What ships
The content pack is a set of curated rules for common Windows and Linux techniques. Every rule is tagged with its ATT&CK technique and ships with test events that prove it fires. Import it from Detections › Import content pack; rules arrive disabled so you can enable those that match the sources you have.
| Rule | Technique | Needs |
|---|---|---|
| Encoded PowerShell command | T1059.001 | Windows process creation |
| LSASS memory access | T1003.001 | Sysmon |
| certutil download | T1105 | Windows process creation |
| Scheduled task persistence | T1053.005 | Windows process creation or Security log |
| regsvr32 remote script | T1218.010 | Windows process creation |
| WMIC process creation | T1047 | Windows process creation |
| Local account added | T1136.001 | Windows Security log |
| Event log cleared | T1070.001 | Windows Security log |
| Authentication brute force | T1110 | Windows Security log or Linux auth |
| Kerberoasting | T1558.003 | Windows Security log |
| Defender real-time protection disabled | T1562.001 | Microsoft Defender |
| Admin share access | T1021.002 | Windows Security log |
| Office application spawns shell | T1566.001 | Windows process creation |
| Linux pipe to shell | T1059.004 | Linux auditd |
| Credential-dumping tool strings | T1003 | Windows process creation |
| Parent PID spoofing | T1134.004 | Sysmon |
| Brute force followed by success | T1110, T1078 | Windows Security log or Linux auth |
| Failed logons followed by service install | T1110, T1543.003 | Windows Security log |
| Ransomware canary modified | T1486 | Sysmon or auditd |
The last three are sequence rules.
Tuning
Content-pack rules are a starting point. Expect to add exceptions for your environment's legitimate administration tooling in the first two weeks; see Exceptions and suppressions. The rule inspector's false-positive rate tells you which rules need attention.
Updates
New pack versions arrive with platform updates. Re-importing updates the rules and keeps your exceptions, bindings and enabled state. Rules you edited are shown as overridden and are not replaced.