\\ws\\_tomcatservice.exe' ESCAPE '\\' AND NOT ((Image LIKE '%\\\\repadmin.exe' ESCAPE '\\')))"
         ],
         "filename": "proc_creation_win_apt_mint_sandstorm_log4j_wstomcat_execution.yml"
     },
@@ -12156,7 +12156,7 @@
     {
         "title": "Potential Exploitation Attempt Of Undocumented WindowsServer RCE",
         "id": "6d5b8176-d87d-4402-8af4-53aee9db7b5d",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential exploitation attempt of undocumented Windows Server Pre Auth Remote Code Execution (RCE)",
         "author": "Florian Roth (Nextron Systems), Nasreddine Bencherchali",
         "tags": [
@@ -13528,7 +13528,7 @@
     {
         "title": "Suspicious AppX Package Locations",
         "id": "5cdeaf3d-1489-477c-95ab-c318559fc051",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an appx package added the pipeline of the \"to be processed\" packages which is located in suspicious locations",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -15522,7 +15522,7 @@
     {
         "title": "DNS Query for Anonfiles.com Domain - DNS Client",
         "id": "29f171d7-aa47-42c7-9c7b-3c87938164d9",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects DNS queries for anonfiles.com, which is an anonymous file upload platform often used for malicious purposes",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -16712,7 +16712,7 @@
     {
         "title": "Restricted Software Access By SRP",
         "id": "b4c8da4a-1c12-46b0-8a2b-0a8521d03442",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects restricted access to applications by the Software Restriction Policies (SRP) policy",
         "author": "frack113",
         "tags": [
@@ -17444,7 +17444,7 @@
     {
         "title": "Renamed Plink Execution",
         "id": "1c12727d-02bf-45ff-a9f3-d49806a3cf43",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed version of the Plink binary",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -18056,7 +18056,7 @@
     {
         "title": "Potential Persistence Via Powershell Search Order Hijacking - Task",
         "id": "b66474aa-bd92-4333-a16c-298155b120df",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell \"Get-Variable\" technique as seen being used in Colibri Loader",
         "author": "pH-T (Nextron Systems), Florian Roth (Nextron Systems)",
         "tags": [
@@ -18351,7 +18351,7 @@
     {
         "title": "SQLite Chromium Profile Data DB Access",
         "id": "24c77512-782b-448a-8950-eddb0785fc71",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect usage of the \"sqlite\" binary to query databases in Chromium-based browsers for potential data stealing.",
         "author": "TropChaud",
         "tags": [
@@ -18690,7 +18690,7 @@
     {
         "title": "Renamed NetSupport RAT Execution",
         "id": "0afbd410-de03-4078-8491-f132303cb67d",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed \"client32.exe\" (NetSupport RAT) via Imphash, Product and OriginalFileName strings",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -19024,7 +19024,7 @@
     {
         "title": "HackTool - Inveigh Execution",
         "id": "b99a1518-1ad5-4f65-bc95-1ffff97a8fd0",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -19224,7 +19224,7 @@
     {
         "title": "Disabled RestrictedAdminMode For RDS - ProcCreation",
         "id": "28ac00d6-22d9-4a3c-927f-bbd770104573",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect activation of DisableRestrictedAdmin to disable RestrictedAdmin mode.\nRestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.\nThis prevents your credentials from being harvested during the initial connection process if the remote server has been compromise\n",
         "author": "frack113",
         "tags": [
@@ -19421,7 +19421,7 @@
     {
         "title": "HackTool - SafetyKatz Execution",
         "id": "b1876533-4ed5-4a83-90f3-b8645840a413",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the hacktool SafetyKatz via PE information and default Image name",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -19617,7 +19617,7 @@
     {
         "title": "Potential Renamed Rundll32 Execution",
         "id": "2569ed8c-1147-498a-9b8c-2ad3656b10ed",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when 'DllRegisterServer' is called in the commandline and the image is not rundll32. This could mean that the 'rundll32' utility has been renamed in order to avoid detection",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -19730,7 +19730,7 @@
     {
         "title": "PUA - DefenderCheck Execution",
         "id": "f0ca6c24-3225-47d5-b1f5-352bf07ecfa7",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of DefenderCheck, a tool to evaluate the signatures used in Microsoft Defender. It can be used to figure out the strings / byte chains used in Microsoft Defender to detect a tool and thus used for AV evasion.",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -19999,7 +19999,7 @@
     {
         "title": "Suspicious Hacktool Execution - Imphash",
         "id": "24e3e58a-646b-4b50-adef-02ef935b9fc8",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -20389,7 +20389,7 @@
     {
         "title": "Microsoft IIS Service Account Password Dumped",
         "id": "2d3cdeec-c0db-45b4-aa86-082f7eb75701",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords",
         "author": "Tim Rauch, Janantha Marasinghe",
         "tags": [
@@ -20880,7 +20880,7 @@
     {
         "title": "Potential WinAPI Calls Via CommandLine",
         "id": "ba3f5c1b-6272-4119-9dbd-0bc8d21c2702",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -20960,7 +20960,7 @@
     {
         "title": "PUA - Seatbelt Execution",
         "id": "38646daa-e78f-4ace-9de0-55547b2d30da",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -21023,7 +21023,7 @@
     {
         "title": "Potential Arbitrary Code Execution Via Node.EXE",
         "id": "6640f31c-01ad-49b5-beb5-83498a5cd8bd",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution node.exe which is shipped with multiple software such as VMware, Adobe...etc. In order to execute arbitrary code. For example to establish reverse shell as seen in Log4j attacks...etc",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -21224,7 +21224,7 @@
     {
         "title": "HackTool - SharPersist Execution",
         "id": "26488ad0-f9fd-4536-876f-52fea846a2e4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the hacktool SharPersist - used to deploy various different kinds of persistence mechanisms",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -21266,7 +21266,7 @@
     {
         "title": "Uncommon One Time Only Scheduled Task At 00:00",
         "id": "970823b7-273b-460a-8afc-3a6811998529",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects scheduled task creation events that include suspicious actions, and is run once at 00:00",
         "author": "pH-T (Nextron Systems)",
         "tags": [
@@ -21872,7 +21872,7 @@
     {
         "title": "Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE",
         "id": "07f8bdc2-c9b3-472a-9817-5a670b872f53",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of cmdkey to look for cached credentials on the system",
         "author": "jmallette, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -21948,7 +21948,7 @@
     {
         "title": "Operator Bloopers Cobalt Strike Modules",
         "id": "4f154fb6-27d1-4813-a759-78b93e0b9c48",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects Cobalt Strike module/commands accidentally entered in CMD shell",
         "author": "_pete_0, TheDFIRReport",
         "tags": [
@@ -22590,7 +22590,7 @@
     {
         "title": "HackTool - KrbRelayUp Execution",
         "id": "12827a56-61a4-476a-a9cb-f3068f191073",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -22941,7 +22941,7 @@
     {
         "title": "Disable Windows IIS HTTP Logging",
         "id": "e4ed6030-ffe5-4e6a-8a8a-ab3c1ab9d94e",
-        "status": "experimental",
+        "status": "test",
         "description": "Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union)",
         "author": "frack113",
         "tags": [
@@ -23678,7 +23678,7 @@
     {
         "title": "HackTool - KrbRelay Execution",
         "id": "e96253b8-6b3b-4f90-9e59-3b24b99cf9b4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of KrbRelay, a Kerberos relaying tool",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -23755,7 +23755,7 @@
     {
         "title": "HackTool - PowerTool Execution",
         "id": "a34f79a3-8e5f-4cc3-b765-de00695452c2",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the tool PowerTool which has the ability to kill a process, delete its process file, unload drivers, and delete the driver files",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -23852,7 +23852,7 @@
     {
         "title": "Potential Credential Dumping Attempt Using New NetworkProvider - CLI",
         "id": "baef1ec6-2ca9-47a3-97cc-4cf2bda10b77",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -23871,7 +23871,7 @@
     {
         "title": "Potential Recon Activity Via Nltest.EXE",
         "id": "5cc90652-4cbd-4241-aa3b-4b462fa5a248",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects nltest commands that can be used for information discovery",
         "author": "Craig Young, oscd.community, Georg Lauenstein",
         "tags": [
@@ -24086,7 +24086,7 @@
     {
         "title": "HackTool - SharpLdapWhoami Execution",
         "id": "d9367cbb-c2e0-47ce-bdc0-128cb6da898d",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -24127,7 +24127,7 @@
     {
         "title": "SafeBoot Registry Key Deleted Via Reg.EXE",
         "id": "fc0e89b5-adb0-43c1-b749-c12a10ec37de",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of \"reg.exe\" commands with the \"delete\" flag on safe boot registry keys. Often used by attacker to prevent safeboot execution of security products",
         "author": "Nasreddine Bencherchali (Nextron Systems), Tim Shelton",
         "tags": [
@@ -24203,7 +24203,7 @@
     {
         "title": "Suspicious Binary In User Directory Spawned From Office Application",
         "id": "aa3a6f94-890e-4e22-b634-ffdfd54792cc",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an executable in the users directory started from one of the Microsoft Office suite applications (Word, Excel, PowerPoint, Publisher, Visio)",
         "author": "Jason Lynch",
         "tags": [
@@ -24417,7 +24417,7 @@
     {
         "title": "Suspicious Hacktool Execution - PE Metadata",
         "id": "37c1333a-a0db-48be-b64b-7393b2386e3b",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -24743,7 +24743,7 @@
     {
         "title": "PowerShell Base64 Encoded WMI Classes",
         "id": "1816994b-42e1-4fb1-afd2-134d88184f71",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects calls to base64 encoded WMI class such as \"Win32_Shadowcopy\", \"Win32_ScheduledJob\", etc.",
         "author": "Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -24784,7 +24784,7 @@
     {
         "title": "HackTool - SysmonEOP Execution",
         "id": "8a7e90c5-fe6e-45dc-889e-057fe4378bd9",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -24804,7 +24804,7 @@
     {
         "title": "PUA - Fast Reverse Proxy (FRP) Execution",
         "id": "32410e29-5f94-4568-b6a3-d91a8adad863",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet.",
         "author": "frack113, Florian Roth",
         "tags": [
@@ -25091,7 +25091,7 @@
     {
         "title": "Operator Bloopers Cobalt Strike Commands",
         "id": "647c7b9e-d784-4fda-b9a0-45c565a7b729",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects use of Cobalt Strike commands accidentally entered in the CMD shell",
         "author": "_pete_0, TheDFIRReport",
         "tags": [
@@ -25244,7 +25244,7 @@
     {
         "title": "HackTool - HandleKatz LSASS Dumper Execution",
         "id": "ca621ba5-54ab-4035-9942-d378e6fcde3c",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -25681,7 +25681,7 @@
     {
         "title": "Suspicious Shells Spawn by Java Utility Keytool",
         "id": "90fb5e62-ca1f-4e22-b42e-cc521874c938",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation)",
         "author": "Andreas Hunkeler (@Karneades)",
         "tags": [
@@ -25701,7 +25701,7 @@
     {
         "title": "PUA - NPS Tunneling Tool Execution",
         "id": "68d37776-61db-42f5-bf54-27e87072d17e",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of NPS, a port forwarding and intranet penetration proxy server",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -25798,7 +25798,7 @@
     {
         "title": "Renamed Msdt.EXE Execution",
         "id": "bd1c6866-65fc-44b2-be51-5588fcff82b9",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed \"Msdt.exe\" binary",
         "author": "pH-T (Nextron Systems)",
         "tags": [
@@ -25836,7 +25836,7 @@
     {
         "title": "Execution from Suspicious Folder",
         "id": "3dfd06d2-eaf4-4532-9555-68aca59f57c4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects a suspicious execution from an uncommon folder",
         "author": "Florian Roth (Nextron Systems), Tim Shelton",
         "tags": [
@@ -25988,7 +25988,7 @@
     {
         "title": "Renamed Mavinject.EXE Execution",
         "id": "e6474a1b-5390-49cd-ab41-8d88655f7394",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed version of the \"Mavinject\" process. Which can be abused to perform process injection using the \"/INJECTRUNNING\" flag",
         "author": "frack113, Florian Roth",
         "tags": [
@@ -26694,7 +26694,7 @@
     {
         "title": "Potential PowerShell Execution Policy Tampering - ProcCreation",
         "id": "cf2e938e-9a3e-4fe8-a347-411642b28a9f",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects changes to the PowerShell execution policy registry key in order to bypass signing requirements for script execution from the CommandLine",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -26712,7 +26712,7 @@
     {
         "title": "Renamed BrowserCore.EXE Execution",
         "id": "8a4519e8-e64a-40b6-ae85-ba8ad2177559",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects process creation with a renamed BrowserCore.exe (used to extract Azure tokens)",
         "author": "Max Altgelt (Nextron Systems)",
         "tags": [
@@ -26973,7 +26973,7 @@
     {
         "title": "Renamed Vmnat.exe Execution",
         "id": "7b4f794b-590a-4ad4-ba18-7964a2832205",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects renamed vmnat.exe or portable version that can be used for DLL side-loading",
         "author": "elhoim",
         "tags": [
@@ -26992,7 +26992,7 @@
     {
         "title": "Renamed Sysinternals Sdelete Execution",
         "id": "c1d867fe-8d95-4487-aab4-e53f2d339f90",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of a renamed SysInternals Sdelete, which is something an administrator shouldn't do (the renaming)",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -27184,7 +27184,7 @@
     {
         "title": "Potential Signing Bypass Via Windows Developer Features",
         "id": "a383dec4-deec-4e6e-913b-ed9249670848",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when a user enable developer features such as \"Developer Mode\" or \"Application Sideloading\". Which allows the user to install untrusted packages.",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -27339,7 +27339,7 @@
     {
         "title": "Root Certificate Installed From Susp Locations",
         "id": "5f6a601c-2ecb-498b-9c33-660362323afa",
-        "status": "experimental",
+        "status": "test",
         "description": "Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -27358,7 +27358,7 @@
     {
         "title": "Potential Process Injection Via Msra.EXE",
         "id": "744a188b-0415-4792-896f-11ddb0588dbc",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential process injection via Microsoft Remote Asssistance (Msra.exe) by looking at suspicious child processes spawned from the aforementioned process. It has been a target used by many threat actors and used for discovery and persistence tactics",
         "author": "Alexander McDonald",
         "tags": [
@@ -27700,7 +27700,7 @@
     {
         "title": "Potential RDP Tunneling Via SSH",
         "id": "f7d7ebd5-a016-46e2-9c54-f9932f2d386d",
-        "status": "experimental",
+        "status": "test",
         "description": "Execution of ssh.exe to perform data exfiltration and tunneling through RDP",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -27856,7 +27856,7 @@
     {
         "title": "Service Registry Key Deleted Via Reg.EXE",
         "id": "05b2aa93-1210-42c8-8d9a-2fcc13b284f5",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of \"reg.exe\" commands with the \"delete\" flag on services registry key. Often used by attacker to remove AV software services",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -28011,7 +28011,7 @@
     {
         "title": "HackTool - Htran/NATBypass Execution",
         "id": "f5e3b62f-e577-4e59-931e-0a15b2b94e1e",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass)",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -28031,7 +28031,7 @@
     {
         "title": "SQLite Firefox Profile Data DB Access",
         "id": "4833155a-4053-4c9c-a997-777fcea0baa7",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect usage of the \"sqlite\" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.",
         "author": "frack113",
         "tags": [
diff --git a/rules/rules_windows_sysmon_full.json b/rules/rules_windows_sysmon_full.json
index 7ff02db..1a2d408 100644
--- a/rules/rules_windows_sysmon_full.json
+++ b/rules/rules_windows_sysmon_full.json
@@ -3488,7 +3488,7 @@
     {
         "title": "Potential PendingFileRenameOperations Tamper",
         "id": "4eec988f-7bf0-49f1-8675-1e6a510b3a2a",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect changes to the \"PendingFileRenameOperations\" registry key from uncommon or suspicious images lcoations to stage currently used files for rename after reboot.",
         "author": "frack113",
         "tags": [
@@ -3841,7 +3841,7 @@
     {
         "title": "Atbroker Registry Change",
         "id": "9577edbb-851f-4243-8c91-1d5b50c1a39b",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'",
         "author": "Mateusz Wydra, oscd.community",
         "tags": [
@@ -4764,7 +4764,7 @@
     {
         "title": "Potential Svchost Memory Access",
         "id": "166e9c50-8cd9-44af-815d-d1f0c0e90dde",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential access to svchost process memory such as that used by Invoke-Phantom to kill the winRM Windows event logging service.",
         "author": "Tim Burrell",
         "tags": [
@@ -5511,7 +5511,7 @@
     {
         "title": "Suspicious PowerShell Download - PoshModule",
         "id": "de41232e-12e8-49fa-86bc-c05c7e722df9",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious PowerShell download command",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -5589,7 +5589,7 @@
     {
         "title": "Malicious PowerShell Scripts - PoshModule",
         "id": "41025fd7-0466-4650-a813-574aaacbe7f4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of known offensive powershell scripts used for exploitation or reconnaissance",
         "author": "frack113, Nasreddine Bencherchali",
         "tags": [
@@ -5650,7 +5650,7 @@
     {
         "title": "Potential Active Directory Enumeration Using AD Module - PsModule",
         "id": "74176142-4684-4d8a-8b0a-713257e7df8e",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of the \"Import-Module\" cmdlet to load the \"Microsoft.ActiveDirectory.Management.dl\" DLL. Which is often used by attackers to perform AD enumeration.",
         "author": "Nasreddine Bencherchali (Nextron Systems), frack113",
         "tags": [
@@ -6781,7 +6781,7 @@
     {
         "title": "Usage Of Web Request Commands And Cmdlets - ScriptBlock",
         "id": "1139d2e2-84b1-4226-b445-354492eba8ba",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via PowerShell scriptblock logs",
         "author": "James Pemberton / @4A616D6573",
         "tags": [
@@ -7277,7 +7277,7 @@
     {
         "title": "Unsigned AppX Installation Attempt Using Add-AppxPackage - PsScript",
         "id": "975b2262-9a49-439d-92a6-0709cccdf0b2",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of the \"Add-AppxPackage\" or it's alias \"Add-AppPackage\" to install unsigned AppX packages",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -7659,7 +7659,7 @@
     {
         "title": "Import PowerShell Modules From Suspicious Directories",
         "id": "21f9162c-5f5d-4b01-89a8-b705bd7d10ab",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects powershell scripts that import modules from suspicious directories",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -7984,7 +7984,7 @@
     {
         "title": "Potential Data Exfiltration Via Audio File",
         "id": "e4f93c99-396f-47c8-bb0f-201b1fa69034",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential exfiltration attempt via audio file using PowerShell",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -8117,7 +8117,7 @@
     {
         "title": "Powershell XML Execute Command",
         "id": "6c6c6282-7671-4fe9-a0ce-a2dcebdc342b",
-        "status": "experimental",
+        "status": "test",
         "description": "Adversaries may abuse PowerShell commands and scripts for execution.\nPowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell)\nAdversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code\n",
         "author": "frack113",
         "tags": [
@@ -8815,7 +8815,7 @@
     {
         "title": "Potential PowerShell Obfuscation Using Alias Cmdlets",
         "id": "96cd126d-f970-49c4-848a-da3a09f55c55",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects Set-Alias or New-Alias cmdlet usage. Which can be use as a mean to obfuscate PowerShell scripts",
         "author": "frack113",
         "tags": [
@@ -8893,7 +8893,7 @@
     {
         "title": "Potential Active Directory Enumeration Using AD Module - PsScript",
         "id": "9e620995-f2d8-4630-8430-4afd89f77604",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of the \"Import-Module\" cmdlet to load the \"Microsoft.ActiveDirectory.Management.dl\" DLL. Which is often used by attackers to perform AD enumeration.",
         "author": "frack113, Nasreddine Bencherchali",
         "tags": [
@@ -9008,7 +9008,7 @@
     {
         "title": "Potential PowerShell Obfuscation Using Character Join",
         "id": "e8314f79-564d-4f79-bc13-fbc0bf2660d8",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects specific techniques often seen used inside of PowerShell scripts to obfscuate Alias creation",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -9187,7 +9187,7 @@
     {
         "title": "Malicious Nishang PowerShell Commandlets",
         "id": "f772cee9-b7c2-4cb2-8f07-49870adc02e0",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects Commandlet names and arguments from the Nishang exploitation framework",
         "author": "Alec Costello",
         "tags": [
@@ -9203,25 +9203,6 @@
         ],
         "filename": "posh_ps_nishang_malicious_commandlets.yml"
     },
-    {
-        "title": "Suspicious DNS Query for IP Lookup Service APIs",
-        "id": "ec82e2a5-81ea-4211-a1f8-37a0286df2c2",
-        "status": "test",
-        "description": "Detects DNS queries for IP lookup services such as \"api.ipify.org\" originating from a non browser process.",
-        "author": "Brandon George (blog post), Thomas Patzke",
-        "tags": [
-            "attack.reconnaissance",
-            "attack.t1590"
-        ],
-        "falsepositives": [
-            "Legitimate usage of IP lookup services such as ipify API"
-        ],
-        "level": "medium",
-        "rule": [
-            "SELECT * FROM logs WHERE ((EventID = '22' AND Channel = 'Microsoft-Windows-Sysmon/Operational') AND (QueryName LIKE '%api.2ip.ua%' ESCAPE '\\' OR QueryName LIKE '%api.ipify.org%' ESCAPE '\\' OR QueryName LIKE '%bot.whatismyipaddress.com%' ESCAPE '\\' OR QueryName LIKE '%canireachthe.net%' ESCAPE '\\' OR QueryName LIKE '%checkip.amazonaws.com%' ESCAPE '\\' OR QueryName LIKE '%checkip.dyndns.org%' ESCAPE '\\' OR QueryName LIKE '%curlmyip.com%' ESCAPE '\\' OR QueryName LIKE '%edns.ip-api.com%' ESCAPE '\\' OR QueryName LIKE '%eth0.me%' ESCAPE '\\' OR QueryName LIKE '%freegeoip.app%' ESCAPE '\\' OR QueryName LIKE '%geoipy.com%' ESCAPE '\\' OR QueryName LIKE '%getip.pro%' ESCAPE '\\' OR QueryName LIKE '%icanhazip.com%' ESCAPE '\\' OR QueryName LIKE '%ident.me%' ESCAPE '\\' OR QueryName LIKE '%ifconfig.io%' ESCAPE '\\' OR QueryName LIKE '%ifconfig.me%' ESCAPE '\\' OR QueryName LIKE '%ip-api.com%' ESCAPE '\\' OR QueryName LIKE '%ip.anysrc.net%' ESCAPE '\\' OR QueryName LIKE '%ip.tyk.nu%' ESCAPE '\\' OR QueryName LIKE '%ipaddressworld.com%' ESCAPE '\\' OR QueryName LIKE '%ipecho.net%' ESCAPE '\\' OR QueryName LIKE '%ipinfo.io%' ESCAPE '\\' OR QueryName LIKE '%ipof.in%' ESCAPE '\\' OR QueryName LIKE '%ipv4.icanhazip.com%' ESCAPE '\\' OR QueryName LIKE '%ipv4bot.whatismyipaddress.com%' ESCAPE '\\' OR QueryName LIKE '%ipwho.is%' ESCAPE '\\' OR QueryName LIKE '%l2.io%' ESCAPE '\\' OR QueryName LIKE '%myexternalip.com%' ESCAPE '\\' OR QueryName LIKE '%wgetip.com%' ESCAPE '\\' OR QueryName LIKE '%whatismyip.akamai.com%' ESCAPE '\\' OR QueryName LIKE '%wtfismyip.com%' ESCAPE '\\') AND NOT ((Image LIKE '%\\\\brave.exe' ESCAPE '\\') OR ((Image LIKE 'C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files (x86)\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\')) OR ((Image LIKE 'C:\\\\Program Files\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\')) OR ((Image LIKE 'C:\\\\Program Files (x86)\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\')) OR (Image LIKE '%\\\\maxthon.exe' ESCAPE '\\') OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\%' ESCAPE '\\' OR Image LIKE '%\\\\WindowsApps\\\\MicrosoftEdge.exe' ESCAPE '\\' OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\')) OR ((Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\') AND (Image LIKE '%\\\\msedge.exe' ESCAPE '\\' OR Image LIKE '%\\\\msedgewebview2.exe' ESCAPE '\\')) OR (Image LIKE '%\\\\opera.exe' ESCAPE '\\') OR (Image LIKE '%\\\\safari.exe' ESCAPE '\\') OR (Image LIKE '%\\\\seamonkey.exe' ESCAPE '\\') OR (Image LIKE '%\\\\vivaldi.exe' ESCAPE '\\') OR (Image LIKE '%\\\\whale.exe' ESCAPE '\\')))"
-        ],
-        "filename": "dns_query_win_susp_ipify.yml"
-    },
     {
         "title": "DNS Query Request By Regsvr32.EXE",
         "id": "36e037c4-c228-4866-b6a3-48eb292b9955",
@@ -9323,7 +9304,7 @@
     {
         "title": "DNS Query for Anonfiles.com Domain - Sysmon",
         "id": "065cceea-77ec-4030-9052-fc0affea7110",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects DNS queries for \"anonfiles.com\", which is an anonymous file upload platform often used for malicious purposes",
         "author": "pH-T (Nextron Systems)",
         "tags": [
@@ -9453,6 +9434,25 @@
         ],
         "filename": "dns_query_win_vscode_tunnel_communication.yml"
     },
+    {
+        "title": "Suspicious DNS Query for IP Lookup Service APIs",
+        "id": "ec82e2a5-81ea-4211-a1f8-37a0286df2c2",
+        "status": "test",
+        "description": "Detects DNS queries for IP lookup services such as \"api.ipify.org\" originating from a non browser process.",
+        "author": "Brandon George (blog post), Thomas Patzke",
+        "tags": [
+            "attack.reconnaissance",
+            "attack.t1590"
+        ],
+        "falsepositives": [
+            "Legitimate usage of IP lookup services such as ipify API"
+        ],
+        "level": "medium",
+        "rule": [
+            "SELECT * FROM logs WHERE ((EventID = '22' AND Channel = 'Microsoft-Windows-Sysmon/Operational') AND (QueryName LIKE '%api.2ip.ua%' ESCAPE '\\' OR QueryName LIKE '%api.bigdatacloud.net%' ESCAPE '\\' OR QueryName LIKE '%api.ipify.org%' ESCAPE '\\' OR QueryName LIKE '%bot.whatismyipaddress.com%' ESCAPE '\\' OR QueryName LIKE '%canireachthe.net%' ESCAPE '\\' OR QueryName LIKE '%checkip.amazonaws.com%' ESCAPE '\\' OR QueryName LIKE '%checkip.dyndns.org%' ESCAPE '\\' OR QueryName LIKE '%curlmyip.com%' ESCAPE '\\' OR QueryName LIKE '%db-ip.com%' ESCAPE '\\' OR QueryName LIKE '%edns.ip-api.com%' ESCAPE '\\' OR QueryName LIKE '%eth0.me%' ESCAPE '\\' OR QueryName LIKE '%freegeoip.app%' ESCAPE '\\' OR QueryName LIKE '%geoipy.com%' ESCAPE '\\' OR QueryName LIKE '%getip.pro%' ESCAPE '\\' OR QueryName LIKE '%icanhazip.com%' ESCAPE '\\' OR QueryName LIKE '%ident.me%' ESCAPE '\\' OR QueryName LIKE '%ifconfig.io%' ESCAPE '\\' OR QueryName LIKE '%ifconfig.me%' ESCAPE '\\' OR QueryName LIKE '%ipapi.co%' ESCAPE '\\' OR QueryName LIKE '%ip-api.com%' ESCAPE '\\' OR QueryName LIKE '%ip.anysrc.net%' ESCAPE '\\' OR QueryName LIKE '%ip.tyk.nu%' ESCAPE '\\' OR QueryName LIKE '%ipaddressworld.com%' ESCAPE '\\' OR QueryName LIKE '%ipecho.net%' ESCAPE '\\' OR QueryName LIKE '%ipinfo.io%' ESCAPE '\\' OR QueryName LIKE '%ipof.in%' ESCAPE '\\' OR QueryName LIKE '%ipv4.icanhazip.com%' ESCAPE '\\' OR QueryName LIKE '%ipv4bot.whatismyipaddress.com%' ESCAPE '\\' OR QueryName LIKE '%ipwho.is%' ESCAPE '\\' OR QueryName LIKE '%l2.io%' ESCAPE '\\' OR QueryName LIKE '%myexternalip.com%' ESCAPE '\\' OR QueryName LIKE '%wgetip.com%' ESCAPE '\\' OR QueryName LIKE '%whatismyip.akamai.com%' ESCAPE '\\' OR QueryName LIKE '%wtfismyip.com%' ESCAPE '\\') AND NOT ((Image LIKE '%\\\\brave.exe' ESCAPE '\\') OR ((Image LIKE 'C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files (x86)\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\')) OR ((Image LIKE 'C:\\\\Program Files\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\')) OR ((Image LIKE 'C:\\\\Program Files (x86)\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\')) OR (Image LIKE '%\\\\maxthon.exe' ESCAPE '\\') OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\%' ESCAPE '\\' OR Image LIKE '%\\\\WindowsApps\\\\MicrosoftEdge.exe' ESCAPE '\\' OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\')) OR ((Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\') AND (Image LIKE '%\\\\msedge.exe' ESCAPE '\\' OR Image LIKE '%\\\\msedgewebview2.exe' ESCAPE '\\')) OR (Image LIKE '%\\\\opera.exe' ESCAPE '\\') OR (Image LIKE '%\\\\safari.exe' ESCAPE '\\') OR (Image LIKE '%\\\\seamonkey.exe' ESCAPE '\\') OR (Image LIKE '%\\\\vivaldi.exe' ESCAPE '\\') OR (Image LIKE '%\\\\whale.exe' ESCAPE '\\')))"
+        ],
+        "filename": "dns_query_win_susp_external_ip_lookup.yml"
+    },
     {
         "title": "DNS Query Tor .Onion Address - Sysmon",
         "id": "b55ca2a3-7cff-4dda-8bdd-c7bfa63bf544",
@@ -11303,7 +11303,7 @@
     {
         "title": "Potential DLL Sideloading Of Non-Existent DLLs From System Folders",
         "id": "6b98b92b-4f00-4f62-b4fe-4d1920215771",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects DLL sideloading of system dlls that are not present on the system by default. Usually to achieve techniques such as UAC bypass and privilege escalation",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -11424,6 +11424,28 @@
         ],
         "filename": "registry_set_office_trusted_location.yml"
     },
+    {
+        "title": "Registry Set With Crypto-Classes From The \"Cryptography\" PowerShell Namespace",
+        "id": "1c2a3268-3881-414a-80af-a5b313b14c0e",
+        "status": "experimental",
+        "description": "Detects the setting of a registry inside the \"\\Shell\\Open\\Command\" value with PowerShell classes from the \"System.Security.Cryptography\" namespace.\nThe PowerShell namespace \"System.Security.Cryptography\" provides classes for on-the-fly encryption and decryption.\nThese can be used for example in decrypting malicious payload for defense evasion.\n",
+        "author": "Andreas Braathen (mnemonic.io)",
+        "tags": [
+            "attack.defense_evasion",
+            "attack.t1059.001",
+            "attack.t1027.010",
+            "attack.t1547.001",
+            "detection.threat_hunting"
+        ],
+        "falsepositives": [
+            "Classes are legitimately used, but less so when e.g. parents with low prevalence or decryption of content in temporary folders."
+        ],
+        "level": "medium",
+        "rule": [
+            "SELECT * FROM logs WHERE (EventID = '13' AND Channel = 'Microsoft-Windows-Sysmon/Operational' AND EventType = 'SetValue' AND TargetObject LIKE '%\\\\Shell\\\\Open\\\\Command%' ESCAPE '\\' AND (Details LIKE '%powershell%' ESCAPE '\\' OR Details LIKE '%pwsh%' ESCAPE '\\') AND Details LIKE '%System.Security.Cryptography.%' ESCAPE '\\' AND (Details LIKE '%.AesCryptoServiceProvider%' ESCAPE '\\' OR Details LIKE '%.DESCryptoServiceProvider%' ESCAPE '\\' OR Details LIKE '%.DSACryptoServiceProvider%' ESCAPE '\\' OR Details LIKE '%.RC2CryptoServiceProvider%' ESCAPE '\\' OR Details LIKE '%.Rijndael%' ESCAPE '\\' OR Details LIKE '%.RSACryptoServiceProvider%' ESCAPE '\\' OR Details LIKE '%.TripleDESCryptoServiceProvider%' ESCAPE '\\'))"
+        ],
+        "filename": "registry_set_powershell_crypto_namespace.yml"
+    },
     {
         "title": "Scheduled Task Created - Registry",
         "id": "93ff0ceb-e0ef-4586-8cd8-a6c277d738e3",
@@ -11783,7 +11805,7 @@
     {
         "title": "Scheduled Task Deletion",
         "id": "4f86b304-3e02-40e3-aa5d-e88a167c9617",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects scheduled task deletion events. Scheduled tasks are likely to be deleted if not used for persistence. Malicious Software often creates tasks directly under the root node e.g. \\TASKNAME",
         "author": "David Strassegger, Tim Shelton",
         "tags": [
@@ -12168,6 +12190,27 @@
         ],
         "filename": "proc_creation_win_susp_file_permission_modifications.yml"
     },
+    {
+        "title": "Invocation Of Crypto-Classes From The \"Cryptography\" PowerShell Namespace",
+        "id": "ad856965-f44d-42a8-945e-bbf7bd03d05a",
+        "status": "experimental",
+        "description": "Detects the invocation of PowerShell commands with references to classes from the \"System.Security.Cryptography\" namespace.\nThe PowerShell namespace \"System.Security.Cryptography\" provides classes for on-the-fly encryption and decryption.\nThese can be used for example in decrypting malicious payload for defense evasion.\n",
+        "author": "Andreas Braathen (mnemonic.io)",
+        "tags": [
+            "attack.defense_evasion",
+            "attack.t1059.001",
+            "attack.t1027.010",
+            "detection.threat_hunting"
+        ],
+        "falsepositives": [
+            "Classes are legitimately used, but less so when e.g. parents with low prevalence or decryption of content in temporary folders."
+        ],
+        "level": "medium",
+        "rule": [
+            "SELECT * FROM logs WHERE ((EventID = '1' AND Channel = 'Microsoft-Windows-Sysmon/Operational') AND ((Image LIKE '%\\\\powershell.exe' ESCAPE '\\' OR Image LIKE '%\\\\pwsh.exe' ESCAPE '\\') OR OriginalFileName IN ('PowerShell.EXE', 'pwsh.dll')) AND CommandLine LIKE '%System.Security.Cryptography.%' ESCAPE '\\' AND (CommandLine LIKE '%.AesCryptoServiceProvider%' ESCAPE '\\' OR CommandLine LIKE '%.DESCryptoServiceProvider%' ESCAPE '\\' OR CommandLine LIKE '%.DSACryptoServiceProvider%' ESCAPE '\\' OR CommandLine LIKE '%.RC2CryptoServiceProvider%' ESCAPE '\\' OR CommandLine LIKE '%.Rijndael%' ESCAPE '\\' OR CommandLine LIKE '%.RSACryptoServiceProvider%' ESCAPE '\\' OR CommandLine LIKE '%.TripleDESCryptoServiceProvider%' ESCAPE '\\'))"
+        ],
+        "filename": "proc_creation_win_powershell_crypto_namespace.yml"
+    },
     {
         "title": "ClickOnce Deployment Execution - Dfsvc.EXE Child Process",
         "id": "241d52b5-eee0-49d0-ac8a-8b9c15c7221c",
@@ -13563,7 +13606,7 @@
     {
         "title": "Suspicious Startup Folder Persistence",
         "id": "28208707-fe31-437f-9a7f-4b1108b94d2e",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when a file with a suspicious extension is created in the startup folder",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -15186,7 +15229,7 @@
     {
         "title": "VsCode Powershell Profile Modification",
         "id": "3a9fa2ec-30bc-4ebd-b49e-7c9cff225502",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the creation or modification of a vscode related powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -18214,7 +18257,7 @@
     {
         "title": "Potential Exploitation Attempt From Office Application",
         "id": "868955d9-697e-45d4-a3da-360cefd7c216",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects Office applications executing a child process that includes directory traversal patterns. This could be an attempt to exploit CVE-2022-30190 (MSDT RCE) or CVE-2021-40444 (MSHTML RCE)",
         "author": "Christian Burkard (Nextron Systems), @SBousseaden (idea)",
         "tags": [
@@ -19155,7 +19198,7 @@
     {
         "title": "Potential CVE-2022-26809 Exploitation Attempt",
         "id": "a7cd7306-df8b-4398-b711-6f3e4935cf16",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious remote procedure call (RPC) service anomalies based on the spawned sub processes (long shot to detect the exploitation of vulnerabilities like CVE-2022-26809)",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -19261,7 +19304,7 @@
     {
         "title": "Potential Centos Web Panel Exploitation Attempt - CVE-2022-44877",
         "id": "1b2eeb27-949b-4704-8bfa-d8e5cfa045a1",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential exploitation attempts that target the Centos Web Panel 7 Unauthenticated Remote Code Execution CVE-2022-44877",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -19750,7 +19793,7 @@
         ],
         "level": "high",
         "rule": [
-            "SELECT * FROM logs WHERE (EventID = '1' AND Channel = 'Microsoft-Windows-Sysmon/Operational' AND ParentImage LIKE '%\\\\ws\\_tomcatservice.exe' ESCAPE '\\' AND Image LIKE '%\\\\repadmin.exe' ESCAPE '\\')"
+            "SELECT * FROM logs WHERE ((EventID = '1' AND Channel = 'Microsoft-Windows-Sysmon/Operational') AND ParentImage LIKE '%\\\\ws\\_tomcatservice.exe' ESCAPE '\\' AND NOT ((Image LIKE '%\\\\repadmin.exe' ESCAPE '\\')))"
         ],
         "filename": "proc_creation_win_apt_mint_sandstorm_log4j_wstomcat_execution.yml"
     },
@@ -20777,7 +20820,7 @@
     {
         "title": "Potential Exploitation Attempt Of Undocumented WindowsServer RCE",
         "id": "6d5b8176-d87d-4402-8af4-53aee9db7b5d",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential exploitation attempt of undocumented Windows Server Pre Auth Remote Code Execution (RCE)",
         "author": "Florian Roth (Nextron Systems), Nasreddine Bencherchali",
         "tags": [
@@ -22311,7 +22354,7 @@
     {
         "title": "Deployment Of The AppX Package Was Blocked By The Policy",
         "id": "e021bbb5-407f-41f5-9dc9-1864c45a7a51",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an appx package deployment that was blocked by the local computer policy",
         "author": "frack113",
         "tags": [
@@ -22329,7 +22372,7 @@
     {
         "title": "Suspicious AppX Package Locations",
         "id": "5cdeaf3d-1489-477c-95ab-c318559fc051",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an appx package added the pipeline of the \"to be processed\" packages which is located in suspicious locations",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -22365,7 +22408,7 @@
     {
         "title": "Deployment AppX Package Was Blocked By AppLocker",
         "id": "6ae53108-c3a0-4bee-8f45-c7591a2c337f",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an appx package deployment that was blocked by AppLocker policy",
         "author": "frack113",
         "tags": [
@@ -22383,7 +22426,7 @@
     {
         "title": "Suspicious AppX Package Installation Attempt",
         "id": "898d5fc9-fbc3-43de-93ad-38e97237c344",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an appx package installation with the error code \"0x80073cff\" which indicates that the package didn't meet the signing requirements and could be suspicious",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -22401,7 +22444,7 @@
     {
         "title": "Uncommon AppX Package Locations",
         "id": "c977cb50-3dff-4a9f-b873-9290f56132f1",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an appx package added the pipeline of the \"to be processed\" packages which is located in uncommon locations",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -22419,7 +22462,7 @@
     {
         "title": "Potential Malicious AppX Package Installation Attempts",
         "id": "09d3b48b-be17-47f5-bf4e-94e7e75d09ce",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential installation or installation attempts of known malicious appx packages",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -22849,7 +22892,7 @@
     {
         "title": "Suspicious Digital Signature Of AppX Package",
         "id": "b5aa7d60-c17e-4538-97de-09029d6cd76b",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of AppX packages with known suspicious or malicious signature",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -25940,7 +25983,7 @@
     {
         "title": "DNS Query for Anonfiles.com Domain - DNS Client",
         "id": "29f171d7-aa47-42c7-9c7b-3c87938164d9",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects DNS queries for anonfiles.com, which is an anonymous file upload platform often used for malicious purposes",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -27956,7 +27999,7 @@
     {
         "title": "Restricted Software Access By SRP",
         "id": "b4c8da4a-1c12-46b0-8a2b-0a8521d03442",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects restricted access to applications by the Software Restriction Policies (SRP) policy",
         "author": "frack113",
         "tags": [
@@ -28132,7 +28175,7 @@
     {
         "title": "The Windows Defender Firewall Service Failed To Load Group Policy",
         "id": "7ec15688-fd24-4177-ba43-1a950537ee39",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects activity when The Windows Defender Firewall service failed to load Group Policy",
         "author": "frack113",
         "tags": [
@@ -28808,7 +28851,7 @@
         ],
         "level": "medium",
         "rule": [
-            "SELECT * FROM logs WHERE ((EventID = '3' AND Channel = 'Microsoft-Windows-Sysmon/Operational') AND (DestinationHostname LIKE '%api.2ip.ua%' ESCAPE '\\' OR DestinationHostname LIKE '%api.ipify.org%' ESCAPE '\\' OR DestinationHostname LIKE '%bot.whatismyipaddress.com%' ESCAPE '\\' OR DestinationHostname LIKE '%canireachthe.net%' ESCAPE '\\' OR DestinationHostname LIKE '%checkip.amazonaws.com%' ESCAPE '\\' OR DestinationHostname LIKE '%checkip.dyndns.org%' ESCAPE '\\' OR DestinationHostname LIKE '%curlmyip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%edns.ip-api.com%' ESCAPE '\\' OR DestinationHostname LIKE '%eth0.me%' ESCAPE '\\' OR DestinationHostname LIKE '%freegeoip.app%' ESCAPE '\\' OR DestinationHostname LIKE '%geoipy.com%' ESCAPE '\\' OR DestinationHostname LIKE '%getip.pro%' ESCAPE '\\' OR DestinationHostname LIKE '%icanhazip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ident.me%' ESCAPE '\\' OR DestinationHostname LIKE '%ifconfig.io%' ESCAPE '\\' OR DestinationHostname LIKE '%ifconfig.me%' ESCAPE '\\' OR DestinationHostname LIKE '%ip-api.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ip.anysrc.net%' ESCAPE '\\' OR DestinationHostname LIKE '%ip.tyk.nu%' ESCAPE '\\' OR DestinationHostname LIKE '%ipaddressworld.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ipecho.net%' ESCAPE '\\' OR DestinationHostname LIKE '%ipinfo.io%' ESCAPE '\\' OR DestinationHostname LIKE '%ipof.in%' ESCAPE '\\' OR DestinationHostname LIKE '%ipv4.icanhazip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ipv4bot.whatismyipaddress.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ipwho.is%' ESCAPE '\\' OR DestinationHostname LIKE '%l2.io%' ESCAPE '\\' OR DestinationHostname LIKE '%myexternalip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%wgetip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%whatismyip.akamai.com%' ESCAPE '\\' OR DestinationHostname LIKE '%wtfismyip.com%' ESCAPE '\\') AND NOT ((Image LIKE '%\\\\brave.exe' ESCAPE '\\') OR ((Image LIKE 'C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files (x86)\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\')) OR ((Image LIKE 'C:\\\\Program Files\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\')) OR ((Image LIKE 'C:\\\\Program Files (x86)\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\')) OR (Image LIKE '%\\\\maxthon.exe' ESCAPE '\\') OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\%' ESCAPE '\\' OR Image LIKE '%\\\\WindowsApps\\\\MicrosoftEdge.exe' ESCAPE '\\' OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\')) OR ((Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\') AND (Image LIKE '%\\\\msedge.exe' ESCAPE '\\' OR Image LIKE '%\\\\msedgewebview2.exe' ESCAPE '\\')) OR (Image LIKE '%\\\\opera.exe' ESCAPE '\\') OR (Image LIKE '%\\\\safari.exe' ESCAPE '\\') OR (Image LIKE '%\\\\seamonkey.exe' ESCAPE '\\') OR (Image LIKE '%\\\\vivaldi.exe' ESCAPE '\\') OR (Image LIKE '%\\\\whale.exe' ESCAPE '\\')))"
+            "SELECT * FROM logs WHERE ((EventID = '3' AND Channel = 'Microsoft-Windows-Sysmon/Operational') AND (DestinationHostname LIKE '%api.2ip.ua%' ESCAPE '\\' OR DestinationHostname LIKE '%api.bigdatacloud.net%' ESCAPE '\\' OR DestinationHostname LIKE '%api.ipify.org%' ESCAPE '\\' OR DestinationHostname LIKE '%bot.whatismyipaddress.com%' ESCAPE '\\' OR DestinationHostname LIKE '%canireachthe.net%' ESCAPE '\\' OR DestinationHostname LIKE '%checkip.amazonaws.com%' ESCAPE '\\' OR DestinationHostname LIKE '%checkip.dyndns.org%' ESCAPE '\\' OR DestinationHostname LIKE '%curlmyip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%db-ip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%edns.ip-api.com%' ESCAPE '\\' OR DestinationHostname LIKE '%eth0.me%' ESCAPE '\\' OR DestinationHostname LIKE '%freegeoip.app%' ESCAPE '\\' OR DestinationHostname LIKE '%geoipy.com%' ESCAPE '\\' OR DestinationHostname LIKE '%getip.pro%' ESCAPE '\\' OR DestinationHostname LIKE '%icanhazip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ident.me%' ESCAPE '\\' OR DestinationHostname LIKE '%ifconfig.io%' ESCAPE '\\' OR DestinationHostname LIKE '%ifconfig.me%' ESCAPE '\\' OR DestinationHostname LIKE '%ipapi.co%' ESCAPE '\\' OR DestinationHostname LIKE '%ip-api.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ip.anysrc.net%' ESCAPE '\\' OR DestinationHostname LIKE '%ip.tyk.nu%' ESCAPE '\\' OR DestinationHostname LIKE '%ipaddressworld.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ipecho.net%' ESCAPE '\\' OR DestinationHostname LIKE '%ipinfo.io%' ESCAPE '\\' OR DestinationHostname LIKE '%ipof.in%' ESCAPE '\\' OR DestinationHostname LIKE '%ipv4.icanhazip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ipv4bot.whatismyipaddress.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ipwho.is%' ESCAPE '\\' OR DestinationHostname LIKE '%l2.io%' ESCAPE '\\' OR DestinationHostname LIKE '%myexternalip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%wgetip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%whatismyip.akamai.com%' ESCAPE '\\' OR DestinationHostname LIKE '%wtfismyip.com%' ESCAPE '\\') AND NOT ((Image LIKE '%\\\\brave.exe' ESCAPE '\\') OR ((Image LIKE 'C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files (x86)\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\')) OR ((Image LIKE 'C:\\\\Program Files\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\')) OR ((Image LIKE 'C:\\\\Program Files (x86)\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\')) OR (Image LIKE '%\\\\maxthon.exe' ESCAPE '\\') OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\%' ESCAPE '\\' OR Image LIKE '%\\\\WindowsApps\\\\MicrosoftEdge.exe' ESCAPE '\\' OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\')) OR ((Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\') AND (Image LIKE '%\\\\msedge.exe' ESCAPE '\\' OR Image LIKE '%\\\\msedgewebview2.exe' ESCAPE '\\')) OR (Image LIKE '%\\\\opera.exe' ESCAPE '\\') OR (Image LIKE '%\\\\safari.exe' ESCAPE '\\') OR (Image LIKE '%\\\\seamonkey.exe' ESCAPE '\\') OR (Image LIKE '%\\\\vivaldi.exe' ESCAPE '\\') OR (Image LIKE '%\\\\whale.exe' ESCAPE '\\')))"
         ],
         "filename": "net_connection_win_susp_external_ip_lookup.yml"
     },
@@ -29468,7 +29511,7 @@
     {
         "title": "Renamed Plink Execution",
         "id": "1c12727d-02bf-45ff-a9f3-d49806a3cf43",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed version of the Plink binary",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -29508,7 +29551,7 @@
     {
         "title": "Potential Password Spraying Attempt Using Dsacls.EXE",
         "id": "bac9fb54-2da7-44e9-988f-11e9a5edbc0c",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects possible password spraying attempts using Dsacls",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -30347,7 +30390,7 @@
     {
         "title": "DirLister Execution",
         "id": "b4dc61f5-6cce-468e-a608-b48b469feaa2",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect the usage of \"DirLister.exe\" a utility for quickly listing folder or drive contents. It was seen used by BlackCat ransomware to create a list of accessible directories and files.",
         "author": "frack113",
         "tags": [
@@ -30660,7 +30703,7 @@
     {
         "title": "Potential Persistence Via Powershell Search Order Hijacking - Task",
         "id": "b66474aa-bd92-4333-a16c-298155b120df",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell \"Get-Variable\" technique as seen being used in Colibri Loader",
         "author": "pH-T (Nextron Systems), Florian Roth (Nextron Systems)",
         "tags": [
@@ -31237,7 +31280,7 @@
     {
         "title": "SQLite Chromium Profile Data DB Access",
         "id": "24c77512-782b-448a-8950-eddb0785fc71",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect usage of the \"sqlite\" binary to query databases in Chromium-based browsers for potential data stealing.",
         "author": "TropChaud",
         "tags": [
@@ -31640,7 +31683,7 @@
     {
         "title": "Potential Active Directory Enumeration Using AD Module - ProcCreation",
         "id": "70bc5215-526f-4477-963c-a47a5c9ebd12",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of the \"Import-Module\" cmdlet to load the \"Microsoft.ActiveDirectory.Management.dl\" DLL. Which is often used by attackers to perform AD enumeration.",
         "author": "frack113",
         "tags": [
@@ -31891,7 +31934,7 @@
     {
         "title": "Renamed NetSupport RAT Execution",
         "id": "0afbd410-de03-4078-8491-f132303cb67d",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed \"client32.exe\" (NetSupport RAT) via Imphash, Product and OriginalFileName strings",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -32150,7 +32193,7 @@
     {
         "title": "PDQ Deploy Remote Adminstartion Tool Execution",
         "id": "d679950c-abb7-43a6-80fb-2a480c4fc450",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect use of PDQ Deploy remote admin tool",
         "author": "frack113",
         "tags": [
@@ -32311,7 +32354,7 @@
     {
         "title": "Nltest.EXE Execution",
         "id": "903076ff-f442-475a-b667-4f246bcc203b",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects nltest commands that can be used for information discovery",
         "author": "Arun Chauhan",
         "tags": [
@@ -32600,7 +32643,7 @@
     {
         "title": "HackTool - Inveigh Execution",
         "id": "b99a1518-1ad5-4f65-bc95-1ffff97a8fd0",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -32954,7 +32997,7 @@
     {
         "title": "Disabled RestrictedAdminMode For RDS - ProcCreation",
         "id": "28ac00d6-22d9-4a3c-927f-bbd770104573",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect activation of DisableRestrictedAdmin to disable RestrictedAdmin mode.\nRestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.\nThis prevents your credentials from being harvested during the initial connection process if the remote server has been compromise\n",
         "author": "frack113",
         "tags": [
@@ -33014,7 +33057,7 @@
     {
         "title": "Unsigned AppX Installation Attempt Using Add-AppxPackage",
         "id": "37651c2a-42cd-4a69-ae0d-22a4349aa04a",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of the \"Add-AppxPackage\" or it's alias \"Add-AppPackage\" to install unsigned AppX packages",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -33307,7 +33350,7 @@
     {
         "title": "HackTool - SafetyKatz Execution",
         "id": "b1876533-4ed5-4a83-90f3-b8645840a413",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the hacktool SafetyKatz via PE information and default Image name",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -33716,7 +33759,7 @@
     {
         "title": "Potential Renamed Rundll32 Execution",
         "id": "2569ed8c-1147-498a-9b8c-2ad3656b10ed",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when 'DllRegisterServer' is called in the commandline and the image is not rundll32. This could mean that the 'rundll32' utility has been renamed in order to avoid detection",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -33848,7 +33891,7 @@
     {
         "title": "PUA - DefenderCheck Execution",
         "id": "f0ca6c24-3225-47d5-b1f5-352bf07ecfa7",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of DefenderCheck, a tool to evaluate the signatures used in Microsoft Defender. It can be used to figure out the strings / byte chains used in Microsoft Defender to detect a tool and thus used for AV evasion.",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -34366,7 +34409,7 @@
     {
         "title": "Suspicious Hacktool Execution - Imphash",
         "id": "24e3e58a-646b-4b50-adef-02ef935b9fc8",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -35044,7 +35087,7 @@
     {
         "title": "Microsoft IIS Service Account Password Dumped",
         "id": "2d3cdeec-c0db-45b4-aa86-082f7eb75701",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords",
         "author": "Tim Rauch, Janantha Marasinghe",
         "tags": [
@@ -35959,7 +36002,7 @@
     {
         "title": "Potential WinAPI Calls Via CommandLine",
         "id": "ba3f5c1b-6272-4119-9dbd-0bc8d21c2702",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -36079,7 +36122,7 @@
     {
         "title": "PUA - Seatbelt Execution",
         "id": "38646daa-e78f-4ace-9de0-55547b2d30da",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -36142,7 +36185,7 @@
     {
         "title": "Potential Arbitrary Code Execution Via Node.EXE",
         "id": "6640f31c-01ad-49b5-beb5-83498a5cd8bd",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution node.exe which is shipped with multiple software such as VMware, Adobe...etc. In order to execute arbitrary code. For example to establish reverse shell as seen in Log4j attacks...etc",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -36444,7 +36487,7 @@
     {
         "title": "HackTool - SharPersist Execution",
         "id": "26488ad0-f9fd-4536-876f-52fea846a2e4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the hacktool SharPersist - used to deploy various different kinds of persistence mechanisms",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -36547,7 +36590,7 @@
     {
         "title": "Uncommon One Time Only Scheduled Task At 00:00",
         "id": "970823b7-273b-460a-8afc-3a6811998529",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects scheduled task creation events that include suspicious actions, and is run once at 00:00",
         "author": "pH-T (Nextron Systems)",
         "tags": [
@@ -36721,7 +36764,7 @@
     {
         "title": "Suspicious New Instance Of An Office COM Object",
         "id": "9bdaf1e9-fdef-443b-8081-4341b74a7e28",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an svchost process spawning an instance of an office application. This happens when the initial word application creates an instance of one of the Office COM objects such as 'Word.Application', 'Excel.Application', etc.\nThis can be used by malicious actors to create malicious Office documents with macros on the fly. (See vba2clr project in the references)\n",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -37497,7 +37540,7 @@
     {
         "title": "Potential DLL Sideloading Via DeviceEnroller.EXE",
         "id": "e173ad47-4388-4012-ae62-bd13f71c18a8",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of the PhoneDeepLink parameter to potentially sideload a DLL file that does not exist. This non-existent DLL file is named \"ShellChromeAPI.dll\".\nAdversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter\n",
         "author": "@gott_cyber",
         "tags": [
@@ -37691,7 +37734,7 @@
     {
         "title": "Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE",
         "id": "07f8bdc2-c9b3-472a-9817-5a670b872f53",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of cmdkey to look for cached credentials on the system",
         "author": "jmallette, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -37867,7 +37910,7 @@
     {
         "title": "Operator Bloopers Cobalt Strike Modules",
         "id": "4f154fb6-27d1-4813-a759-78b93e0b9c48",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects Cobalt Strike module/commands accidentally entered in CMD shell",
         "author": "_pete_0, TheDFIRReport",
         "tags": [
@@ -39084,7 +39127,7 @@
     {
         "title": "HackTool - KrbRelayUp Execution",
         "id": "12827a56-61a4-476a-a9cb-f3068f191073",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -39689,7 +39732,7 @@
     {
         "title": "Disable Windows IIS HTTP Logging",
         "id": "e4ed6030-ffe5-4e6a-8a8a-ab3c1ab9d94e",
-        "status": "experimental",
+        "status": "test",
         "description": "Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union)",
         "author": "frack113",
         "tags": [
@@ -39816,7 +39859,7 @@
     {
         "title": "Suspicious IIS URL GlobalRules Rewrite Via AppCmd",
         "id": "7c8af9b2-dcae-41a2-a9db-b28c288b5f08",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of \"appcmd\" to create new global URL rewrite rules. This behaviour has been observed being used by threat actors to add new rules so they can access their webshells.",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -40965,7 +41008,7 @@
     {
         "title": "Suspicious Git Clone",
         "id": "aef9d1f1-7396-4e92-a927-4567c7a495c1",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of \"git\" in order to clone a remote repository that contain suspicious keywords which might be suspicious",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -41022,7 +41065,7 @@
     {
         "title": "HackTool - KrbRelay Execution",
         "id": "e96253b8-6b3b-4f90-9e59-3b24b99cf9b4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of KrbRelay, a Kerberos relaying tool",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -41060,7 +41103,7 @@
     {
         "title": "New Remote Desktop Connection Initiated Via Mstsc.EXE",
         "id": "954f0af7-62dd-418f-b3df-a84bc2c7a774",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the usage of \"mstsc.exe\" with the \"/v\" flag to initiate a connection to a remote server.\nAdversaries may use valid accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.\n",
         "author": "frack113",
         "tags": [
@@ -41255,7 +41298,7 @@
     {
         "title": "HackTool - PowerTool Execution",
         "id": "a34f79a3-8e5f-4cc3-b765-de00695452c2",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the tool PowerTool which has the ability to kill a process, delete its process file, unload drivers, and delete the driver files",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -41293,7 +41336,7 @@
     {
         "title": "Potentially Over Permissive Permissions Granted Using Dsacls.EXE",
         "id": "01c42d3c-242d-4655-85b2-34f1739632f7",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of Dsacls to grant over permissive permissions",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -41447,7 +41490,7 @@
     {
         "title": "Potential Credential Dumping Attempt Using New NetworkProvider - CLI",
         "id": "baef1ec6-2ca9-47a3-97cc-4cf2bda10b77",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -41507,7 +41550,7 @@
     {
         "title": "Potential Recon Activity Via Nltest.EXE",
         "id": "5cc90652-4cbd-4241-aa3b-4b462fa5a248",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects nltest commands that can be used for information discovery",
         "author": "Craig Young, oscd.community, Georg Lauenstein",
         "tags": [
@@ -41873,7 +41916,7 @@
     {
         "title": "HackTool - SharpLdapWhoami Execution",
         "id": "d9367cbb-c2e0-47ce-bdc0-128cb6da898d",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -41914,7 +41957,7 @@
     {
         "title": "SafeBoot Registry Key Deleted Via Reg.EXE",
         "id": "fc0e89b5-adb0-43c1-b749-c12a10ec37de",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of \"reg.exe\" commands with the \"delete\" flag on safe boot registry keys. Often used by attacker to prevent safeboot execution of security products",
         "author": "Nasreddine Bencherchali (Nextron Systems), Tim Shelton",
         "tags": [
@@ -42085,7 +42128,7 @@
     {
         "title": "Suspicious Binary In User Directory Spawned From Office Application",
         "id": "aa3a6f94-890e-4e22-b634-ffdfd54792cc",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an executable in the users directory started from one of the Microsoft Office suite applications (Word, Excel, PowerPoint, Publisher, Visio)",
         "author": "Jason Lynch",
         "tags": [
@@ -42166,7 +42209,7 @@
     {
         "title": "Fsutil Behavior Set SymlinkEvaluation",
         "id": "c0b2768a-dd06-4671-8339-b16ca8d1f27f",
-        "status": "experimental",
+        "status": "test",
         "description": "A symbolic link is a type of file that contains a reference to another file.\nThis is probably done to make sure that the ransomware is able to follow shortcuts on the machine in order to find the original file to encrypt\n",
         "author": "frack113",
         "tags": [
@@ -42438,7 +42481,7 @@
     {
         "title": "Suspicious Hacktool Execution - PE Metadata",
         "id": "37c1333a-a0db-48be-b64b-7393b2386e3b",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -42499,7 +42542,7 @@
     {
         "title": "Suspicious Rundll32 Script in CommandLine",
         "id": "73fcad2e-ff14-4c38-b11d-4172c8ac86c7",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious process related to rundll32 based on arguments",
         "author": "frack113, Zaw Min Htun (ZETA)",
         "tags": [
@@ -43134,7 +43177,7 @@
     {
         "title": "PowerShell Base64 Encoded WMI Classes",
         "id": "1816994b-42e1-4fb1-afd2-134d88184f71",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects calls to base64 encoded WMI class such as \"Win32_Shadowcopy\", \"Win32_ScheduledJob\", etc.",
         "author": "Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -43253,7 +43296,7 @@
     {
         "title": "HackTool - SysmonEOP Execution",
         "id": "8a7e90c5-fe6e-45dc-889e-057fe4378bd9",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -43331,7 +43374,7 @@
     {
         "title": "PUA - Fast Reverse Proxy (FRP) Execution",
         "id": "32410e29-5f94-4568-b6a3-d91a8adad863",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet.",
         "author": "frack113, Florian Roth",
         "tags": [
@@ -43394,7 +43437,7 @@
     {
         "title": "Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE",
         "id": "48917adc-a28e-4f5d-b729-11e75da8941f",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the usage of \"reg.exe\" to add Defender folder exclusions. Qbot has been seen using this technique to add exclusions for folders within AppData and ProgramData.",
         "author": "frack113",
         "tags": [
@@ -43834,7 +43877,7 @@
     {
         "title": "Operator Bloopers Cobalt Strike Commands",
         "id": "647c7b9e-d784-4fda-b9a0-45c565a7b729",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects use of Cobalt Strike commands accidentally entered in the CMD shell",
         "author": "_pete_0, TheDFIRReport",
         "tags": [
@@ -44278,7 +44321,7 @@
     {
         "title": "HackTool - HandleKatz LSASS Dumper Execution",
         "id": "ca621ba5-54ab-4035-9942-d378e6fcde3c",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -44727,7 +44770,7 @@
     {
         "title": "New Generic Credentials Added Via Cmdkey.EXE",
         "id": "b1ec66c6-f4d1-4b5c-96dd-af28ccae7727",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of cmdkey to add generic credentials. As an example, this has to be used before connecting to an RDP session via command line interface.",
         "author": "frack113, Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -45099,7 +45142,7 @@
     {
         "title": "Suspicious Shells Spawn by Java Utility Keytool",
         "id": "90fb5e62-ca1f-4e22-b42e-cc521874c938",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation)",
         "author": "Andreas Hunkeler (@Karneades)",
         "tags": [
@@ -45119,7 +45162,7 @@
     {
         "title": "PUA - NPS Tunneling Tool Execution",
         "id": "68d37776-61db-42f5-bf54-27e87072d17e",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of NPS, a port forwarding and intranet penetration proxy server",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -45275,7 +45318,7 @@
     {
         "title": "Renamed Msdt.EXE Execution",
         "id": "bd1c6866-65fc-44b2-be51-5588fcff82b9",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed \"Msdt.exe\" binary",
         "author": "pH-T (Nextron Systems)",
         "tags": [
@@ -45313,7 +45356,7 @@
     {
         "title": "Execution from Suspicious Folder",
         "id": "3dfd06d2-eaf4-4532-9555-68aca59f57c4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects a suspicious execution from an uncommon folder",
         "author": "Florian Roth (Nextron Systems), Tim Shelton",
         "tags": [
@@ -45468,7 +45511,7 @@
     {
         "title": "Lolbin Ssh.exe Use As Proxy",
         "id": "7d6d30b8-5b91-4b90-a891-46cccaf29598",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect usage of the \"ssh.exe\" binary as a proxy to launch other programs",
         "author": "frack113, Nasreddine Bencherchali",
         "tags": [
@@ -45565,7 +45608,7 @@
     {
         "title": "Renamed Mavinject.EXE Execution",
         "id": "e6474a1b-5390-49cd-ab41-8d88655f7394",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed version of the \"Mavinject\" process. Which can be abused to perform process injection using the \"/INJECTRUNNING\" flag",
         "author": "frack113, Florian Roth",
         "tags": [
@@ -46741,7 +46784,7 @@
     {
         "title": "Query Usage To Exfil Data",
         "id": "53ef0cef-fa24-4f25-a34a-6c72dfa2e6e2",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of \"query.exe\" a system binary to exfil information such as \"sessions\" and \"processes\" for later use",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -46856,7 +46899,7 @@
     {
         "title": "Potential PowerShell Execution Policy Tampering - ProcCreation",
         "id": "cf2e938e-9a3e-4fe8-a347-411642b28a9f",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects changes to the PowerShell execution policy registry key in order to bypass signing requirements for script execution from the CommandLine",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -46874,7 +46917,7 @@
     {
         "title": "Renamed BrowserCore.EXE Execution",
         "id": "8a4519e8-e64a-40b6-ae85-ba8ad2177559",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects process creation with a renamed BrowserCore.exe (used to extract Azure tokens)",
         "author": "Max Altgelt (Nextron Systems)",
         "tags": [
@@ -47145,7 +47188,7 @@
     {
         "title": "Suspicious Use of PsLogList",
         "id": "aae1243f-d8af-40d8-ab20-33fc6d0c55bc",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of the PsLogList utility to dump event log in order to extract admin accounts and perform account discovery or delete events logs",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -47352,7 +47395,7 @@
     {
         "title": "Renamed Vmnat.exe Execution",
         "id": "7b4f794b-590a-4ad4-ba18-7964a2832205",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects renamed vmnat.exe or portable version that can be used for DLL side-loading",
         "author": "elhoim",
         "tags": [
@@ -47371,7 +47414,7 @@
     {
         "title": "Renamed Sysinternals Sdelete Execution",
         "id": "c1d867fe-8d95-4487-aab4-e53f2d339f90",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of a renamed SysInternals Sdelete, which is something an administrator shouldn't do (the renaming)",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -47844,7 +47887,7 @@
     {
         "title": "Potential Signing Bypass Via Windows Developer Features",
         "id": "a383dec4-deec-4e6e-913b-ed9249670848",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when a user enable developer features such as \"Developer Mode\" or \"Application Sideloading\". Which allows the user to install untrusted packages.",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -47900,7 +47943,7 @@
     {
         "title": "Renamed Remote Utilities RAT (RURAT) Execution",
         "id": "9ef27c24-4903-4192-881a-3adde7ff92a5",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of renamed Remote Utilities (RURAT) via Product PE header field",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -48275,7 +48318,7 @@
     {
         "title": "Root Certificate Installed From Susp Locations",
         "id": "5f6a601c-2ecb-498b-9c33-660362323afa",
-        "status": "experimental",
+        "status": "test",
         "description": "Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -48294,7 +48337,7 @@
     {
         "title": "Potential Process Injection Via Msra.EXE",
         "id": "744a188b-0415-4792-896f-11ddb0588dbc",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential process injection via Microsoft Remote Asssistance (Msra.exe) by looking at suspicious child processes spawned from the aforementioned process. It has been a target used by many threat actors and used for discovery and persistence tactics",
         "author": "Alexander McDonald",
         "tags": [
@@ -48807,7 +48850,7 @@
     {
         "title": "Import PowerShell Modules From Suspicious Directories - ProcCreation",
         "id": "c31364f7-8be6-4b77-8483-dd2b5a7b69a3",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects powershell scripts that import modules from suspicious directories",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -48907,7 +48950,7 @@
     {
         "title": "Potential RDP Tunneling Via SSH",
         "id": "f7d7ebd5-a016-46e2-9c54-f9932f2d386d",
-        "status": "experimental",
+        "status": "test",
         "description": "Execution of ssh.exe to perform data exfiltration and tunneling through RDP",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -49218,7 +49261,7 @@
     {
         "title": "Potential Discovery Activity Via Dnscmd.EXE",
         "id": "b6457d63-d2a2-4e29-859d-4e7affc153d1",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an attempt to leverage dnscmd.exe to enumerate the DNS zones of a domain. DNS zones used to host the DNS records for a particular domain.",
         "author": "@gott_cyber",
         "tags": [
@@ -49278,7 +49321,7 @@
     {
         "title": "Service Registry Key Deleted Via Reg.EXE",
         "id": "05b2aa93-1210-42c8-8d9a-2fcc13b284f5",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of \"reg.exe\" commands with the \"delete\" flag on services registry key. Often used by attacker to remove AV software services",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -49587,7 +49630,7 @@
     {
         "title": "HackTool - Htran/NATBypass Execution",
         "id": "f5e3b62f-e577-4e59-931e-0a15b2b94e1e",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass)",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -49626,7 +49669,7 @@
     {
         "title": "SQLite Firefox Profile Data DB Access",
         "id": "4833155a-4053-4c9c-a997-777fcea0baa7",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect usage of the \"sqlite\" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.",
         "author": "frack113",
         "tags": [
diff --git a/rules/rules_windows_sysmon_high.json b/rules/rules_windows_sysmon_high.json
index fe37081..766a1f5 100644
--- a/rules/rules_windows_sysmon_high.json
+++ b/rules/rules_windows_sysmon_high.json
@@ -2880,7 +2880,7 @@
     {
         "title": "Potential Svchost Memory Access",
         "id": "166e9c50-8cd9-44af-815d-d1f0c0e90dde",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential access to svchost process memory such as that used by Invoke-Phantom to kill the winRM Windows event logging service.",
         "author": "Tim Burrell",
         "tags": [
@@ -3375,7 +3375,7 @@
     {
         "title": "Malicious PowerShell Scripts - PoshModule",
         "id": "41025fd7-0466-4650-a813-574aaacbe7f4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of known offensive powershell scripts used for exploitation or reconnaissance",
         "author": "frack113, Nasreddine Bencherchali",
         "tags": [
@@ -4654,7 +4654,7 @@
     {
         "title": "Malicious Nishang PowerShell Commandlets",
         "id": "f772cee9-b7c2-4cb2-8f07-49870adc02e0",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects Commandlet names and arguments from the Nishang exploitation framework",
         "author": "Alec Costello",
         "tags": [
@@ -4692,7 +4692,7 @@
     {
         "title": "DNS Query for Anonfiles.com Domain - Sysmon",
         "id": "065cceea-77ec-4030-9052-fc0affea7110",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects DNS queries for \"anonfiles.com\", which is an anonymous file upload platform often used for malicious purposes",
         "author": "pH-T (Nextron Systems)",
         "tags": [
@@ -5641,7 +5641,7 @@
     {
         "title": "Potential DLL Sideloading Of Non-Existent DLLs From System Folders",
         "id": "6b98b92b-4f00-4f62-b4fe-4d1920215771",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects DLL sideloading of system dlls that are not present on the system by default. Usually to achieve techniques such as UAC bypass and privilege escalation",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -6529,7 +6529,7 @@
     {
         "title": "Suspicious Startup Folder Persistence",
         "id": "28208707-fe31-437f-9a7f-4b1108b94d2e",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when a file with a suspicious extension is created in the startup folder",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -9905,7 +9905,7 @@
     {
         "title": "Potential Exploitation Attempt From Office Application",
         "id": "868955d9-697e-45d4-a3da-360cefd7c216",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects Office applications executing a child process that includes directory traversal patterns. This could be an attempt to exploit CVE-2022-30190 (MSDT RCE) or CVE-2021-40444 (MSHTML RCE)",
         "author": "Christian Burkard (Nextron Systems), @SBousseaden (idea)",
         "tags": [
@@ -10803,7 +10803,7 @@
     {
         "title": "Potential CVE-2022-26809 Exploitation Attempt",
         "id": "a7cd7306-df8b-4398-b711-6f3e4935cf16",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious remote procedure call (RPC) service anomalies based on the spawned sub processes (long shot to detect the exploitation of vulnerabilities like CVE-2022-26809)",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -10909,7 +10909,7 @@
     {
         "title": "Potential Centos Web Panel Exploitation Attempt - CVE-2022-44877",
         "id": "1b2eeb27-949b-4704-8bfa-d8e5cfa045a1",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential exploitation attempts that target the Centos Web Panel 7 Unauthenticated Remote Code Execution CVE-2022-44877",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -11379,7 +11379,7 @@
         ],
         "level": "high",
         "rule": [
-            "SELECT * FROM logs WHERE (EventID = '1' AND Channel = 'Microsoft-Windows-Sysmon/Operational' AND ParentImage LIKE '%\\\\ws\\_tomcatservice.exe' ESCAPE '\\' AND Image LIKE '%\\\\repadmin.exe' ESCAPE '\\')"
+            "SELECT * FROM logs WHERE ((EventID = '1' AND Channel = 'Microsoft-Windows-Sysmon/Operational') AND ParentImage LIKE '%\\\\ws\\_tomcatservice.exe' ESCAPE '\\' AND NOT ((Image LIKE '%\\\\repadmin.exe' ESCAPE '\\')))"
         ],
         "filename": "proc_creation_win_apt_mint_sandstorm_log4j_wstomcat_execution.yml"
     },
@@ -12156,7 +12156,7 @@
     {
         "title": "Potential Exploitation Attempt Of Undocumented WindowsServer RCE",
         "id": "6d5b8176-d87d-4402-8af4-53aee9db7b5d",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential exploitation attempt of undocumented Windows Server Pre Auth Remote Code Execution (RCE)",
         "author": "Florian Roth (Nextron Systems), Nasreddine Bencherchali",
         "tags": [
@@ -13528,7 +13528,7 @@
     {
         "title": "Suspicious AppX Package Locations",
         "id": "5cdeaf3d-1489-477c-95ab-c318559fc051",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an appx package added the pipeline of the \"to be processed\" packages which is located in suspicious locations",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -15522,7 +15522,7 @@
     {
         "title": "DNS Query for Anonfiles.com Domain - DNS Client",
         "id": "29f171d7-aa47-42c7-9c7b-3c87938164d9",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects DNS queries for anonfiles.com, which is an anonymous file upload platform often used for malicious purposes",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -16712,7 +16712,7 @@
     {
         "title": "Restricted Software Access By SRP",
         "id": "b4c8da4a-1c12-46b0-8a2b-0a8521d03442",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects restricted access to applications by the Software Restriction Policies (SRP) policy",
         "author": "frack113",
         "tags": [
@@ -17444,7 +17444,7 @@
     {
         "title": "Renamed Plink Execution",
         "id": "1c12727d-02bf-45ff-a9f3-d49806a3cf43",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed version of the Plink binary",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -18056,7 +18056,7 @@
     {
         "title": "Potential Persistence Via Powershell Search Order Hijacking - Task",
         "id": "b66474aa-bd92-4333-a16c-298155b120df",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell \"Get-Variable\" technique as seen being used in Colibri Loader",
         "author": "pH-T (Nextron Systems), Florian Roth (Nextron Systems)",
         "tags": [
@@ -18351,7 +18351,7 @@
     {
         "title": "SQLite Chromium Profile Data DB Access",
         "id": "24c77512-782b-448a-8950-eddb0785fc71",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect usage of the \"sqlite\" binary to query databases in Chromium-based browsers for potential data stealing.",
         "author": "TropChaud",
         "tags": [
@@ -18690,7 +18690,7 @@
     {
         "title": "Renamed NetSupport RAT Execution",
         "id": "0afbd410-de03-4078-8491-f132303cb67d",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed \"client32.exe\" (NetSupport RAT) via Imphash, Product and OriginalFileName strings",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -19024,7 +19024,7 @@
     {
         "title": "HackTool - Inveigh Execution",
         "id": "b99a1518-1ad5-4f65-bc95-1ffff97a8fd0",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -19224,7 +19224,7 @@
     {
         "title": "Disabled RestrictedAdminMode For RDS - ProcCreation",
         "id": "28ac00d6-22d9-4a3c-927f-bbd770104573",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect activation of DisableRestrictedAdmin to disable RestrictedAdmin mode.\nRestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.\nThis prevents your credentials from being harvested during the initial connection process if the remote server has been compromise\n",
         "author": "frack113",
         "tags": [
@@ -19421,7 +19421,7 @@
     {
         "title": "HackTool - SafetyKatz Execution",
         "id": "b1876533-4ed5-4a83-90f3-b8645840a413",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the hacktool SafetyKatz via PE information and default Image name",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -19617,7 +19617,7 @@
     {
         "title": "Potential Renamed Rundll32 Execution",
         "id": "2569ed8c-1147-498a-9b8c-2ad3656b10ed",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when 'DllRegisterServer' is called in the commandline and the image is not rundll32. This could mean that the 'rundll32' utility has been renamed in order to avoid detection",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -19730,7 +19730,7 @@
     {
         "title": "PUA - DefenderCheck Execution",
         "id": "f0ca6c24-3225-47d5-b1f5-352bf07ecfa7",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of DefenderCheck, a tool to evaluate the signatures used in Microsoft Defender. It can be used to figure out the strings / byte chains used in Microsoft Defender to detect a tool and thus used for AV evasion.",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -19999,7 +19999,7 @@
     {
         "title": "Suspicious Hacktool Execution - Imphash",
         "id": "24e3e58a-646b-4b50-adef-02ef935b9fc8",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -20389,7 +20389,7 @@
     {
         "title": "Microsoft IIS Service Account Password Dumped",
         "id": "2d3cdeec-c0db-45b4-aa86-082f7eb75701",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords",
         "author": "Tim Rauch, Janantha Marasinghe",
         "tags": [
@@ -20880,7 +20880,7 @@
     {
         "title": "Potential WinAPI Calls Via CommandLine",
         "id": "ba3f5c1b-6272-4119-9dbd-0bc8d21c2702",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -20960,7 +20960,7 @@
     {
         "title": "PUA - Seatbelt Execution",
         "id": "38646daa-e78f-4ace-9de0-55547b2d30da",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -21023,7 +21023,7 @@
     {
         "title": "Potential Arbitrary Code Execution Via Node.EXE",
         "id": "6640f31c-01ad-49b5-beb5-83498a5cd8bd",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution node.exe which is shipped with multiple software such as VMware, Adobe...etc. In order to execute arbitrary code. For example to establish reverse shell as seen in Log4j attacks...etc",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -21224,7 +21224,7 @@
     {
         "title": "HackTool - SharPersist Execution",
         "id": "26488ad0-f9fd-4536-876f-52fea846a2e4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the hacktool SharPersist - used to deploy various different kinds of persistence mechanisms",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -21266,7 +21266,7 @@
     {
         "title": "Uncommon One Time Only Scheduled Task At 00:00",
         "id": "970823b7-273b-460a-8afc-3a6811998529",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects scheduled task creation events that include suspicious actions, and is run once at 00:00",
         "author": "pH-T (Nextron Systems)",
         "tags": [
@@ -21872,7 +21872,7 @@
     {
         "title": "Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE",
         "id": "07f8bdc2-c9b3-472a-9817-5a670b872f53",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of cmdkey to look for cached credentials on the system",
         "author": "jmallette, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -21948,7 +21948,7 @@
     {
         "title": "Operator Bloopers Cobalt Strike Modules",
         "id": "4f154fb6-27d1-4813-a759-78b93e0b9c48",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects Cobalt Strike module/commands accidentally entered in CMD shell",
         "author": "_pete_0, TheDFIRReport",
         "tags": [
@@ -22590,7 +22590,7 @@
     {
         "title": "HackTool - KrbRelayUp Execution",
         "id": "12827a56-61a4-476a-a9cb-f3068f191073",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -22941,7 +22941,7 @@
     {
         "title": "Disable Windows IIS HTTP Logging",
         "id": "e4ed6030-ffe5-4e6a-8a8a-ab3c1ab9d94e",
-        "status": "experimental",
+        "status": "test",
         "description": "Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union)",
         "author": "frack113",
         "tags": [
@@ -23678,7 +23678,7 @@
     {
         "title": "HackTool - KrbRelay Execution",
         "id": "e96253b8-6b3b-4f90-9e59-3b24b99cf9b4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of KrbRelay, a Kerberos relaying tool",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -23755,7 +23755,7 @@
     {
         "title": "HackTool - PowerTool Execution",
         "id": "a34f79a3-8e5f-4cc3-b765-de00695452c2",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the tool PowerTool which has the ability to kill a process, delete its process file, unload drivers, and delete the driver files",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -23852,7 +23852,7 @@
     {
         "title": "Potential Credential Dumping Attempt Using New NetworkProvider - CLI",
         "id": "baef1ec6-2ca9-47a3-97cc-4cf2bda10b77",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -23871,7 +23871,7 @@
     {
         "title": "Potential Recon Activity Via Nltest.EXE",
         "id": "5cc90652-4cbd-4241-aa3b-4b462fa5a248",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects nltest commands that can be used for information discovery",
         "author": "Craig Young, oscd.community, Georg Lauenstein",
         "tags": [
@@ -24086,7 +24086,7 @@
     {
         "title": "HackTool - SharpLdapWhoami Execution",
         "id": "d9367cbb-c2e0-47ce-bdc0-128cb6da898d",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -24127,7 +24127,7 @@
     {
         "title": "SafeBoot Registry Key Deleted Via Reg.EXE",
         "id": "fc0e89b5-adb0-43c1-b749-c12a10ec37de",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of \"reg.exe\" commands with the \"delete\" flag on safe boot registry keys. Often used by attacker to prevent safeboot execution of security products",
         "author": "Nasreddine Bencherchali (Nextron Systems), Tim Shelton",
         "tags": [
@@ -24203,7 +24203,7 @@
     {
         "title": "Suspicious Binary In User Directory Spawned From Office Application",
         "id": "aa3a6f94-890e-4e22-b634-ffdfd54792cc",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an executable in the users directory started from one of the Microsoft Office suite applications (Word, Excel, PowerPoint, Publisher, Visio)",
         "author": "Jason Lynch",
         "tags": [
@@ -24417,7 +24417,7 @@
     {
         "title": "Suspicious Hacktool Execution - PE Metadata",
         "id": "37c1333a-a0db-48be-b64b-7393b2386e3b",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -24743,7 +24743,7 @@
     {
         "title": "PowerShell Base64 Encoded WMI Classes",
         "id": "1816994b-42e1-4fb1-afd2-134d88184f71",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects calls to base64 encoded WMI class such as \"Win32_Shadowcopy\", \"Win32_ScheduledJob\", etc.",
         "author": "Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -24784,7 +24784,7 @@
     {
         "title": "HackTool - SysmonEOP Execution",
         "id": "8a7e90c5-fe6e-45dc-889e-057fe4378bd9",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -24804,7 +24804,7 @@
     {
         "title": "PUA - Fast Reverse Proxy (FRP) Execution",
         "id": "32410e29-5f94-4568-b6a3-d91a8adad863",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet.",
         "author": "frack113, Florian Roth",
         "tags": [
@@ -25091,7 +25091,7 @@
     {
         "title": "Operator Bloopers Cobalt Strike Commands",
         "id": "647c7b9e-d784-4fda-b9a0-45c565a7b729",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects use of Cobalt Strike commands accidentally entered in the CMD shell",
         "author": "_pete_0, TheDFIRReport",
         "tags": [
@@ -25244,7 +25244,7 @@
     {
         "title": "HackTool - HandleKatz LSASS Dumper Execution",
         "id": "ca621ba5-54ab-4035-9942-d378e6fcde3c",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -25681,7 +25681,7 @@
     {
         "title": "Suspicious Shells Spawn by Java Utility Keytool",
         "id": "90fb5e62-ca1f-4e22-b42e-cc521874c938",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation)",
         "author": "Andreas Hunkeler (@Karneades)",
         "tags": [
@@ -25701,7 +25701,7 @@
     {
         "title": "PUA - NPS Tunneling Tool Execution",
         "id": "68d37776-61db-42f5-bf54-27e87072d17e",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of NPS, a port forwarding and intranet penetration proxy server",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -25798,7 +25798,7 @@
     {
         "title": "Renamed Msdt.EXE Execution",
         "id": "bd1c6866-65fc-44b2-be51-5588fcff82b9",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed \"Msdt.exe\" binary",
         "author": "pH-T (Nextron Systems)",
         "tags": [
@@ -25836,7 +25836,7 @@
     {
         "title": "Execution from Suspicious Folder",
         "id": "3dfd06d2-eaf4-4532-9555-68aca59f57c4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects a suspicious execution from an uncommon folder",
         "author": "Florian Roth (Nextron Systems), Tim Shelton",
         "tags": [
@@ -25988,7 +25988,7 @@
     {
         "title": "Renamed Mavinject.EXE Execution",
         "id": "e6474a1b-5390-49cd-ab41-8d88655f7394",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed version of the \"Mavinject\" process. Which can be abused to perform process injection using the \"/INJECTRUNNING\" flag",
         "author": "frack113, Florian Roth",
         "tags": [
@@ -26694,7 +26694,7 @@
     {
         "title": "Potential PowerShell Execution Policy Tampering - ProcCreation",
         "id": "cf2e938e-9a3e-4fe8-a347-411642b28a9f",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects changes to the PowerShell execution policy registry key in order to bypass signing requirements for script execution from the CommandLine",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -26712,7 +26712,7 @@
     {
         "title": "Renamed BrowserCore.EXE Execution",
         "id": "8a4519e8-e64a-40b6-ae85-ba8ad2177559",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects process creation with a renamed BrowserCore.exe (used to extract Azure tokens)",
         "author": "Max Altgelt (Nextron Systems)",
         "tags": [
@@ -26973,7 +26973,7 @@
     {
         "title": "Renamed Vmnat.exe Execution",
         "id": "7b4f794b-590a-4ad4-ba18-7964a2832205",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects renamed vmnat.exe or portable version that can be used for DLL side-loading",
         "author": "elhoim",
         "tags": [
@@ -26992,7 +26992,7 @@
     {
         "title": "Renamed Sysinternals Sdelete Execution",
         "id": "c1d867fe-8d95-4487-aab4-e53f2d339f90",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of a renamed SysInternals Sdelete, which is something an administrator shouldn't do (the renaming)",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -27184,7 +27184,7 @@
     {
         "title": "Potential Signing Bypass Via Windows Developer Features",
         "id": "a383dec4-deec-4e6e-913b-ed9249670848",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when a user enable developer features such as \"Developer Mode\" or \"Application Sideloading\". Which allows the user to install untrusted packages.",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -27339,7 +27339,7 @@
     {
         "title": "Root Certificate Installed From Susp Locations",
         "id": "5f6a601c-2ecb-498b-9c33-660362323afa",
-        "status": "experimental",
+        "status": "test",
         "description": "Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -27358,7 +27358,7 @@
     {
         "title": "Potential Process Injection Via Msra.EXE",
         "id": "744a188b-0415-4792-896f-11ddb0588dbc",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential process injection via Microsoft Remote Asssistance (Msra.exe) by looking at suspicious child processes spawned from the aforementioned process. It has been a target used by many threat actors and used for discovery and persistence tactics",
         "author": "Alexander McDonald",
         "tags": [
@@ -27700,7 +27700,7 @@
     {
         "title": "Potential RDP Tunneling Via SSH",
         "id": "f7d7ebd5-a016-46e2-9c54-f9932f2d386d",
-        "status": "experimental",
+        "status": "test",
         "description": "Execution of ssh.exe to perform data exfiltration and tunneling through RDP",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -27856,7 +27856,7 @@
     {
         "title": "Service Registry Key Deleted Via Reg.EXE",
         "id": "05b2aa93-1210-42c8-8d9a-2fcc13b284f5",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of \"reg.exe\" commands with the \"delete\" flag on services registry key. Often used by attacker to remove AV software services",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -28011,7 +28011,7 @@
     {
         "title": "HackTool - Htran/NATBypass Execution",
         "id": "f5e3b62f-e577-4e59-931e-0a15b2b94e1e",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass)",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -28031,7 +28031,7 @@
     {
         "title": "SQLite Firefox Profile Data DB Access",
         "id": "4833155a-4053-4c9c-a997-777fcea0baa7",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect usage of the \"sqlite\" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.",
         "author": "frack113",
         "tags": [
diff --git a/rules/rules_windows_sysmon_medium.json b/rules/rules_windows_sysmon_medium.json
index c8f207a..6a02360 100644
--- a/rules/rules_windows_sysmon_medium.json
+++ b/rules/rules_windows_sysmon_medium.json
@@ -3333,7 +3333,7 @@
     {
         "title": "Potential PendingFileRenameOperations Tamper",
         "id": "4eec988f-7bf0-49f1-8675-1e6a510b3a2a",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect changes to the \"PendingFileRenameOperations\" registry key from uncommon or suspicious images lcoations to stage currently used files for rename after reboot.",
         "author": "frack113",
         "tags": [
@@ -3686,7 +3686,7 @@
     {
         "title": "Atbroker Registry Change",
         "id": "9577edbb-851f-4243-8c91-1d5b50c1a39b",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'",
         "author": "Mateusz Wydra, oscd.community",
         "tags": [
@@ -4609,7 +4609,7 @@
     {
         "title": "Potential Svchost Memory Access",
         "id": "166e9c50-8cd9-44af-815d-d1f0c0e90dde",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential access to svchost process memory such as that used by Invoke-Phantom to kill the winRM Windows event logging service.",
         "author": "Tim Burrell",
         "tags": [
@@ -5261,7 +5261,7 @@
     {
         "title": "Suspicious PowerShell Download - PoshModule",
         "id": "de41232e-12e8-49fa-86bc-c05c7e722df9",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious PowerShell download command",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -5339,7 +5339,7 @@
     {
         "title": "Malicious PowerShell Scripts - PoshModule",
         "id": "41025fd7-0466-4650-a813-574aaacbe7f4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of known offensive powershell scripts used for exploitation or reconnaissance",
         "author": "frack113, Nasreddine Bencherchali",
         "tags": [
@@ -5400,7 +5400,7 @@
     {
         "title": "Potential Active Directory Enumeration Using AD Module - PsModule",
         "id": "74176142-4684-4d8a-8b0a-713257e7df8e",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of the \"Import-Module\" cmdlet to load the \"Microsoft.ActiveDirectory.Management.dl\" DLL. Which is often used by attackers to perform AD enumeration.",
         "author": "Nasreddine Bencherchali (Nextron Systems), frack113",
         "tags": [
@@ -6416,7 +6416,7 @@
     {
         "title": "Usage Of Web Request Commands And Cmdlets - ScriptBlock",
         "id": "1139d2e2-84b1-4226-b445-354492eba8ba",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via PowerShell scriptblock logs",
         "author": "James Pemberton / @4A616D6573",
         "tags": [
@@ -6855,7 +6855,7 @@
     {
         "title": "Unsigned AppX Installation Attempt Using Add-AppxPackage - PsScript",
         "id": "975b2262-9a49-439d-92a6-0709cccdf0b2",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of the \"Add-AppxPackage\" or it's alias \"Add-AppPackage\" to install unsigned AppX packages",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -7199,7 +7199,7 @@
     {
         "title": "Import PowerShell Modules From Suspicious Directories",
         "id": "21f9162c-5f5d-4b01-89a8-b705bd7d10ab",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects powershell scripts that import modules from suspicious directories",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -7467,7 +7467,7 @@
     {
         "title": "Potential Data Exfiltration Via Audio File",
         "id": "e4f93c99-396f-47c8-bb0f-201b1fa69034",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential exfiltration attempt via audio file using PowerShell",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -7600,7 +7600,7 @@
     {
         "title": "Powershell XML Execute Command",
         "id": "6c6c6282-7671-4fe9-a0ce-a2dcebdc342b",
-        "status": "experimental",
+        "status": "test",
         "description": "Adversaries may abuse PowerShell commands and scripts for execution.\nPowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell)\nAdversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code\n",
         "author": "frack113",
         "tags": [
@@ -8260,7 +8260,7 @@
     {
         "title": "Potential Active Directory Enumeration Using AD Module - PsScript",
         "id": "9e620995-f2d8-4630-8430-4afd89f77604",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of the \"Import-Module\" cmdlet to load the \"Microsoft.ActiveDirectory.Management.dl\" DLL. Which is often used by attackers to perform AD enumeration.",
         "author": "frack113, Nasreddine Bencherchali",
         "tags": [
@@ -8457,7 +8457,7 @@
     {
         "title": "Malicious Nishang PowerShell Commandlets",
         "id": "f772cee9-b7c2-4cb2-8f07-49870adc02e0",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects Commandlet names and arguments from the Nishang exploitation framework",
         "author": "Alec Costello",
         "tags": [
@@ -8473,25 +8473,6 @@
         ],
         "filename": "posh_ps_nishang_malicious_commandlets.yml"
     },
-    {
-        "title": "Suspicious DNS Query for IP Lookup Service APIs",
-        "id": "ec82e2a5-81ea-4211-a1f8-37a0286df2c2",
-        "status": "test",
-        "description": "Detects DNS queries for IP lookup services such as \"api.ipify.org\" originating from a non browser process.",
-        "author": "Brandon George (blog post), Thomas Patzke",
-        "tags": [
-            "attack.reconnaissance",
-            "attack.t1590"
-        ],
-        "falsepositives": [
-            "Legitimate usage of IP lookup services such as ipify API"
-        ],
-        "level": "medium",
-        "rule": [
-            "SELECT * FROM logs WHERE ((EventID = '22' AND Channel = 'Microsoft-Windows-Sysmon/Operational') AND (QueryName LIKE '%api.2ip.ua%' ESCAPE '\\' OR QueryName LIKE '%api.ipify.org%' ESCAPE '\\' OR QueryName LIKE '%bot.whatismyipaddress.com%' ESCAPE '\\' OR QueryName LIKE '%canireachthe.net%' ESCAPE '\\' OR QueryName LIKE '%checkip.amazonaws.com%' ESCAPE '\\' OR QueryName LIKE '%checkip.dyndns.org%' ESCAPE '\\' OR QueryName LIKE '%curlmyip.com%' ESCAPE '\\' OR QueryName LIKE '%edns.ip-api.com%' ESCAPE '\\' OR QueryName LIKE '%eth0.me%' ESCAPE '\\' OR QueryName LIKE '%freegeoip.app%' ESCAPE '\\' OR QueryName LIKE '%geoipy.com%' ESCAPE '\\' OR QueryName LIKE '%getip.pro%' ESCAPE '\\' OR QueryName LIKE '%icanhazip.com%' ESCAPE '\\' OR QueryName LIKE '%ident.me%' ESCAPE '\\' OR QueryName LIKE '%ifconfig.io%' ESCAPE '\\' OR QueryName LIKE '%ifconfig.me%' ESCAPE '\\' OR QueryName LIKE '%ip-api.com%' ESCAPE '\\' OR QueryName LIKE '%ip.anysrc.net%' ESCAPE '\\' OR QueryName LIKE '%ip.tyk.nu%' ESCAPE '\\' OR QueryName LIKE '%ipaddressworld.com%' ESCAPE '\\' OR QueryName LIKE '%ipecho.net%' ESCAPE '\\' OR QueryName LIKE '%ipinfo.io%' ESCAPE '\\' OR QueryName LIKE '%ipof.in%' ESCAPE '\\' OR QueryName LIKE '%ipv4.icanhazip.com%' ESCAPE '\\' OR QueryName LIKE '%ipv4bot.whatismyipaddress.com%' ESCAPE '\\' OR QueryName LIKE '%ipwho.is%' ESCAPE '\\' OR QueryName LIKE '%l2.io%' ESCAPE '\\' OR QueryName LIKE '%myexternalip.com%' ESCAPE '\\' OR QueryName LIKE '%wgetip.com%' ESCAPE '\\' OR QueryName LIKE '%whatismyip.akamai.com%' ESCAPE '\\' OR QueryName LIKE '%wtfismyip.com%' ESCAPE '\\') AND NOT ((Image LIKE '%\\\\brave.exe' ESCAPE '\\') OR ((Image LIKE 'C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files (x86)\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\')) OR ((Image LIKE 'C:\\\\Program Files\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\')) OR ((Image LIKE 'C:\\\\Program Files (x86)\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\')) OR (Image LIKE '%\\\\maxthon.exe' ESCAPE '\\') OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\%' ESCAPE '\\' OR Image LIKE '%\\\\WindowsApps\\\\MicrosoftEdge.exe' ESCAPE '\\' OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\')) OR ((Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\') AND (Image LIKE '%\\\\msedge.exe' ESCAPE '\\' OR Image LIKE '%\\\\msedgewebview2.exe' ESCAPE '\\')) OR (Image LIKE '%\\\\opera.exe' ESCAPE '\\') OR (Image LIKE '%\\\\safari.exe' ESCAPE '\\') OR (Image LIKE '%\\\\seamonkey.exe' ESCAPE '\\') OR (Image LIKE '%\\\\vivaldi.exe' ESCAPE '\\') OR (Image LIKE '%\\\\whale.exe' ESCAPE '\\')))"
-        ],
-        "filename": "dns_query_win_susp_ipify.yml"
-    },
     {
         "title": "DNS Query Request By Regsvr32.EXE",
         "id": "36e037c4-c228-4866-b6a3-48eb292b9955",
@@ -8574,7 +8555,7 @@
     {
         "title": "DNS Query for Anonfiles.com Domain - Sysmon",
         "id": "065cceea-77ec-4030-9052-fc0affea7110",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects DNS queries for \"anonfiles.com\", which is an anonymous file upload platform often used for malicious purposes",
         "author": "pH-T (Nextron Systems)",
         "tags": [
@@ -8685,6 +8666,25 @@
         ],
         "filename": "dns_query_win_vscode_tunnel_communication.yml"
     },
+    {
+        "title": "Suspicious DNS Query for IP Lookup Service APIs",
+        "id": "ec82e2a5-81ea-4211-a1f8-37a0286df2c2",
+        "status": "test",
+        "description": "Detects DNS queries for IP lookup services such as \"api.ipify.org\" originating from a non browser process.",
+        "author": "Brandon George (blog post), Thomas Patzke",
+        "tags": [
+            "attack.reconnaissance",
+            "attack.t1590"
+        ],
+        "falsepositives": [
+            "Legitimate usage of IP lookup services such as ipify API"
+        ],
+        "level": "medium",
+        "rule": [
+            "SELECT * FROM logs WHERE ((EventID = '22' AND Channel = 'Microsoft-Windows-Sysmon/Operational') AND (QueryName LIKE '%api.2ip.ua%' ESCAPE '\\' OR QueryName LIKE '%api.bigdatacloud.net%' ESCAPE '\\' OR QueryName LIKE '%api.ipify.org%' ESCAPE '\\' OR QueryName LIKE '%bot.whatismyipaddress.com%' ESCAPE '\\' OR QueryName LIKE '%canireachthe.net%' ESCAPE '\\' OR QueryName LIKE '%checkip.amazonaws.com%' ESCAPE '\\' OR QueryName LIKE '%checkip.dyndns.org%' ESCAPE '\\' OR QueryName LIKE '%curlmyip.com%' ESCAPE '\\' OR QueryName LIKE '%db-ip.com%' ESCAPE '\\' OR QueryName LIKE '%edns.ip-api.com%' ESCAPE '\\' OR QueryName LIKE '%eth0.me%' ESCAPE '\\' OR QueryName LIKE '%freegeoip.app%' ESCAPE '\\' OR QueryName LIKE '%geoipy.com%' ESCAPE '\\' OR QueryName LIKE '%getip.pro%' ESCAPE '\\' OR QueryName LIKE '%icanhazip.com%' ESCAPE '\\' OR QueryName LIKE '%ident.me%' ESCAPE '\\' OR QueryName LIKE '%ifconfig.io%' ESCAPE '\\' OR QueryName LIKE '%ifconfig.me%' ESCAPE '\\' OR QueryName LIKE '%ipapi.co%' ESCAPE '\\' OR QueryName LIKE '%ip-api.com%' ESCAPE '\\' OR QueryName LIKE '%ip.anysrc.net%' ESCAPE '\\' OR QueryName LIKE '%ip.tyk.nu%' ESCAPE '\\' OR QueryName LIKE '%ipaddressworld.com%' ESCAPE '\\' OR QueryName LIKE '%ipecho.net%' ESCAPE '\\' OR QueryName LIKE '%ipinfo.io%' ESCAPE '\\' OR QueryName LIKE '%ipof.in%' ESCAPE '\\' OR QueryName LIKE '%ipv4.icanhazip.com%' ESCAPE '\\' OR QueryName LIKE '%ipv4bot.whatismyipaddress.com%' ESCAPE '\\' OR QueryName LIKE '%ipwho.is%' ESCAPE '\\' OR QueryName LIKE '%l2.io%' ESCAPE '\\' OR QueryName LIKE '%myexternalip.com%' ESCAPE '\\' OR QueryName LIKE '%wgetip.com%' ESCAPE '\\' OR QueryName LIKE '%whatismyip.akamai.com%' ESCAPE '\\' OR QueryName LIKE '%wtfismyip.com%' ESCAPE '\\') AND NOT ((Image LIKE '%\\\\brave.exe' ESCAPE '\\') OR ((Image LIKE 'C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files (x86)\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\')) OR ((Image LIKE 'C:\\\\Program Files\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\')) OR ((Image LIKE 'C:\\\\Program Files (x86)\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\')) OR (Image LIKE '%\\\\maxthon.exe' ESCAPE '\\') OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\%' ESCAPE '\\' OR Image LIKE '%\\\\WindowsApps\\\\MicrosoftEdge.exe' ESCAPE '\\' OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\')) OR ((Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\') AND (Image LIKE '%\\\\msedge.exe' ESCAPE '\\' OR Image LIKE '%\\\\msedgewebview2.exe' ESCAPE '\\')) OR (Image LIKE '%\\\\opera.exe' ESCAPE '\\') OR (Image LIKE '%\\\\safari.exe' ESCAPE '\\') OR (Image LIKE '%\\\\seamonkey.exe' ESCAPE '\\') OR (Image LIKE '%\\\\vivaldi.exe' ESCAPE '\\') OR (Image LIKE '%\\\\whale.exe' ESCAPE '\\')))"
+        ],
+        "filename": "dns_query_win_susp_external_ip_lookup.yml"
+    },
     {
         "title": "DNS Query Tor .Onion Address - Sysmon",
         "id": "b55ca2a3-7cff-4dda-8bdd-c7bfa63bf544",
@@ -10431,7 +10431,7 @@
     {
         "title": "Potential DLL Sideloading Of Non-Existent DLLs From System Folders",
         "id": "6b98b92b-4f00-4f62-b4fe-4d1920215771",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects DLL sideloading of system dlls that are not present on the system by default. Usually to achieve techniques such as UAC bypass and privilege escalation",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -10509,6 +10509,28 @@
         ],
         "filename": "registry_set_office_trusted_location.yml"
     },
+    {
+        "title": "Registry Set With Crypto-Classes From The \"Cryptography\" PowerShell Namespace",
+        "id": "1c2a3268-3881-414a-80af-a5b313b14c0e",
+        "status": "experimental",
+        "description": "Detects the setting of a registry inside the \"\\Shell\\Open\\Command\" value with PowerShell classes from the \"System.Security.Cryptography\" namespace.\nThe PowerShell namespace \"System.Security.Cryptography\" provides classes for on-the-fly encryption and decryption.\nThese can be used for example in decrypting malicious payload for defense evasion.\n",
+        "author": "Andreas Braathen (mnemonic.io)",
+        "tags": [
+            "attack.defense_evasion",
+            "attack.t1059.001",
+            "attack.t1027.010",
+            "attack.t1547.001",
+            "detection.threat_hunting"
+        ],
+        "falsepositives": [
+            "Classes are legitimately used, but less so when e.g. parents with low prevalence or decryption of content in temporary folders."
+        ],
+        "level": "medium",
+        "rule": [
+            "SELECT * FROM logs WHERE (EventID = '13' AND Channel = 'Microsoft-Windows-Sysmon/Operational' AND EventType = 'SetValue' AND TargetObject LIKE '%\\\\Shell\\\\Open\\\\Command%' ESCAPE '\\' AND (Details LIKE '%powershell%' ESCAPE '\\' OR Details LIKE '%pwsh%' ESCAPE '\\') AND Details LIKE '%System.Security.Cryptography.%' ESCAPE '\\' AND (Details LIKE '%.AesCryptoServiceProvider%' ESCAPE '\\' OR Details LIKE '%.DESCryptoServiceProvider%' ESCAPE '\\' OR Details LIKE '%.DSACryptoServiceProvider%' ESCAPE '\\' OR Details LIKE '%.RC2CryptoServiceProvider%' ESCAPE '\\' OR Details LIKE '%.Rijndael%' ESCAPE '\\' OR Details LIKE '%.RSACryptoServiceProvider%' ESCAPE '\\' OR Details LIKE '%.TripleDESCryptoServiceProvider%' ESCAPE '\\'))"
+        ],
+        "filename": "registry_set_powershell_crypto_namespace.yml"
+    },
     {
         "title": "WinAPI Library Calls Via PowerShell Scripts",
         "id": "19d65a1c-8540-4140-8062-8eb00db0bba5",
@@ -10979,6 +11001,27 @@
         ],
         "filename": "proc_creation_win_susp_file_permission_modifications.yml"
     },
+    {
+        "title": "Invocation Of Crypto-Classes From The \"Cryptography\" PowerShell Namespace",
+        "id": "ad856965-f44d-42a8-945e-bbf7bd03d05a",
+        "status": "experimental",
+        "description": "Detects the invocation of PowerShell commands with references to classes from the \"System.Security.Cryptography\" namespace.\nThe PowerShell namespace \"System.Security.Cryptography\" provides classes for on-the-fly encryption and decryption.\nThese can be used for example in decrypting malicious payload for defense evasion.\n",
+        "author": "Andreas Braathen (mnemonic.io)",
+        "tags": [
+            "attack.defense_evasion",
+            "attack.t1059.001",
+            "attack.t1027.010",
+            "detection.threat_hunting"
+        ],
+        "falsepositives": [
+            "Classes are legitimately used, but less so when e.g. parents with low prevalence or decryption of content in temporary folders."
+        ],
+        "level": "medium",
+        "rule": [
+            "SELECT * FROM logs WHERE ((EventID = '1' AND Channel = 'Microsoft-Windows-Sysmon/Operational') AND ((Image LIKE '%\\\\powershell.exe' ESCAPE '\\' OR Image LIKE '%\\\\pwsh.exe' ESCAPE '\\') OR OriginalFileName IN ('PowerShell.EXE', 'pwsh.dll')) AND CommandLine LIKE '%System.Security.Cryptography.%' ESCAPE '\\' AND (CommandLine LIKE '%.AesCryptoServiceProvider%' ESCAPE '\\' OR CommandLine LIKE '%.DESCryptoServiceProvider%' ESCAPE '\\' OR CommandLine LIKE '%.DSACryptoServiceProvider%' ESCAPE '\\' OR CommandLine LIKE '%.RC2CryptoServiceProvider%' ESCAPE '\\' OR CommandLine LIKE '%.Rijndael%' ESCAPE '\\' OR CommandLine LIKE '%.RSACryptoServiceProvider%' ESCAPE '\\' OR CommandLine LIKE '%.TripleDESCryptoServiceProvider%' ESCAPE '\\'))"
+        ],
+        "filename": "proc_creation_win_powershell_crypto_namespace.yml"
+    },
     {
         "title": "ClickOnce Deployment Execution - Dfsvc.EXE Child Process",
         "id": "241d52b5-eee0-49d0-ac8a-8b9c15c7221c",
@@ -12335,7 +12378,7 @@
     {
         "title": "Suspicious Startup Folder Persistence",
         "id": "28208707-fe31-437f-9a7f-4b1108b94d2e",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when a file with a suspicious extension is created in the startup folder",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -13865,7 +13908,7 @@
     {
         "title": "VsCode Powershell Profile Modification",
         "id": "3a9fa2ec-30bc-4ebd-b49e-7c9cff225502",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the creation or modification of a vscode related powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -16777,7 +16820,7 @@
     {
         "title": "Potential Exploitation Attempt From Office Application",
         "id": "868955d9-697e-45d4-a3da-360cefd7c216",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects Office applications executing a child process that includes directory traversal patterns. This could be an attempt to exploit CVE-2022-30190 (MSDT RCE) or CVE-2021-40444 (MSHTML RCE)",
         "author": "Christian Burkard (Nextron Systems), @SBousseaden (idea)",
         "tags": [
@@ -17718,7 +17761,7 @@
     {
         "title": "Potential CVE-2022-26809 Exploitation Attempt",
         "id": "a7cd7306-df8b-4398-b711-6f3e4935cf16",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious remote procedure call (RPC) service anomalies based on the spawned sub processes (long shot to detect the exploitation of vulnerabilities like CVE-2022-26809)",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -17824,7 +17867,7 @@
     {
         "title": "Potential Centos Web Panel Exploitation Attempt - CVE-2022-44877",
         "id": "1b2eeb27-949b-4704-8bfa-d8e5cfa045a1",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential exploitation attempts that target the Centos Web Panel 7 Unauthenticated Remote Code Execution CVE-2022-44877",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -18313,7 +18356,7 @@
         ],
         "level": "high",
         "rule": [
-            "SELECT * FROM logs WHERE (EventID = '1' AND Channel = 'Microsoft-Windows-Sysmon/Operational' AND ParentImage LIKE '%\\\\ws\\_tomcatservice.exe' ESCAPE '\\' AND Image LIKE '%\\\\repadmin.exe' ESCAPE '\\')"
+            "SELECT * FROM logs WHERE ((EventID = '1' AND Channel = 'Microsoft-Windows-Sysmon/Operational') AND ParentImage LIKE '%\\\\ws\\_tomcatservice.exe' ESCAPE '\\' AND NOT ((Image LIKE '%\\\\repadmin.exe' ESCAPE '\\')))"
         ],
         "filename": "proc_creation_win_apt_mint_sandstorm_log4j_wstomcat_execution.yml"
     },
@@ -19299,7 +19342,7 @@
     {
         "title": "Potential Exploitation Attempt Of Undocumented WindowsServer RCE",
         "id": "6d5b8176-d87d-4402-8af4-53aee9db7b5d",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential exploitation attempt of undocumented Windows Server Pre Auth Remote Code Execution (RCE)",
         "author": "Florian Roth (Nextron Systems), Nasreddine Bencherchali",
         "tags": [
@@ -20814,7 +20857,7 @@
     {
         "title": "Deployment Of The AppX Package Was Blocked By The Policy",
         "id": "e021bbb5-407f-41f5-9dc9-1864c45a7a51",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an appx package deployment that was blocked by the local computer policy",
         "author": "frack113",
         "tags": [
@@ -20832,7 +20875,7 @@
     {
         "title": "Suspicious AppX Package Locations",
         "id": "5cdeaf3d-1489-477c-95ab-c318559fc051",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an appx package added the pipeline of the \"to be processed\" packages which is located in suspicious locations",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -20868,7 +20911,7 @@
     {
         "title": "Deployment AppX Package Was Blocked By AppLocker",
         "id": "6ae53108-c3a0-4bee-8f45-c7591a2c337f",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an appx package deployment that was blocked by AppLocker policy",
         "author": "frack113",
         "tags": [
@@ -20886,7 +20929,7 @@
     {
         "title": "Suspicious AppX Package Installation Attempt",
         "id": "898d5fc9-fbc3-43de-93ad-38e97237c344",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an appx package installation with the error code \"0x80073cff\" which indicates that the package didn't meet the signing requirements and could be suspicious",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -20904,7 +20947,7 @@
     {
         "title": "Uncommon AppX Package Locations",
         "id": "c977cb50-3dff-4a9f-b873-9290f56132f1",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an appx package added the pipeline of the \"to be processed\" packages which is located in uncommon locations",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -20922,7 +20965,7 @@
     {
         "title": "Potential Malicious AppX Package Installation Attempts",
         "id": "09d3b48b-be17-47f5-bf4e-94e7e75d09ce",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential installation or installation attempts of known malicious appx packages",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -21333,7 +21376,7 @@
     {
         "title": "Suspicious Digital Signature Of AppX Package",
         "id": "b5aa7d60-c17e-4538-97de-09029d6cd76b",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of AppX packages with known suspicious or malicious signature",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -24017,7 +24060,7 @@
     {
         "title": "DNS Query for Anonfiles.com Domain - DNS Client",
         "id": "29f171d7-aa47-42c7-9c7b-3c87938164d9",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects DNS queries for anonfiles.com, which is an anonymous file upload platform often used for malicious purposes",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -25862,7 +25905,7 @@
     {
         "title": "Restricted Software Access By SRP",
         "id": "b4c8da4a-1c12-46b0-8a2b-0a8521d03442",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects restricted access to applications by the Software Restriction Policies (SRP) policy",
         "author": "frack113",
         "tags": [
@@ -26593,7 +26636,7 @@
         ],
         "level": "medium",
         "rule": [
-            "SELECT * FROM logs WHERE ((EventID = '3' AND Channel = 'Microsoft-Windows-Sysmon/Operational') AND (DestinationHostname LIKE '%api.2ip.ua%' ESCAPE '\\' OR DestinationHostname LIKE '%api.ipify.org%' ESCAPE '\\' OR DestinationHostname LIKE '%bot.whatismyipaddress.com%' ESCAPE '\\' OR DestinationHostname LIKE '%canireachthe.net%' ESCAPE '\\' OR DestinationHostname LIKE '%checkip.amazonaws.com%' ESCAPE '\\' OR DestinationHostname LIKE '%checkip.dyndns.org%' ESCAPE '\\' OR DestinationHostname LIKE '%curlmyip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%edns.ip-api.com%' ESCAPE '\\' OR DestinationHostname LIKE '%eth0.me%' ESCAPE '\\' OR DestinationHostname LIKE '%freegeoip.app%' ESCAPE '\\' OR DestinationHostname LIKE '%geoipy.com%' ESCAPE '\\' OR DestinationHostname LIKE '%getip.pro%' ESCAPE '\\' OR DestinationHostname LIKE '%icanhazip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ident.me%' ESCAPE '\\' OR DestinationHostname LIKE '%ifconfig.io%' ESCAPE '\\' OR DestinationHostname LIKE '%ifconfig.me%' ESCAPE '\\' OR DestinationHostname LIKE '%ip-api.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ip.anysrc.net%' ESCAPE '\\' OR DestinationHostname LIKE '%ip.tyk.nu%' ESCAPE '\\' OR DestinationHostname LIKE '%ipaddressworld.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ipecho.net%' ESCAPE '\\' OR DestinationHostname LIKE '%ipinfo.io%' ESCAPE '\\' OR DestinationHostname LIKE '%ipof.in%' ESCAPE '\\' OR DestinationHostname LIKE '%ipv4.icanhazip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ipv4bot.whatismyipaddress.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ipwho.is%' ESCAPE '\\' OR DestinationHostname LIKE '%l2.io%' ESCAPE '\\' OR DestinationHostname LIKE '%myexternalip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%wgetip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%whatismyip.akamai.com%' ESCAPE '\\' OR DestinationHostname LIKE '%wtfismyip.com%' ESCAPE '\\') AND NOT ((Image LIKE '%\\\\brave.exe' ESCAPE '\\') OR ((Image LIKE 'C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files (x86)\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\')) OR ((Image LIKE 'C:\\\\Program Files\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\')) OR ((Image LIKE 'C:\\\\Program Files (x86)\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\')) OR (Image LIKE '%\\\\maxthon.exe' ESCAPE '\\') OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\%' ESCAPE '\\' OR Image LIKE '%\\\\WindowsApps\\\\MicrosoftEdge.exe' ESCAPE '\\' OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\')) OR ((Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\') AND (Image LIKE '%\\\\msedge.exe' ESCAPE '\\' OR Image LIKE '%\\\\msedgewebview2.exe' ESCAPE '\\')) OR (Image LIKE '%\\\\opera.exe' ESCAPE '\\') OR (Image LIKE '%\\\\safari.exe' ESCAPE '\\') OR (Image LIKE '%\\\\seamonkey.exe' ESCAPE '\\') OR (Image LIKE '%\\\\vivaldi.exe' ESCAPE '\\') OR (Image LIKE '%\\\\whale.exe' ESCAPE '\\')))"
+            "SELECT * FROM logs WHERE ((EventID = '3' AND Channel = 'Microsoft-Windows-Sysmon/Operational') AND (DestinationHostname LIKE '%api.2ip.ua%' ESCAPE '\\' OR DestinationHostname LIKE '%api.bigdatacloud.net%' ESCAPE '\\' OR DestinationHostname LIKE '%api.ipify.org%' ESCAPE '\\' OR DestinationHostname LIKE '%bot.whatismyipaddress.com%' ESCAPE '\\' OR DestinationHostname LIKE '%canireachthe.net%' ESCAPE '\\' OR DestinationHostname LIKE '%checkip.amazonaws.com%' ESCAPE '\\' OR DestinationHostname LIKE '%checkip.dyndns.org%' ESCAPE '\\' OR DestinationHostname LIKE '%curlmyip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%db-ip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%edns.ip-api.com%' ESCAPE '\\' OR DestinationHostname LIKE '%eth0.me%' ESCAPE '\\' OR DestinationHostname LIKE '%freegeoip.app%' ESCAPE '\\' OR DestinationHostname LIKE '%geoipy.com%' ESCAPE '\\' OR DestinationHostname LIKE '%getip.pro%' ESCAPE '\\' OR DestinationHostname LIKE '%icanhazip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ident.me%' ESCAPE '\\' OR DestinationHostname LIKE '%ifconfig.io%' ESCAPE '\\' OR DestinationHostname LIKE '%ifconfig.me%' ESCAPE '\\' OR DestinationHostname LIKE '%ipapi.co%' ESCAPE '\\' OR DestinationHostname LIKE '%ip-api.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ip.anysrc.net%' ESCAPE '\\' OR DestinationHostname LIKE '%ip.tyk.nu%' ESCAPE '\\' OR DestinationHostname LIKE '%ipaddressworld.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ipecho.net%' ESCAPE '\\' OR DestinationHostname LIKE '%ipinfo.io%' ESCAPE '\\' OR DestinationHostname LIKE '%ipof.in%' ESCAPE '\\' OR DestinationHostname LIKE '%ipv4.icanhazip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ipv4bot.whatismyipaddress.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ipwho.is%' ESCAPE '\\' OR DestinationHostname LIKE '%l2.io%' ESCAPE '\\' OR DestinationHostname LIKE '%myexternalip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%wgetip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%whatismyip.akamai.com%' ESCAPE '\\' OR DestinationHostname LIKE '%wtfismyip.com%' ESCAPE '\\') AND NOT ((Image LIKE '%\\\\brave.exe' ESCAPE '\\') OR ((Image LIKE 'C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files (x86)\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\')) OR ((Image LIKE 'C:\\\\Program Files\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\')) OR ((Image LIKE 'C:\\\\Program Files (x86)\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\')) OR (Image LIKE '%\\\\maxthon.exe' ESCAPE '\\') OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\%' ESCAPE '\\' OR Image LIKE '%\\\\WindowsApps\\\\MicrosoftEdge.exe' ESCAPE '\\' OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\')) OR ((Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\') AND (Image LIKE '%\\\\msedge.exe' ESCAPE '\\' OR Image LIKE '%\\\\msedgewebview2.exe' ESCAPE '\\')) OR (Image LIKE '%\\\\opera.exe' ESCAPE '\\') OR (Image LIKE '%\\\\safari.exe' ESCAPE '\\') OR (Image LIKE '%\\\\seamonkey.exe' ESCAPE '\\') OR (Image LIKE '%\\\\vivaldi.exe' ESCAPE '\\') OR (Image LIKE '%\\\\whale.exe' ESCAPE '\\')))"
         ],
         "filename": "net_connection_win_susp_external_ip_lookup.yml"
     },
@@ -27211,7 +27254,7 @@
     {
         "title": "Renamed Plink Execution",
         "id": "1c12727d-02bf-45ff-a9f3-d49806a3cf43",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed version of the Plink binary",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -27251,7 +27294,7 @@
     {
         "title": "Potential Password Spraying Attempt Using Dsacls.EXE",
         "id": "bac9fb54-2da7-44e9-988f-11e9a5edbc0c",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects possible password spraying attempts using Dsacls",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -28365,7 +28408,7 @@
     {
         "title": "Potential Persistence Via Powershell Search Order Hijacking - Task",
         "id": "b66474aa-bd92-4333-a16c-298155b120df",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell \"Get-Variable\" technique as seen being used in Colibri Loader",
         "author": "pH-T (Nextron Systems), Florian Roth (Nextron Systems)",
         "tags": [
@@ -28912,7 +28955,7 @@
     {
         "title": "SQLite Chromium Profile Data DB Access",
         "id": "24c77512-782b-448a-8950-eddb0785fc71",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect usage of the \"sqlite\" binary to query databases in Chromium-based browsers for potential data stealing.",
         "author": "TropChaud",
         "tags": [
@@ -29293,7 +29336,7 @@
     {
         "title": "Potential Active Directory Enumeration Using AD Module - ProcCreation",
         "id": "70bc5215-526f-4477-963c-a47a5c9ebd12",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of the \"Import-Module\" cmdlet to load the \"Microsoft.ActiveDirectory.Management.dl\" DLL. Which is often used by attackers to perform AD enumeration.",
         "author": "frack113",
         "tags": [
@@ -29504,7 +29547,7 @@
     {
         "title": "Renamed NetSupport RAT Execution",
         "id": "0afbd410-de03-4078-8491-f132303cb67d",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed \"client32.exe\" (NetSupport RAT) via Imphash, Product and OriginalFileName strings",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -29744,7 +29787,7 @@
     {
         "title": "PDQ Deploy Remote Adminstartion Tool Execution",
         "id": "d679950c-abb7-43a6-80fb-2a480c4fc450",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect use of PDQ Deploy remote admin tool",
         "author": "frack113",
         "tags": [
@@ -30133,7 +30176,7 @@
     {
         "title": "HackTool - Inveigh Execution",
         "id": "b99a1518-1ad5-4f65-bc95-1ffff97a8fd0",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -30468,7 +30511,7 @@
     {
         "title": "Disabled RestrictedAdminMode For RDS - ProcCreation",
         "id": "28ac00d6-22d9-4a3c-927f-bbd770104573",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect activation of DisableRestrictedAdmin to disable RestrictedAdmin mode.\nRestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.\nThis prevents your credentials from being harvested during the initial connection process if the remote server has been compromise\n",
         "author": "frack113",
         "tags": [
@@ -30528,7 +30571,7 @@
     {
         "title": "Unsigned AppX Installation Attempt Using Add-AppxPackage",
         "id": "37651c2a-42cd-4a69-ae0d-22a4349aa04a",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of the \"Add-AppxPackage\" or it's alias \"Add-AppPackage\" to install unsigned AppX packages",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -30821,7 +30864,7 @@
     {
         "title": "HackTool - SafetyKatz Execution",
         "id": "b1876533-4ed5-4a83-90f3-b8645840a413",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the hacktool SafetyKatz via PE information and default Image name",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -31211,7 +31254,7 @@
     {
         "title": "Potential Renamed Rundll32 Execution",
         "id": "2569ed8c-1147-498a-9b8c-2ad3656b10ed",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when 'DllRegisterServer' is called in the commandline and the image is not rundll32. This could mean that the 'rundll32' utility has been renamed in order to avoid detection",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -31343,7 +31386,7 @@
     {
         "title": "PUA - DefenderCheck Execution",
         "id": "f0ca6c24-3225-47d5-b1f5-352bf07ecfa7",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of DefenderCheck, a tool to evaluate the signatures used in Microsoft Defender. It can be used to figure out the strings / byte chains used in Microsoft Defender to detect a tool and thus used for AV evasion.",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -31842,7 +31885,7 @@
     {
         "title": "Suspicious Hacktool Execution - Imphash",
         "id": "24e3e58a-646b-4b50-adef-02ef935b9fc8",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -32499,7 +32542,7 @@
     {
         "title": "Microsoft IIS Service Account Password Dumped",
         "id": "2d3cdeec-c0db-45b4-aa86-082f7eb75701",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords",
         "author": "Tim Rauch, Janantha Marasinghe",
         "tags": [
@@ -33395,7 +33438,7 @@
     {
         "title": "Potential WinAPI Calls Via CommandLine",
         "id": "ba3f5c1b-6272-4119-9dbd-0bc8d21c2702",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -33515,7 +33558,7 @@
     {
         "title": "PUA - Seatbelt Execution",
         "id": "38646daa-e78f-4ace-9de0-55547b2d30da",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -33578,7 +33621,7 @@
     {
         "title": "Potential Arbitrary Code Execution Via Node.EXE",
         "id": "6640f31c-01ad-49b5-beb5-83498a5cd8bd",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution node.exe which is shipped with multiple software such as VMware, Adobe...etc. In order to execute arbitrary code. For example to establish reverse shell as seen in Log4j attacks...etc",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -33880,7 +33923,7 @@
     {
         "title": "HackTool - SharPersist Execution",
         "id": "26488ad0-f9fd-4536-876f-52fea846a2e4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the hacktool SharPersist - used to deploy various different kinds of persistence mechanisms",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -33983,7 +34026,7 @@
     {
         "title": "Uncommon One Time Only Scheduled Task At 00:00",
         "id": "970823b7-273b-460a-8afc-3a6811998529",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects scheduled task creation events that include suspicious actions, and is run once at 00:00",
         "author": "pH-T (Nextron Systems)",
         "tags": [
@@ -34157,7 +34200,7 @@
     {
         "title": "Suspicious New Instance Of An Office COM Object",
         "id": "9bdaf1e9-fdef-443b-8081-4341b74a7e28",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an svchost process spawning an instance of an office application. This happens when the initial word application creates an instance of one of the Office COM objects such as 'Word.Application', 'Excel.Application', etc.\nThis can be used by malicious actors to create malicious Office documents with macros on the fly. (See vba2clr project in the references)\n",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -34914,7 +34957,7 @@
     {
         "title": "Potential DLL Sideloading Via DeviceEnroller.EXE",
         "id": "e173ad47-4388-4012-ae62-bd13f71c18a8",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of the PhoneDeepLink parameter to potentially sideload a DLL file that does not exist. This non-existent DLL file is named \"ShellChromeAPI.dll\".\nAdversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter\n",
         "author": "@gott_cyber",
         "tags": [
@@ -35108,7 +35151,7 @@
     {
         "title": "Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE",
         "id": "07f8bdc2-c9b3-472a-9817-5a670b872f53",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of cmdkey to look for cached credentials on the system",
         "author": "jmallette, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -35264,7 +35307,7 @@
     {
         "title": "Operator Bloopers Cobalt Strike Modules",
         "id": "4f154fb6-27d1-4813-a759-78b93e0b9c48",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects Cobalt Strike module/commands accidentally entered in CMD shell",
         "author": "_pete_0, TheDFIRReport",
         "tags": [
@@ -36423,7 +36466,7 @@
     {
         "title": "HackTool - KrbRelayUp Execution",
         "id": "12827a56-61a4-476a-a9cb-f3068f191073",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -37009,7 +37052,7 @@
     {
         "title": "Disable Windows IIS HTTP Logging",
         "id": "e4ed6030-ffe5-4e6a-8a8a-ab3c1ab9d94e",
-        "status": "experimental",
+        "status": "test",
         "description": "Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union)",
         "author": "frack113",
         "tags": [
@@ -37136,7 +37179,7 @@
     {
         "title": "Suspicious IIS URL GlobalRules Rewrite Via AppCmd",
         "id": "7c8af9b2-dcae-41a2-a9db-b28c288b5f08",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of \"appcmd\" to create new global URL rewrite rules. This behaviour has been observed being used by threat actors to add new rules so they can access their webshells.",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -38168,7 +38211,7 @@
     {
         "title": "Suspicious Git Clone",
         "id": "aef9d1f1-7396-4e92-a927-4567c7a495c1",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of \"git\" in order to clone a remote repository that contain suspicious keywords which might be suspicious",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -38225,7 +38268,7 @@
     {
         "title": "HackTool - KrbRelay Execution",
         "id": "e96253b8-6b3b-4f90-9e59-3b24b99cf9b4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of KrbRelay, a Kerberos relaying tool",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -38263,7 +38306,7 @@
     {
         "title": "New Remote Desktop Connection Initiated Via Mstsc.EXE",
         "id": "954f0af7-62dd-418f-b3df-a84bc2c7a774",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the usage of \"mstsc.exe\" with the \"/v\" flag to initiate a connection to a remote server.\nAdversaries may use valid accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.\n",
         "author": "frack113",
         "tags": [
@@ -38439,7 +38482,7 @@
     {
         "title": "HackTool - PowerTool Execution",
         "id": "a34f79a3-8e5f-4cc3-b765-de00695452c2",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the tool PowerTool which has the ability to kill a process, delete its process file, unload drivers, and delete the driver files",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -38477,7 +38520,7 @@
     {
         "title": "Potentially Over Permissive Permissions Granted Using Dsacls.EXE",
         "id": "01c42d3c-242d-4655-85b2-34f1739632f7",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of Dsacls to grant over permissive permissions",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -38631,7 +38674,7 @@
     {
         "title": "Potential Credential Dumping Attempt Using New NetworkProvider - CLI",
         "id": "baef1ec6-2ca9-47a3-97cc-4cf2bda10b77",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -38691,7 +38734,7 @@
     {
         "title": "Potential Recon Activity Via Nltest.EXE",
         "id": "5cc90652-4cbd-4241-aa3b-4b462fa5a248",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects nltest commands that can be used for information discovery",
         "author": "Craig Young, oscd.community, Georg Lauenstein",
         "tags": [
@@ -39038,7 +39081,7 @@
     {
         "title": "HackTool - SharpLdapWhoami Execution",
         "id": "d9367cbb-c2e0-47ce-bdc0-128cb6da898d",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -39079,7 +39122,7 @@
     {
         "title": "SafeBoot Registry Key Deleted Via Reg.EXE",
         "id": "fc0e89b5-adb0-43c1-b749-c12a10ec37de",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of \"reg.exe\" commands with the \"delete\" flag on safe boot registry keys. Often used by attacker to prevent safeboot execution of security products",
         "author": "Nasreddine Bencherchali (Nextron Systems), Tim Shelton",
         "tags": [
@@ -39250,7 +39293,7 @@
     {
         "title": "Suspicious Binary In User Directory Spawned From Office Application",
         "id": "aa3a6f94-890e-4e22-b634-ffdfd54792cc",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an executable in the users directory started from one of the Microsoft Office suite applications (Word, Excel, PowerPoint, Publisher, Visio)",
         "author": "Jason Lynch",
         "tags": [
@@ -39331,7 +39374,7 @@
     {
         "title": "Fsutil Behavior Set SymlinkEvaluation",
         "id": "c0b2768a-dd06-4671-8339-b16ca8d1f27f",
-        "status": "experimental",
+        "status": "test",
         "description": "A symbolic link is a type of file that contains a reference to another file.\nThis is probably done to make sure that the ransomware is able to follow shortcuts on the machine in order to find the original file to encrypt\n",
         "author": "frack113",
         "tags": [
@@ -39603,7 +39646,7 @@
     {
         "title": "Suspicious Hacktool Execution - PE Metadata",
         "id": "37c1333a-a0db-48be-b64b-7393b2386e3b",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -39664,7 +39707,7 @@
     {
         "title": "Suspicious Rundll32 Script in CommandLine",
         "id": "73fcad2e-ff14-4c38-b11d-4172c8ac86c7",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious process related to rundll32 based on arguments",
         "author": "frack113, Zaw Min Htun (ZETA)",
         "tags": [
@@ -40299,7 +40342,7 @@
     {
         "title": "PowerShell Base64 Encoded WMI Classes",
         "id": "1816994b-42e1-4fb1-afd2-134d88184f71",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects calls to base64 encoded WMI class such as \"Win32_Shadowcopy\", \"Win32_ScheduledJob\", etc.",
         "author": "Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -40418,7 +40461,7 @@
     {
         "title": "HackTool - SysmonEOP Execution",
         "id": "8a7e90c5-fe6e-45dc-889e-057fe4378bd9",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -40477,7 +40520,7 @@
     {
         "title": "PUA - Fast Reverse Proxy (FRP) Execution",
         "id": "32410e29-5f94-4568-b6a3-d91a8adad863",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet.",
         "author": "frack113, Florian Roth",
         "tags": [
@@ -40540,7 +40583,7 @@
     {
         "title": "Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE",
         "id": "48917adc-a28e-4f5d-b729-11e75da8941f",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the usage of \"reg.exe\" to add Defender folder exclusions. Qbot has been seen using this technique to add exclusions for folders within AppData and ProgramData.",
         "author": "frack113",
         "tags": [
@@ -40961,7 +41004,7 @@
     {
         "title": "Operator Bloopers Cobalt Strike Commands",
         "id": "647c7b9e-d784-4fda-b9a0-45c565a7b729",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects use of Cobalt Strike commands accidentally entered in the CMD shell",
         "author": "_pete_0, TheDFIRReport",
         "tags": [
@@ -41385,7 +41428,7 @@
     {
         "title": "HackTool - HandleKatz LSASS Dumper Execution",
         "id": "ca621ba5-54ab-4035-9942-d378e6fcde3c",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -41816,7 +41859,7 @@
     {
         "title": "New Generic Credentials Added Via Cmdkey.EXE",
         "id": "b1ec66c6-f4d1-4b5c-96dd-af28ccae7727",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of cmdkey to add generic credentials. As an example, this has to be used before connecting to an RDP session via command line interface.",
         "author": "frack113, Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -42188,7 +42231,7 @@
     {
         "title": "Suspicious Shells Spawn by Java Utility Keytool",
         "id": "90fb5e62-ca1f-4e22-b42e-cc521874c938",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation)",
         "author": "Andreas Hunkeler (@Karneades)",
         "tags": [
@@ -42208,7 +42251,7 @@
     {
         "title": "PUA - NPS Tunneling Tool Execution",
         "id": "68d37776-61db-42f5-bf54-27e87072d17e",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of NPS, a port forwarding and intranet penetration proxy server",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -42364,7 +42407,7 @@
     {
         "title": "Renamed Msdt.EXE Execution",
         "id": "bd1c6866-65fc-44b2-be51-5588fcff82b9",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed \"Msdt.exe\" binary",
         "author": "pH-T (Nextron Systems)",
         "tags": [
@@ -42402,7 +42445,7 @@
     {
         "title": "Execution from Suspicious Folder",
         "id": "3dfd06d2-eaf4-4532-9555-68aca59f57c4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects a suspicious execution from an uncommon folder",
         "author": "Florian Roth (Nextron Systems), Tim Shelton",
         "tags": [
@@ -42557,7 +42600,7 @@
     {
         "title": "Lolbin Ssh.exe Use As Proxy",
         "id": "7d6d30b8-5b91-4b90-a891-46cccaf29598",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect usage of the \"ssh.exe\" binary as a proxy to launch other programs",
         "author": "frack113, Nasreddine Bencherchali",
         "tags": [
@@ -42654,7 +42697,7 @@
     {
         "title": "Renamed Mavinject.EXE Execution",
         "id": "e6474a1b-5390-49cd-ab41-8d88655f7394",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed version of the \"Mavinject\" process. Which can be abused to perform process injection using the \"/INJECTRUNNING\" flag",
         "author": "frack113, Florian Roth",
         "tags": [
@@ -43792,7 +43835,7 @@
     {
         "title": "Query Usage To Exfil Data",
         "id": "53ef0cef-fa24-4f25-a34a-6c72dfa2e6e2",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of \"query.exe\" a system binary to exfil information such as \"sessions\" and \"processes\" for later use",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -43907,7 +43950,7 @@
     {
         "title": "Potential PowerShell Execution Policy Tampering - ProcCreation",
         "id": "cf2e938e-9a3e-4fe8-a347-411642b28a9f",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects changes to the PowerShell execution policy registry key in order to bypass signing requirements for script execution from the CommandLine",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -43925,7 +43968,7 @@
     {
         "title": "Renamed BrowserCore.EXE Execution",
         "id": "8a4519e8-e64a-40b6-ae85-ba8ad2177559",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects process creation with a renamed BrowserCore.exe (used to extract Azure tokens)",
         "author": "Max Altgelt (Nextron Systems)",
         "tags": [
@@ -44139,7 +44182,7 @@
     {
         "title": "Suspicious Use of PsLogList",
         "id": "aae1243f-d8af-40d8-ab20-33fc6d0c55bc",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of the PsLogList utility to dump event log in order to extract admin accounts and perform account discovery or delete events logs",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -44346,7 +44389,7 @@
     {
         "title": "Renamed Vmnat.exe Execution",
         "id": "7b4f794b-590a-4ad4-ba18-7964a2832205",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects renamed vmnat.exe or portable version that can be used for DLL side-loading",
         "author": "elhoim",
         "tags": [
@@ -44365,7 +44408,7 @@
     {
         "title": "Renamed Sysinternals Sdelete Execution",
         "id": "c1d867fe-8d95-4487-aab4-e53f2d339f90",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of a renamed SysInternals Sdelete, which is something an administrator shouldn't do (the renaming)",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -44813,7 +44856,7 @@
     {
         "title": "Potential Signing Bypass Via Windows Developer Features",
         "id": "a383dec4-deec-4e6e-913b-ed9249670848",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when a user enable developer features such as \"Developer Mode\" or \"Application Sideloading\". Which allows the user to install untrusted packages.",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -44869,7 +44912,7 @@
     {
         "title": "Renamed Remote Utilities RAT (RURAT) Execution",
         "id": "9ef27c24-4903-4192-881a-3adde7ff92a5",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of renamed Remote Utilities (RURAT) via Product PE header field",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -45149,7 +45192,7 @@
     {
         "title": "Root Certificate Installed From Susp Locations",
         "id": "5f6a601c-2ecb-498b-9c33-660362323afa",
-        "status": "experimental",
+        "status": "test",
         "description": "Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -45168,7 +45211,7 @@
     {
         "title": "Potential Process Injection Via Msra.EXE",
         "id": "744a188b-0415-4792-896f-11ddb0588dbc",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential process injection via Microsoft Remote Asssistance (Msra.exe) by looking at suspicious child processes spawned from the aforementioned process. It has been a target used by many threat actors and used for discovery and persistence tactics",
         "author": "Alexander McDonald",
         "tags": [
@@ -45661,7 +45704,7 @@
     {
         "title": "Import PowerShell Modules From Suspicious Directories - ProcCreation",
         "id": "c31364f7-8be6-4b77-8483-dd2b5a7b69a3",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects powershell scripts that import modules from suspicious directories",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -45761,7 +45804,7 @@
     {
         "title": "Potential RDP Tunneling Via SSH",
         "id": "f7d7ebd5-a016-46e2-9c54-f9932f2d386d",
-        "status": "experimental",
+        "status": "test",
         "description": "Execution of ssh.exe to perform data exfiltration and tunneling through RDP",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -46053,7 +46096,7 @@
     {
         "title": "Potential Discovery Activity Via Dnscmd.EXE",
         "id": "b6457d63-d2a2-4e29-859d-4e7affc153d1",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an attempt to leverage dnscmd.exe to enumerate the DNS zones of a domain. DNS zones used to host the DNS records for a particular domain.",
         "author": "@gott_cyber",
         "tags": [
@@ -46094,7 +46137,7 @@
     {
         "title": "Service Registry Key Deleted Via Reg.EXE",
         "id": "05b2aa93-1210-42c8-8d9a-2fcc13b284f5",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of \"reg.exe\" commands with the \"delete\" flag on services registry key. Often used by attacker to remove AV software services",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -46384,7 +46427,7 @@
     {
         "title": "HackTool - Htran/NATBypass Execution",
         "id": "f5e3b62f-e577-4e59-931e-0a15b2b94e1e",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass)",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -46423,7 +46466,7 @@
     {
         "title": "SQLite Firefox Profile Data DB Access",
         "id": "4833155a-4053-4c9c-a997-777fcea0baa7",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect usage of the \"sqlite\" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.",
         "author": "frack113",
         "tags": [
diff --git a/rules/rules_windows_sysmon_pysigma.json b/rules/rules_windows_sysmon_pysigma.json
index 6a08e67..ec75150 100644
--- a/rules/rules_windows_sysmon_pysigma.json
+++ b/rules/rules_windows_sysmon_pysigma.json
@@ -2837,7 +2837,7 @@
     {
         "title": "HackTool - Inveigh Execution",
         "id": "b99a1518-1ad5-4f65-bc95-1ffff97a8fd0",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -2856,7 +2856,7 @@
     {
         "title": "HackTool - SafetyKatz Execution",
         "id": "b1876533-4ed5-4a83-90f3-b8645840a413",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the hacktool SafetyKatz via PE information and default Image name",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -2894,7 +2894,7 @@
     {
         "title": "Suspicious Hacktool Execution - Imphash",
         "id": "24e3e58a-646b-4b50-adef-02ef935b9fc8",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -3166,7 +3166,7 @@
     {
         "title": "HackTool - SysmonEOP Execution",
         "id": "8a7e90c5-fe6e-45dc-889e-057fe4378bd9",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -5887,7 +5887,7 @@
     {
         "title": "Potential Svchost Memory Access",
         "id": "166e9c50-8cd9-44af-815d-d1f0c0e90dde",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential access to svchost process memory such as that used by Invoke-Phantom to kill the winRM Windows event logging service.",
         "author": "Tim Burrell",
         "tags": [
@@ -6324,7 +6324,7 @@
     {
         "title": "Malicious PowerShell Scripts - PoshModule",
         "id": "41025fd7-0466-4650-a813-574aaacbe7f4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of known offensive powershell scripts used for exploitation or reconnaissance",
         "author": "frack113, Nasreddine Bencherchali",
         "tags": [
@@ -7538,7 +7538,7 @@
     {
         "title": "Malicious Nishang PowerShell Commandlets",
         "id": "f772cee9-b7c2-4cb2-8f07-49870adc02e0",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects Commandlet names and arguments from the Nishang exploitation framework",
         "author": "Alec Costello",
         "tags": [
@@ -7576,7 +7576,7 @@
     {
         "title": "DNS Query for Anonfiles.com Domain - Sysmon",
         "id": "065cceea-77ec-4030-9052-fc0affea7110",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects DNS queries for \"anonfiles.com\", which is an anonymous file upload platform often used for malicious purposes",
         "author": "pH-T (Nextron Systems)",
         "tags": [
@@ -8486,7 +8486,7 @@
     {
         "title": "Potential DLL Sideloading Of Non-Existent DLLs From System Folders",
         "id": "6b98b92b-4f00-4f62-b4fe-4d1920215771",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects DLL sideloading of system dlls that are not present on the system by default. Usually to achieve techniques such as UAC bypass and privilege escalation",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -9232,7 +9232,7 @@
     {
         "title": "Suspicious Startup Folder Persistence",
         "id": "28208707-fe31-437f-9a7f-4b1108b94d2e",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when a file with a suspicious extension is created in the startup folder",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -11527,7 +11527,7 @@
     {
         "title": "Potential Exploitation Attempt From Office Application",
         "id": "868955d9-697e-45d4-a3da-360cefd7c216",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects Office applications executing a child process that includes directory traversal patterns. This could be an attempt to exploit CVE-2022-30190 (MSDT RCE) or CVE-2021-40444 (MSHTML RCE)",
         "author": "Christian Burkard (Nextron Systems), @SBousseaden (idea)",
         "tags": [
@@ -12136,7 +12136,7 @@
     {
         "title": "Potential CVE-2022-26809 Exploitation Attempt",
         "id": "a7cd7306-df8b-4398-b711-6f3e4935cf16",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious remote procedure call (RPC) service anomalies based on the spawned sub processes (long shot to detect the exploitation of vulnerabilities like CVE-2022-26809)",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -12222,7 +12222,7 @@
     {
         "title": "Potential Centos Web Panel Exploitation Attempt - CVE-2022-44877",
         "id": "1b2eeb27-949b-4704-8bfa-d8e5cfa045a1",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential exploitation attempts that target the Centos Web Panel 7 Unauthenticated Remote Code Execution CVE-2022-44877",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -12632,7 +12632,7 @@
         ],
         "level": "high",
         "rule": [
-            "SELECT * FROM logs WHERE Channel='Microsoft-Windows-Sysmon/Operational' AND (EventID=1 AND (ParentImage LIKE '%\\\\ws\\_tomcatservice.exe' ESCAPE '\\' AND Image LIKE '%\\\\repadmin.exe' ESCAPE '\\'))"
+            "SELECT * FROM logs WHERE Channel='Microsoft-Windows-Sysmon/Operational' AND (EventID=1 AND (ParentImage LIKE '%\\\\ws\\_tomcatservice.exe' ESCAPE '\\' AND (NOT Image LIKE '%\\\\repadmin.exe' ESCAPE '\\')))"
         ],
         "filename": ""
     },
@@ -13330,7 +13330,7 @@
     {
         "title": "Potential Exploitation Attempt Of Undocumented WindowsServer RCE",
         "id": "6d5b8176-d87d-4402-8af4-53aee9db7b5d",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential exploitation attempt of undocumented Windows Server Pre Auth Remote Code Execution (RCE)",
         "author": "Florian Roth (Nextron Systems), Nasreddine Bencherchali",
         "tags": [
@@ -14196,7 +14196,7 @@
     {
         "title": "Suspicious AppX Package Locations",
         "id": "5cdeaf3d-1489-477c-95ab-c318559fc051",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an appx package added the pipeline of the \"to be processed\" packages which is located in suspicious locations",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -15995,7 +15995,7 @@
     {
         "title": "DNS Query for Anonfiles.com Domain - DNS Client",
         "id": "29f171d7-aa47-42c7-9c7b-3c87938164d9",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects DNS queries for anonfiles.com, which is an anonymous file upload platform often used for malicious purposes",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -17039,7 +17039,7 @@
     {
         "title": "Restricted Software Access By SRP",
         "id": "b4c8da4a-1c12-46b0-8a2b-0a8521d03442",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects restricted access to applications by the Software Restriction Policies (SRP) policy",
         "author": "frack113",
         "tags": [
@@ -17746,7 +17746,7 @@
     {
         "title": "Renamed Plink Execution",
         "id": "1c12727d-02bf-45ff-a9f3-d49806a3cf43",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed version of the Plink binary",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -18359,7 +18359,7 @@
     {
         "title": "Potential Persistence Via Powershell Search Order Hijacking - Task",
         "id": "b66474aa-bd92-4333-a16c-298155b120df",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell \"Get-Variable\" technique as seen being used in Colibri Loader",
         "author": "pH-T (Nextron Systems), Florian Roth (Nextron Systems)",
         "tags": [
@@ -18616,7 +18616,7 @@
     {
         "title": "SQLite Chromium Profile Data DB Access",
         "id": "24c77512-782b-448a-8950-eddb0785fc71",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect usage of the \"sqlite\" binary to query databases in Chromium-based browsers for potential data stealing.",
         "author": "TropChaud",
         "tags": [
@@ -18936,7 +18936,7 @@
     {
         "title": "Renamed NetSupport RAT Execution",
         "id": "0afbd410-de03-4078-8491-f132303cb67d",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed \"client32.exe\" (NetSupport RAT) via Imphash, Product and OriginalFileName strings",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -19452,7 +19452,7 @@
     {
         "title": "Disabled RestrictedAdminMode For RDS - ProcCreation",
         "id": "28ac00d6-22d9-4a3c-927f-bbd770104573",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect activation of DisableRestrictedAdmin to disable RestrictedAdmin mode.\nRestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.\nThis prevents your credentials from being harvested during the initial connection process if the remote server has been compromise\n",
         "author": "frack113",
         "tags": [
@@ -19846,7 +19846,7 @@
     {
         "title": "Potential Renamed Rundll32 Execution",
         "id": "2569ed8c-1147-498a-9b8c-2ad3656b10ed",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when 'DllRegisterServer' is called in the commandline and the image is not rundll32. This could mean that the 'rundll32' utility has been renamed in order to avoid detection",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -19940,7 +19940,7 @@
     {
         "title": "PUA - DefenderCheck Execution",
         "id": "f0ca6c24-3225-47d5-b1f5-352bf07ecfa7",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of DefenderCheck, a tool to evaluate the signatures used in Microsoft Defender. It can be used to figure out the strings / byte chains used in Microsoft Defender to detect a tool and thus used for AV evasion.",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -20561,7 +20561,7 @@
     {
         "title": "Microsoft IIS Service Account Password Dumped",
         "id": "2d3cdeec-c0db-45b4-aa86-082f7eb75701",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords",
         "author": "Tim Rauch, Janantha Marasinghe",
         "tags": [
@@ -21030,7 +21030,7 @@
     {
         "title": "Potential WinAPI Calls Via CommandLine",
         "id": "ba3f5c1b-6272-4119-9dbd-0bc8d21c2702",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -21110,7 +21110,7 @@
     {
         "title": "PUA - Seatbelt Execution",
         "id": "38646daa-e78f-4ace-9de0-55547b2d30da",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -21173,7 +21173,7 @@
     {
         "title": "Potential Arbitrary Code Execution Via Node.EXE",
         "id": "6640f31c-01ad-49b5-beb5-83498a5cd8bd",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution node.exe which is shipped with multiple software such as VMware, Adobe...etc. In order to execute arbitrary code. For example to establish reverse shell as seen in Log4j attacks...etc",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -21393,7 +21393,7 @@
     {
         "title": "HackTool - SharPersist Execution",
         "id": "26488ad0-f9fd-4536-876f-52fea846a2e4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the hacktool SharPersist - used to deploy various different kinds of persistence mechanisms",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -21435,7 +21435,7 @@
     {
         "title": "Uncommon One Time Only Scheduled Task At 00:00",
         "id": "970823b7-273b-460a-8afc-3a6811998529",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects scheduled task creation events that include suspicious actions, and is run once at 00:00",
         "author": "pH-T (Nextron Systems)",
         "tags": [
@@ -21966,7 +21966,7 @@
     {
         "title": "Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE",
         "id": "07f8bdc2-c9b3-472a-9817-5a670b872f53",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of cmdkey to look for cached credentials on the system",
         "author": "jmallette, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -22042,7 +22042,7 @@
     {
         "title": "Operator Bloopers Cobalt Strike Modules",
         "id": "4f154fb6-27d1-4813-a759-78b93e0b9c48",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects Cobalt Strike module/commands accidentally entered in CMD shell",
         "author": "_pete_0, TheDFIRReport",
         "tags": [
@@ -22685,7 +22685,7 @@
     {
         "title": "HackTool - KrbRelayUp Execution",
         "id": "12827a56-61a4-476a-a9cb-f3068f191073",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -22976,7 +22976,7 @@
     {
         "title": "Disable Windows IIS HTTP Logging",
         "id": "e4ed6030-ffe5-4e6a-8a8a-ab3c1ab9d94e",
-        "status": "experimental",
+        "status": "test",
         "description": "Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union)",
         "author": "frack113",
         "tags": [
@@ -23460,7 +23460,7 @@
     {
         "title": "Powershell Base64 Encoded MpPreference Cmdlet",
         "id": "c6fb44c6-71f5-49e6-9462-1425d328aee3",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects base64 encoded \"MpPreference\" PowerShell cmdlet code that tries to modifies or tamper with Windows Defender AV",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -23694,7 +23694,7 @@
     {
         "title": "HackTool - KrbRelay Execution",
         "id": "e96253b8-6b3b-4f90-9e59-3b24b99cf9b4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of KrbRelay, a Kerberos relaying tool",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -23771,7 +23771,7 @@
     {
         "title": "HackTool - PowerTool Execution",
         "id": "a34f79a3-8e5f-4cc3-b765-de00695452c2",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of the tool PowerTool which has the ability to kill a process, delete its process file, unload drivers, and delete the driver files",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -23868,7 +23868,7 @@
     {
         "title": "Potential Credential Dumping Attempt Using New NetworkProvider - CLI",
         "id": "baef1ec6-2ca9-47a3-97cc-4cf2bda10b77",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -23887,7 +23887,7 @@
     {
         "title": "Potential Recon Activity Via Nltest.EXE",
         "id": "5cc90652-4cbd-4241-aa3b-4b462fa5a248",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects nltest commands that can be used for information discovery",
         "author": "Craig Young, oscd.community, Georg Lauenstein",
         "tags": [
@@ -24102,7 +24102,7 @@
     {
         "title": "HackTool - SharpLdapWhoami Execution",
         "id": "d9367cbb-c2e0-47ce-bdc0-128cb6da898d",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -24143,7 +24143,7 @@
     {
         "title": "SafeBoot Registry Key Deleted Via Reg.EXE",
         "id": "fc0e89b5-adb0-43c1-b749-c12a10ec37de",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of \"reg.exe\" commands with the \"delete\" flag on safe boot registry keys. Often used by attacker to prevent safeboot execution of security products",
         "author": "Nasreddine Bencherchali (Nextron Systems), Tim Shelton",
         "tags": [
@@ -24199,7 +24199,7 @@
     {
         "title": "Suspicious Binary In User Directory Spawned From Office Application",
         "id": "aa3a6f94-890e-4e22-b634-ffdfd54792cc",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an executable in the users directory started from one of the Microsoft Office suite applications (Word, Excel, PowerPoint, Publisher, Visio)",
         "author": "Jason Lynch",
         "tags": [
@@ -24395,7 +24395,7 @@
     {
         "title": "Suspicious Hacktool Execution - PE Metadata",
         "id": "37c1333a-a0db-48be-b64b-7393b2386e3b",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -24721,7 +24721,7 @@
     {
         "title": "PowerShell Base64 Encoded WMI Classes",
         "id": "1816994b-42e1-4fb1-afd2-134d88184f71",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects calls to base64 encoded WMI class such as \"Win32_Shadowcopy\", \"Win32_ScheduledJob\", etc.",
         "author": "Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -24762,7 +24762,7 @@
     {
         "title": "PUA - Fast Reverse Proxy (FRP) Execution",
         "id": "32410e29-5f94-4568-b6a3-d91a8adad863",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet.",
         "author": "frack113, Florian Roth",
         "tags": [
@@ -25049,7 +25049,7 @@
     {
         "title": "Operator Bloopers Cobalt Strike Commands",
         "id": "647c7b9e-d784-4fda-b9a0-45c565a7b729",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects use of Cobalt Strike commands accidentally entered in the CMD shell",
         "author": "_pete_0, TheDFIRReport",
         "tags": [
@@ -25202,7 +25202,7 @@
     {
         "title": "HackTool - HandleKatz LSASS Dumper Execution",
         "id": "ca621ba5-54ab-4035-9942-d378e6fcde3c",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -25639,7 +25639,7 @@
     {
         "title": "Suspicious Shells Spawn by Java Utility Keytool",
         "id": "90fb5e62-ca1f-4e22-b42e-cc521874c938",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation)",
         "author": "Andreas Hunkeler (@Karneades)",
         "tags": [
@@ -25659,7 +25659,7 @@
     {
         "title": "PUA - NPS Tunneling Tool Execution",
         "id": "68d37776-61db-42f5-bf54-27e87072d17e",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of NPS, a port forwarding and intranet penetration proxy server",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -25756,7 +25756,7 @@
     {
         "title": "Renamed Msdt.EXE Execution",
         "id": "bd1c6866-65fc-44b2-be51-5588fcff82b9",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed \"Msdt.exe\" binary",
         "author": "pH-T (Nextron Systems)",
         "tags": [
@@ -25794,7 +25794,7 @@
     {
         "title": "Execution from Suspicious Folder",
         "id": "3dfd06d2-eaf4-4532-9555-68aca59f57c4",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects a suspicious execution from an uncommon folder",
         "author": "Florian Roth (Nextron Systems), Tim Shelton",
         "tags": [
@@ -25946,7 +25946,7 @@
     {
         "title": "Renamed Mavinject.EXE Execution",
         "id": "e6474a1b-5390-49cd-ab41-8d88655f7394",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the execution of a renamed version of the \"Mavinject\" process. Which can be abused to perform process injection using the \"/INJECTRUNNING\" flag",
         "author": "frack113, Florian Roth",
         "tags": [
@@ -26636,7 +26636,7 @@
     {
         "title": "Potential PowerShell Execution Policy Tampering - ProcCreation",
         "id": "cf2e938e-9a3e-4fe8-a347-411642b28a9f",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects changes to the PowerShell execution policy registry key in order to bypass signing requirements for script execution from the CommandLine",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -26654,7 +26654,7 @@
     {
         "title": "Renamed BrowserCore.EXE Execution",
         "id": "8a4519e8-e64a-40b6-ae85-ba8ad2177559",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects process creation with a renamed BrowserCore.exe (used to extract Azure tokens)",
         "author": "Max Altgelt (Nextron Systems)",
         "tags": [
@@ -26915,7 +26915,7 @@
     {
         "title": "Renamed Vmnat.exe Execution",
         "id": "7b4f794b-590a-4ad4-ba18-7964a2832205",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects renamed vmnat.exe or portable version that can be used for DLL side-loading",
         "author": "elhoim",
         "tags": [
@@ -26934,7 +26934,7 @@
     {
         "title": "Renamed Sysinternals Sdelete Execution",
         "id": "c1d867fe-8d95-4487-aab4-e53f2d339f90",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of a renamed SysInternals Sdelete, which is something an administrator shouldn't do (the renaming)",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -27126,7 +27126,7 @@
     {
         "title": "Potential Signing Bypass Via Windows Developer Features",
         "id": "a383dec4-deec-4e6e-913b-ed9249670848",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects when a user enable developer features such as \"Developer Mode\" or \"Application Sideloading\". Which allows the user to install untrusted packages.",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -27238,7 +27238,7 @@
     {
         "title": "Root Certificate Installed From Susp Locations",
         "id": "5f6a601c-2ecb-498b-9c33-660362323afa",
-        "status": "experimental",
+        "status": "test",
         "description": "Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -27257,7 +27257,7 @@
     {
         "title": "Potential Process Injection Via Msra.EXE",
         "id": "744a188b-0415-4792-896f-11ddb0588dbc",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential process injection via Microsoft Remote Asssistance (Msra.exe) by looking at suspicious child processes spawned from the aforementioned process. It has been a target used by many threat actors and used for discovery and persistence tactics",
         "author": "Alexander McDonald",
         "tags": [
@@ -27579,7 +27579,7 @@
     {
         "title": "Potential RDP Tunneling Via SSH",
         "id": "f7d7ebd5-a016-46e2-9c54-f9932f2d386d",
-        "status": "experimental",
+        "status": "test",
         "description": "Execution of ssh.exe to perform data exfiltration and tunneling through RDP",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -27735,7 +27735,7 @@
     {
         "title": "Service Registry Key Deleted Via Reg.EXE",
         "id": "05b2aa93-1210-42c8-8d9a-2fcc13b284f5",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of \"reg.exe\" commands with the \"delete\" flag on services registry key. Often used by attacker to remove AV software services",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -27890,7 +27890,7 @@
     {
         "title": "HackTool - Htran/NATBypass Execution",
         "id": "f5e3b62f-e577-4e59-931e-0a15b2b94e1e",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass)",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -27910,7 +27910,7 @@
     {
         "title": "SQLite Firefox Profile Data DB Access",
         "id": "4833155a-4053-4c9c-a997-777fcea0baa7",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect usage of the \"sqlite\" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.",
         "author": "frack113",
         "tags": [
@@ -28774,7 +28774,7 @@
     {
         "title": "Potential PowerShell Obfuscation Using Alias Cmdlets",
         "id": "96cd126d-f970-49c4-848a-da3a09f55c55",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects Set-Alias or New-Alias cmdlet usage. Which can be use as a mean to obfuscate PowerShell scripts",
         "author": "frack113",
         "tags": [
@@ -28852,7 +28852,7 @@
     {
         "title": "Potential PowerShell Obfuscation Using Character Join",
         "id": "e8314f79-564d-4f79-bc13-fbc0bf2660d8",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects specific techniques often seen used inside of PowerShell scripts to obfscuate Alias creation",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -29226,7 +29226,7 @@
     {
         "title": "Scheduled Task Deletion",
         "id": "4f86b304-3e02-40e3-aa5d-e88a167c9617",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects scheduled task deletion events. Scheduled tasks are likely to be deleted if not used for persistence. Malicious Software often creates tasks directly under the root node e.g. \\TASKNAME",
         "author": "David Strassegger, Tim Shelton",
         "tags": [
@@ -30233,7 +30233,7 @@
     {
         "title": "The Windows Defender Firewall Service Failed To Load Group Policy",
         "id": "7ec15688-fd24-4177-ba43-1a950537ee39",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects activity when The Windows Defender Firewall service failed to load Group Policy",
         "author": "frack113",
         "tags": [
@@ -30347,7 +30347,7 @@
     {
         "title": "DirLister Execution",
         "id": "b4dc61f5-6cce-468e-a608-b48b469feaa2",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect the usage of \"DirLister.exe\" a utility for quickly listing folder or drive contents. It was seen used by BlackCat ransomware to create a list of accessible directories and files.",
         "author": "frack113",
         "tags": [
@@ -30496,7 +30496,7 @@
     {
         "title": "Nltest.EXE Execution",
         "id": "903076ff-f442-475a-b667-4f246bcc203b",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects nltest commands that can be used for information discovery",
         "author": "Arun Chauhan",
         "tags": [
@@ -32636,7 +32636,7 @@
     {
         "title": "Potential PendingFileRenameOperations Tamper",
         "id": "4eec988f-7bf0-49f1-8675-1e6a510b3a2a",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect changes to the \"PendingFileRenameOperations\" registry key from uncommon or suspicious images lcoations to stage currently used files for rename after reboot.",
         "author": "frack113",
         "tags": [
@@ -32812,7 +32812,7 @@
     {
         "title": "Atbroker Registry Change",
         "id": "9577edbb-851f-4243-8c91-1d5b50c1a39b",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'",
         "author": "Mateusz Wydra, oscd.community",
         "tags": [
@@ -33220,7 +33220,7 @@
     {
         "title": "Suspicious PowerShell Download - PoshModule",
         "id": "de41232e-12e8-49fa-86bc-c05c7e722df9",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious PowerShell download command",
         "author": "Florian Roth (Nextron Systems)",
         "tags": [
@@ -33239,7 +33239,7 @@
     {
         "title": "Potential Active Directory Enumeration Using AD Module - PsModule",
         "id": "74176142-4684-4d8a-8b0a-713257e7df8e",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of the \"Import-Module\" cmdlet to load the \"Microsoft.ActiveDirectory.Management.dl\" DLL. Which is often used by attackers to perform AD enumeration.",
         "author": "Nasreddine Bencherchali (Nextron Systems), frack113",
         "tags": [
@@ -33797,7 +33797,7 @@
     {
         "title": "Usage Of Web Request Commands And Cmdlets - ScriptBlock",
         "id": "1139d2e2-84b1-4226-b445-354492eba8ba",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via PowerShell scriptblock logs",
         "author": "James Pemberton / @4A616D6573",
         "tags": [
@@ -34030,7 +34030,7 @@
     {
         "title": "Unsigned AppX Installation Attempt Using Add-AppxPackage - PsScript",
         "id": "975b2262-9a49-439d-92a6-0709cccdf0b2",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of the \"Add-AppxPackage\" or it's alias \"Add-AppPackage\" to install unsigned AppX packages",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -34220,7 +34220,7 @@
     {
         "title": "Import PowerShell Modules From Suspicious Directories",
         "id": "21f9162c-5f5d-4b01-89a8-b705bd7d10ab",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects powershell scripts that import modules from suspicious directories",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -34428,7 +34428,7 @@
     {
         "title": "Potential Data Exfiltration Via Audio File",
         "id": "e4f93c99-396f-47c8-bb0f-201b1fa69034",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential exfiltration attempt via audio file using PowerShell",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -34522,7 +34522,7 @@
     {
         "title": "Powershell XML Execute Command",
         "id": "6c6c6282-7671-4fe9-a0ce-a2dcebdc342b",
-        "status": "experimental",
+        "status": "test",
         "description": "Adversaries may abuse PowerShell commands and scripts for execution.\nPowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell)\nAdversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code\n",
         "author": "frack113",
         "tags": [
@@ -34962,7 +34962,7 @@
     {
         "title": "Potential Active Directory Enumeration Using AD Module - PsScript",
         "id": "9e620995-f2d8-4630-8430-4afd89f77604",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of the \"Import-Module\" cmdlet to load the \"Microsoft.ActiveDirectory.Management.dl\" DLL. Which is often used by attackers to perform AD enumeration.",
         "author": "frack113, Nasreddine Bencherchali",
         "tags": [
@@ -35075,25 +35075,6 @@
         ],
         "filename": ""
     },
-    {
-        "title": "Suspicious DNS Query for IP Lookup Service APIs",
-        "id": "ec82e2a5-81ea-4211-a1f8-37a0286df2c2",
-        "status": "test",
-        "description": "Detects DNS queries for IP lookup services such as \"api.ipify.org\" originating from a non browser process.",
-        "author": "Brandon George (blog post), Thomas Patzke",
-        "tags": [
-            "attack.reconnaissance",
-            "attack.t1590"
-        ],
-        "falsepositives": [
-            "Legitimate usage of IP lookup services such as ipify API"
-        ],
-        "level": "medium",
-        "rule": [
-            "SELECT * FROM logs WHERE Channel='Microsoft-Windows-Sysmon/Operational' AND (EventID=22 AND ((QueryName LIKE '%api.2ip.ua%' ESCAPE '\\' OR QueryName LIKE '%api.ipify.org%' ESCAPE '\\' OR QueryName LIKE '%bot.whatismyipaddress.com%' ESCAPE '\\' OR QueryName LIKE '%canireachthe.net%' ESCAPE '\\' OR QueryName LIKE '%checkip.amazonaws.com%' ESCAPE '\\' OR QueryName LIKE '%checkip.dyndns.org%' ESCAPE '\\' OR QueryName LIKE '%curlmyip.com%' ESCAPE '\\' OR QueryName LIKE '%edns.ip-api.com%' ESCAPE '\\' OR QueryName LIKE '%eth0.me%' ESCAPE '\\' OR QueryName LIKE '%freegeoip.app%' ESCAPE '\\' OR QueryName LIKE '%geoipy.com%' ESCAPE '\\' OR QueryName LIKE '%getip.pro%' ESCAPE '\\' OR QueryName LIKE '%icanhazip.com%' ESCAPE '\\' OR QueryName LIKE '%ident.me%' ESCAPE '\\' OR QueryName LIKE '%ifconfig.io%' ESCAPE '\\' OR QueryName LIKE '%ifconfig.me%' ESCAPE '\\' OR QueryName LIKE '%ip-api.com%' ESCAPE '\\' OR QueryName LIKE '%ip.anysrc.net%' ESCAPE '\\' OR QueryName LIKE '%ip.tyk.nu%' ESCAPE '\\' OR QueryName LIKE '%ipaddressworld.com%' ESCAPE '\\' OR QueryName LIKE '%ipecho.net%' ESCAPE '\\' OR QueryName LIKE '%ipinfo.io%' ESCAPE '\\' OR QueryName LIKE '%ipof.in%' ESCAPE '\\' OR QueryName LIKE '%ipv4.icanhazip.com%' ESCAPE '\\' OR QueryName LIKE '%ipv4bot.whatismyipaddress.com%' ESCAPE '\\' OR QueryName LIKE '%ipwho.is%' ESCAPE '\\' OR QueryName LIKE '%l2.io%' ESCAPE '\\' OR QueryName LIKE '%myexternalip.com%' ESCAPE '\\' OR QueryName LIKE '%wgetip.com%' ESCAPE '\\' OR QueryName LIKE '%whatismyip.akamai.com%' ESCAPE '\\' OR QueryName LIKE '%wtfismyip.com%' ESCAPE '\\') AND (NOT (Image LIKE '%\\\\brave.exe' ESCAPE '\\' OR (Image LIKE 'C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files (x86)\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\') OR (Image LIKE 'C:\\\\Program Files\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\') OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\') OR Image LIKE '%\\\\maxthon.exe' ESCAPE '\\' OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\%' ESCAPE '\\' OR Image LIKE '%\\\\WindowsApps\\\\MicrosoftEdge.exe' ESCAPE '\\' OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\')) OR ((Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\') AND (Image LIKE '%\\\\msedge.exe' ESCAPE '\\' OR Image LIKE '%\\\\msedgewebview2.exe' ESCAPE '\\')) OR Image LIKE '%\\\\opera.exe' ESCAPE '\\' OR Image LIKE '%\\\\safari.exe' ESCAPE '\\' OR Image LIKE '%\\\\seamonkey.exe' ESCAPE '\\' OR Image LIKE '%\\\\vivaldi.exe' ESCAPE '\\' OR Image LIKE '%\\\\whale.exe' ESCAPE '\\'))))"
-        ],
-        "filename": ""
-    },
     {
         "title": "DNS Query Request By Regsvr32.EXE",
         "id": "36e037c4-c228-4866-b6a3-48eb292b9955",
@@ -35230,6 +35211,25 @@
         ],
         "filename": ""
     },
+    {
+        "title": "Suspicious DNS Query for IP Lookup Service APIs",
+        "id": "ec82e2a5-81ea-4211-a1f8-37a0286df2c2",
+        "status": "test",
+        "description": "Detects DNS queries for IP lookup services such as \"api.ipify.org\" originating from a non browser process.",
+        "author": "Brandon George (blog post), Thomas Patzke",
+        "tags": [
+            "attack.reconnaissance",
+            "attack.t1590"
+        ],
+        "falsepositives": [
+            "Legitimate usage of IP lookup services such as ipify API"
+        ],
+        "level": "medium",
+        "rule": [
+            "SELECT * FROM logs WHERE Channel='Microsoft-Windows-Sysmon/Operational' AND (EventID=22 AND ((QueryName LIKE '%api.2ip.ua%' ESCAPE '\\' OR QueryName LIKE '%api.bigdatacloud.net%' ESCAPE '\\' OR QueryName LIKE '%api.ipify.org%' ESCAPE '\\' OR QueryName LIKE '%bot.whatismyipaddress.com%' ESCAPE '\\' OR QueryName LIKE '%canireachthe.net%' ESCAPE '\\' OR QueryName LIKE '%checkip.amazonaws.com%' ESCAPE '\\' OR QueryName LIKE '%checkip.dyndns.org%' ESCAPE '\\' OR QueryName LIKE '%curlmyip.com%' ESCAPE '\\' OR QueryName LIKE '%db-ip.com%' ESCAPE '\\' OR QueryName LIKE '%edns.ip-api.com%' ESCAPE '\\' OR QueryName LIKE '%eth0.me%' ESCAPE '\\' OR QueryName LIKE '%freegeoip.app%' ESCAPE '\\' OR QueryName LIKE '%geoipy.com%' ESCAPE '\\' OR QueryName LIKE '%getip.pro%' ESCAPE '\\' OR QueryName LIKE '%icanhazip.com%' ESCAPE '\\' OR QueryName LIKE '%ident.me%' ESCAPE '\\' OR QueryName LIKE '%ifconfig.io%' ESCAPE '\\' OR QueryName LIKE '%ifconfig.me%' ESCAPE '\\' OR QueryName LIKE '%ipapi.co%' ESCAPE '\\' OR QueryName LIKE '%ip-api.com%' ESCAPE '\\' OR QueryName LIKE '%ip.anysrc.net%' ESCAPE '\\' OR QueryName LIKE '%ip.tyk.nu%' ESCAPE '\\' OR QueryName LIKE '%ipaddressworld.com%' ESCAPE '\\' OR QueryName LIKE '%ipecho.net%' ESCAPE '\\' OR QueryName LIKE '%ipinfo.io%' ESCAPE '\\' OR QueryName LIKE '%ipof.in%' ESCAPE '\\' OR QueryName LIKE '%ipv4.icanhazip.com%' ESCAPE '\\' OR QueryName LIKE '%ipv4bot.whatismyipaddress.com%' ESCAPE '\\' OR QueryName LIKE '%ipwho.is%' ESCAPE '\\' OR QueryName LIKE '%l2.io%' ESCAPE '\\' OR QueryName LIKE '%myexternalip.com%' ESCAPE '\\' OR QueryName LIKE '%wgetip.com%' ESCAPE '\\' OR QueryName LIKE '%whatismyip.akamai.com%' ESCAPE '\\' OR QueryName LIKE '%wtfismyip.com%' ESCAPE '\\') AND (NOT (Image LIKE '%\\\\brave.exe' ESCAPE '\\' OR (Image LIKE 'C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files (x86)\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\') OR (Image LIKE 'C:\\\\Program Files\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\') OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\') OR Image LIKE '%\\\\maxthon.exe' ESCAPE '\\' OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\%' ESCAPE '\\' OR Image LIKE '%\\\\WindowsApps\\\\MicrosoftEdge.exe' ESCAPE '\\' OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\')) OR ((Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\') AND (Image LIKE '%\\\\msedge.exe' ESCAPE '\\' OR Image LIKE '%\\\\msedgewebview2.exe' ESCAPE '\\')) OR Image LIKE '%\\\\opera.exe' ESCAPE '\\' OR Image LIKE '%\\\\safari.exe' ESCAPE '\\' OR Image LIKE '%\\\\seamonkey.exe' ESCAPE '\\' OR Image LIKE '%\\\\vivaldi.exe' ESCAPE '\\' OR Image LIKE '%\\\\whale.exe' ESCAPE '\\'))))"
+        ],
+        "filename": ""
+    },
     {
         "title": "Potential DLL Sideloading Using Coregen.exe",
         "id": "0fa66f66-e3f6-4a9c-93f8-4f2610b00171",
@@ -36121,6 +36121,28 @@
         ],
         "filename": ""
     },
+    {
+        "title": "Registry Set With Crypto-Classes From The \"Cryptography\" PowerShell Namespace",
+        "id": "1c2a3268-3881-414a-80af-a5b313b14c0e",
+        "status": "experimental",
+        "description": "Detects the setting of a registry inside the \"\\Shell\\Open\\Command\" value with PowerShell classes from the \"System.Security.Cryptography\" namespace.\nThe PowerShell namespace \"System.Security.Cryptography\" provides classes for on-the-fly encryption and decryption.\nThese can be used for example in decrypting malicious payload for defense evasion.\n",
+        "author": "Andreas Braathen (mnemonic.io)",
+        "tags": [
+            "attack.defense_evasion",
+            "attack.t1059.001",
+            "attack.t1027.010",
+            "attack.t1547.001",
+            "detection.threat_hunting"
+        ],
+        "falsepositives": [
+            "Classes are legitimately used, but less so when e.g. parents with low prevalence or decryption of content in temporary folders."
+        ],
+        "level": "medium",
+        "rule": [
+            "SELECT * FROM logs WHERE Channel='Microsoft-Windows-Sysmon/Operational' AND (EventID=13 AND ((EventType='SetValue' AND TargetObject LIKE '%\\\\Shell\\\\Open\\\\Command%' ESCAPE '\\') AND (Details LIKE '%powershell%' ESCAPE '\\' OR Details LIKE '%pwsh%' ESCAPE '\\') AND Details LIKE '%System.Security.Cryptography.%' ESCAPE '\\' AND (Details LIKE '%.AesCryptoServiceProvider%' ESCAPE '\\' OR Details LIKE '%.DESCryptoServiceProvider%' ESCAPE '\\' OR Details LIKE '%.DSACryptoServiceProvider%' ESCAPE '\\' OR Details LIKE '%.RC2CryptoServiceProvider%' ESCAPE '\\' OR Details LIKE '%.Rijndael%' ESCAPE '\\' OR Details LIKE '%.RSACryptoServiceProvider%' ESCAPE '\\' OR Details LIKE '%.TripleDESCryptoServiceProvider%' ESCAPE '\\')))"
+        ],
+        "filename": ""
+    },
     {
         "title": "WinAPI Library Calls Via PowerShell Scripts",
         "id": "19d65a1c-8540-4140-8062-8eb00db0bba5",
@@ -36591,6 +36613,27 @@
         ],
         "filename": ""
     },
+    {
+        "title": "Invocation Of Crypto-Classes From The \"Cryptography\" PowerShell Namespace",
+        "id": "ad856965-f44d-42a8-945e-bbf7bd03d05a",
+        "status": "experimental",
+        "description": "Detects the invocation of PowerShell commands with references to classes from the \"System.Security.Cryptography\" namespace.\nThe PowerShell namespace \"System.Security.Cryptography\" provides classes for on-the-fly encryption and decryption.\nThese can be used for example in decrypting malicious payload for defense evasion.\n",
+        "author": "Andreas Braathen (mnemonic.io)",
+        "tags": [
+            "attack.defense_evasion",
+            "attack.t1059.001",
+            "attack.t1027.010",
+            "detection.threat_hunting"
+        ],
+        "falsepositives": [
+            "Classes are legitimately used, but less so when e.g. parents with low prevalence or decryption of content in temporary folders."
+        ],
+        "level": "medium",
+        "rule": [
+            "SELECT * FROM logs WHERE Channel='Microsoft-Windows-Sysmon/Operational' AND (EventID=1 AND (((Image LIKE '%\\\\powershell.exe' ESCAPE '\\' OR Image LIKE '%\\\\pwsh.exe' ESCAPE '\\') OR (OriginalFileName='PowerShell.EXE' OR OriginalFileName='pwsh.dll')) AND CommandLine LIKE '%System.Security.Cryptography.%' ESCAPE '\\' AND (CommandLine LIKE '%.AesCryptoServiceProvider%' ESCAPE '\\' OR CommandLine LIKE '%.DESCryptoServiceProvider%' ESCAPE '\\' OR CommandLine LIKE '%.DSACryptoServiceProvider%' ESCAPE '\\' OR CommandLine LIKE '%.RC2CryptoServiceProvider%' ESCAPE '\\' OR CommandLine LIKE '%.Rijndael%' ESCAPE '\\' OR CommandLine LIKE '%.RSACryptoServiceProvider%' ESCAPE '\\' OR CommandLine LIKE '%.TripleDESCryptoServiceProvider%' ESCAPE '\\')))"
+        ],
+        "filename": ""
+    },
     {
         "title": "ClickOnce Deployment Execution - Dfsvc.EXE Child Process",
         "id": "241d52b5-eee0-49d0-ac8a-8b9c15c7221c",
@@ -37654,7 +37697,7 @@
     {
         "title": "VsCode Powershell Profile Modification",
         "id": "3a9fa2ec-30bc-4ebd-b49e-7c9cff225502",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the creation or modification of a vscode related powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -38519,7 +38562,7 @@
     {
         "title": "Deployment Of The AppX Package Was Blocked By The Policy",
         "id": "e021bbb5-407f-41f5-9dc9-1864c45a7a51",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an appx package deployment that was blocked by the local computer policy",
         "author": "frack113",
         "tags": [
@@ -38537,7 +38580,7 @@
     {
         "title": "Deployment AppX Package Was Blocked By AppLocker",
         "id": "6ae53108-c3a0-4bee-8f45-c7591a2c337f",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an appx package deployment that was blocked by AppLocker policy",
         "author": "frack113",
         "tags": [
@@ -38555,7 +38598,7 @@
     {
         "title": "Suspicious AppX Package Installation Attempt",
         "id": "898d5fc9-fbc3-43de-93ad-38e97237c344",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an appx package installation with the error code \"0x80073cff\" which indicates that the package didn't meet the signing requirements and could be suspicious",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -38573,7 +38616,7 @@
     {
         "title": "Uncommon AppX Package Locations",
         "id": "c977cb50-3dff-4a9f-b873-9290f56132f1",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an appx package added the pipeline of the \"to be processed\" packages which is located in uncommon locations",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -38591,7 +38634,7 @@
     {
         "title": "Potential Malicious AppX Package Installation Attempts",
         "id": "09d3b48b-be17-47f5-bf4e-94e7e75d09ce",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects potential installation or installation attempts of known malicious appx packages",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -38724,7 +38767,7 @@
     {
         "title": "Suspicious Digital Signature Of AppX Package",
         "id": "b5aa7d60-c17e-4538-97de-09029d6cd76b",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of AppX packages with known suspicious or malicious signature",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -40727,7 +40770,7 @@
         ],
         "level": "medium",
         "rule": [
-            "SELECT * FROM logs WHERE Channel='Microsoft-Windows-Sysmon/Operational' AND (EventID=3 AND ((DestinationHostname LIKE '%api.2ip.ua%' ESCAPE '\\' OR DestinationHostname LIKE '%api.ipify.org%' ESCAPE '\\' OR DestinationHostname LIKE '%bot.whatismyipaddress.com%' ESCAPE '\\' OR DestinationHostname LIKE '%canireachthe.net%' ESCAPE '\\' OR DestinationHostname LIKE '%checkip.amazonaws.com%' ESCAPE '\\' OR DestinationHostname LIKE '%checkip.dyndns.org%' ESCAPE '\\' OR DestinationHostname LIKE '%curlmyip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%edns.ip-api.com%' ESCAPE '\\' OR DestinationHostname LIKE '%eth0.me%' ESCAPE '\\' OR DestinationHostname LIKE '%freegeoip.app%' ESCAPE '\\' OR DestinationHostname LIKE '%geoipy.com%' ESCAPE '\\' OR DestinationHostname LIKE '%getip.pro%' ESCAPE '\\' OR DestinationHostname LIKE '%icanhazip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ident.me%' ESCAPE '\\' OR DestinationHostname LIKE '%ifconfig.io%' ESCAPE '\\' OR DestinationHostname LIKE '%ifconfig.me%' ESCAPE '\\' OR DestinationHostname LIKE '%ip-api.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ip.anysrc.net%' ESCAPE '\\' OR DestinationHostname LIKE '%ip.tyk.nu%' ESCAPE '\\' OR DestinationHostname LIKE '%ipaddressworld.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ipecho.net%' ESCAPE '\\' OR DestinationHostname LIKE '%ipinfo.io%' ESCAPE '\\' OR DestinationHostname LIKE '%ipof.in%' ESCAPE '\\' OR DestinationHostname LIKE '%ipv4.icanhazip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ipv4bot.whatismyipaddress.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ipwho.is%' ESCAPE '\\' OR DestinationHostname LIKE '%l2.io%' ESCAPE '\\' OR DestinationHostname LIKE '%myexternalip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%wgetip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%whatismyip.akamai.com%' ESCAPE '\\' OR DestinationHostname LIKE '%wtfismyip.com%' ESCAPE '\\') AND (NOT (Image LIKE '%\\\\brave.exe' ESCAPE '\\' OR (Image LIKE 'C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files (x86)\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\') OR (Image LIKE 'C:\\\\Program Files\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\') OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\') OR Image LIKE '%\\\\maxthon.exe' ESCAPE '\\' OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\%' ESCAPE '\\' OR Image LIKE '%\\\\WindowsApps\\\\MicrosoftEdge.exe' ESCAPE '\\' OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\')) OR ((Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\') AND (Image LIKE '%\\\\msedge.exe' ESCAPE '\\' OR Image LIKE '%\\\\msedgewebview2.exe' ESCAPE '\\')) OR Image LIKE '%\\\\opera.exe' ESCAPE '\\' OR Image LIKE '%\\\\safari.exe' ESCAPE '\\' OR Image LIKE '%\\\\seamonkey.exe' ESCAPE '\\' OR Image LIKE '%\\\\vivaldi.exe' ESCAPE '\\' OR Image LIKE '%\\\\whale.exe' ESCAPE '\\'))))"
+            "SELECT * FROM logs WHERE Channel='Microsoft-Windows-Sysmon/Operational' AND (EventID=3 AND ((DestinationHostname LIKE '%api.2ip.ua%' ESCAPE '\\' OR DestinationHostname LIKE '%api.bigdatacloud.net%' ESCAPE '\\' OR DestinationHostname LIKE '%api.ipify.org%' ESCAPE '\\' OR DestinationHostname LIKE '%bot.whatismyipaddress.com%' ESCAPE '\\' OR DestinationHostname LIKE '%canireachthe.net%' ESCAPE '\\' OR DestinationHostname LIKE '%checkip.amazonaws.com%' ESCAPE '\\' OR DestinationHostname LIKE '%checkip.dyndns.org%' ESCAPE '\\' OR DestinationHostname LIKE '%curlmyip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%db-ip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%edns.ip-api.com%' ESCAPE '\\' OR DestinationHostname LIKE '%eth0.me%' ESCAPE '\\' OR DestinationHostname LIKE '%freegeoip.app%' ESCAPE '\\' OR DestinationHostname LIKE '%geoipy.com%' ESCAPE '\\' OR DestinationHostname LIKE '%getip.pro%' ESCAPE '\\' OR DestinationHostname LIKE '%icanhazip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ident.me%' ESCAPE '\\' OR DestinationHostname LIKE '%ifconfig.io%' ESCAPE '\\' OR DestinationHostname LIKE '%ifconfig.me%' ESCAPE '\\' OR DestinationHostname LIKE '%ipapi.co%' ESCAPE '\\' OR DestinationHostname LIKE '%ip-api.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ip.anysrc.net%' ESCAPE '\\' OR DestinationHostname LIKE '%ip.tyk.nu%' ESCAPE '\\' OR DestinationHostname LIKE '%ipaddressworld.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ipecho.net%' ESCAPE '\\' OR DestinationHostname LIKE '%ipinfo.io%' ESCAPE '\\' OR DestinationHostname LIKE '%ipof.in%' ESCAPE '\\' OR DestinationHostname LIKE '%ipv4.icanhazip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ipv4bot.whatismyipaddress.com%' ESCAPE '\\' OR DestinationHostname LIKE '%ipwho.is%' ESCAPE '\\' OR DestinationHostname LIKE '%l2.io%' ESCAPE '\\' OR DestinationHostname LIKE '%myexternalip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%wgetip.com%' ESCAPE '\\' OR DestinationHostname LIKE '%whatismyip.akamai.com%' ESCAPE '\\' OR DestinationHostname LIKE '%wtfismyip.com%' ESCAPE '\\') AND (NOT (Image LIKE '%\\\\brave.exe' ESCAPE '\\' OR (Image LIKE 'C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files (x86)\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe' ESCAPE '\\') OR (Image LIKE 'C:\\\\Program Files\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\firefox.exe' ESCAPE '\\') OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Internet Explorer\\\\iexplore.exe' ESCAPE '\\') OR Image LIKE '%\\\\maxthon.exe' ESCAPE '\\' OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\%' ESCAPE '\\' OR Image LIKE '%\\\\WindowsApps\\\\MicrosoftEdge.exe' ESCAPE '\\' OR (Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe' ESCAPE '\\')) OR ((Image LIKE 'C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\' OR Image LIKE 'C:\\\\Program Files\\\\Microsoft\\\\EdgeCore\\\\%' ESCAPE '\\') AND (Image LIKE '%\\\\msedge.exe' ESCAPE '\\' OR Image LIKE '%\\\\msedgewebview2.exe' ESCAPE '\\')) OR Image LIKE '%\\\\opera.exe' ESCAPE '\\' OR Image LIKE '%\\\\safari.exe' ESCAPE '\\' OR Image LIKE '%\\\\seamonkey.exe' ESCAPE '\\' OR Image LIKE '%\\\\vivaldi.exe' ESCAPE '\\' OR Image LIKE '%\\\\whale.exe' ESCAPE '\\'))))"
         ],
         "filename": ""
     },
@@ -41008,7 +41051,7 @@
     {
         "title": "Potential Password Spraying Attempt Using Dsacls.EXE",
         "id": "bac9fb54-2da7-44e9-988f-11e9a5edbc0c",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects possible password spraying attempts using Dsacls",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -41899,7 +41942,7 @@
     {
         "title": "Potential Active Directory Enumeration Using AD Module - ProcCreation",
         "id": "70bc5215-526f-4477-963c-a47a5c9ebd12",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of the \"Import-Module\" cmdlet to load the \"Microsoft.ActiveDirectory.Management.dl\" DLL. Which is often used by attackers to perform AD enumeration.",
         "author": "frack113",
         "tags": [
@@ -42099,7 +42142,7 @@
     {
         "title": "PDQ Deploy Remote Adminstartion Tool Execution",
         "id": "d679950c-abb7-43a6-80fb-2a480c4fc450",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect use of PDQ Deploy remote admin tool",
         "author": "frack113",
         "tags": [
@@ -42485,7 +42528,7 @@
     {
         "title": "Unsigned AppX Installation Attempt Using Add-AppxPackage",
         "id": "37651c2a-42cd-4a69-ae0d-22a4349aa04a",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of the \"Add-AppxPackage\" or it's alias \"Add-AppPackage\" to install unsigned AppX packages",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -44033,7 +44076,7 @@
     {
         "title": "Suspicious New Instance Of An Office COM Object",
         "id": "9bdaf1e9-fdef-443b-8081-4341b74a7e28",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an svchost process spawning an instance of an office application. This happens when the initial word application creates an instance of one of the Office COM objects such as 'Word.Application', 'Excel.Application', etc.\nThis can be used by malicious actors to create malicious Office documents with macros on the fly. (See vba2clr project in the references)\n",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -44399,7 +44442,7 @@
     {
         "title": "Potential DLL Sideloading Via DeviceEnroller.EXE",
         "id": "e173ad47-4388-4012-ae62-bd13f71c18a8",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the use of the PhoneDeepLink parameter to potentially sideload a DLL file that does not exist. This non-existent DLL file is named \"ShellChromeAPI.dll\".\nAdversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter\n",
         "author": "@gott_cyber",
         "tags": [
@@ -45288,7 +45331,7 @@
     {
         "title": "Suspicious IIS URL GlobalRules Rewrite Via AppCmd",
         "id": "7c8af9b2-dcae-41a2-a9db-b28c288b5f08",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of \"appcmd\" to create new global URL rewrite rules. This behaviour has been observed being used by threat actors to add new rules so they can access their webshells.",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -45729,7 +45772,7 @@
     {
         "title": "Suspicious Git Clone",
         "id": "aef9d1f1-7396-4e92-a927-4567c7a495c1",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of \"git\" in order to clone a remote repository that contain suspicious keywords which might be suspicious",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -45786,7 +45829,7 @@
     {
         "title": "New Remote Desktop Connection Initiated Via Mstsc.EXE",
         "id": "954f0af7-62dd-418f-b3df-a84bc2c7a774",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the usage of \"mstsc.exe\" with the \"/v\" flag to initiate a connection to a remote server.\nAdversaries may use valid accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.\n",
         "author": "frack113",
         "tags": [
@@ -45904,7 +45947,7 @@
     {
         "title": "Potentially Over Permissive Permissions Granted Using Dsacls.EXE",
         "id": "01c42d3c-242d-4655-85b2-34f1739632f7",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of Dsacls to grant over permissive permissions",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -46327,7 +46370,7 @@
     {
         "title": "Fsutil Behavior Set SymlinkEvaluation",
         "id": "c0b2768a-dd06-4671-8339-b16ca8d1f27f",
-        "status": "experimental",
+        "status": "test",
         "description": "A symbolic link is a type of file that contains a reference to another file.\nThis is probably done to make sure that the ransomware is able to follow shortcuts on the machine in order to find the original file to encrypt\n",
         "author": "frack113",
         "tags": [
@@ -46447,7 +46490,7 @@
     {
         "title": "Suspicious Rundll32 Script in CommandLine",
         "id": "73fcad2e-ff14-4c38-b11d-4172c8ac86c7",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects suspicious process related to rundll32 based on arguments",
         "author": "frack113, Zaw Min Htun (ZETA)",
         "tags": [
@@ -46915,7 +46958,7 @@
     {
         "title": "Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE",
         "id": "48917adc-a28e-4f5d-b729-11e75da8941f",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects the usage of \"reg.exe\" to add Defender folder exclusions. Qbot has been seen using this technique to add exclusions for folders within AppData and ProgramData.",
         "author": "frack113",
         "tags": [
@@ -47537,7 +47580,7 @@
     {
         "title": "New Generic Credentials Added Via Cmdkey.EXE",
         "id": "b1ec66c6-f4d1-4b5c-96dd-af28ccae7727",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of cmdkey to add generic credentials. As an example, this has to be used before connecting to an RDP session via command line interface.",
         "author": "frack113, Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -47847,7 +47890,7 @@
     {
         "title": "Lolbin Ssh.exe Use As Proxy",
         "id": "7d6d30b8-5b91-4b90-a891-46cccaf29598",
-        "status": "experimental",
+        "status": "test",
         "description": "Detect usage of the \"ssh.exe\" binary as a proxy to launch other programs",
         "author": "frack113, Nasreddine Bencherchali",
         "tags": [
@@ -48357,7 +48400,7 @@
     {
         "title": "Query Usage To Exfil Data",
         "id": "53ef0cef-fa24-4f25-a34a-6c72dfa2e6e2",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of \"query.exe\" a system binary to exfil information such as \"sessions\" and \"processes\" for later use",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -48513,7 +48556,7 @@
     {
         "title": "Suspicious Use of PsLogList",
         "id": "aae1243f-d8af-40d8-ab20-33fc6d0c55bc",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects usage of the PsLogList utility to dump event log in order to extract admin accounts and perform account discovery or delete events logs",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -48851,7 +48894,7 @@
     {
         "title": "Renamed Remote Utilities RAT (RURAT) Execution",
         "id": "9ef27c24-4903-4192-881a-3adde7ff92a5",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects execution of renamed Remote Utilities (RURAT) via Product PE header field",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -49225,7 +49268,7 @@
     {
         "title": "Import PowerShell Modules From Suspicious Directories - ProcCreation",
         "id": "c31364f7-8be6-4b77-8483-dd2b5a7b69a3",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects powershell scripts that import modules from suspicious directories",
         "author": "Nasreddine Bencherchali (Nextron Systems)",
         "tags": [
@@ -49419,7 +49462,7 @@
     {
         "title": "Potential Discovery Activity Via Dnscmd.EXE",
         "id": "b6457d63-d2a2-4e29-859d-4e7affc153d1",
-        "status": "experimental",
+        "status": "test",
         "description": "Detects an attempt to leverage dnscmd.exe to enumerate the DNS zones of a domain. DNS zones used to host the DNS records for a particular domain.",
         "author": "@gott_cyber",
         "tags": [
diff --git a/tools/zircolite_server/requirements.txt b/tools/zircolite_server/requirements.txt
index 122506b..fb52653 100644
--- a/tools/zircolite_server/requirements.txt
+++ b/tools/zircolite_server/requirements.txt
@@ -1,3 +1,2 @@
 flask>=1.1.2
 jinja2>=2.11.3
-werkzeug>=3.0.1 # not directly required, pinned by Snyk to avoid a vulnerability