What ships
The content pack is a set of curated rules for common Windows and Linux techniques. Every rule is tagged with its ATT&CK technique and ships with test events that prove it fires. A new deployment installs the pack automatically, with the rules enabled.
| Rule | Technique | Needs |
|---|---|---|
| Encoded PowerShell command | T1059.001 | Windows process creation |
| Suspicious LSASS process access | T1003.001 | Sysmon |
| Certutil used as downloader | T1105 | Windows process creation |
| Scheduled task created from the command line | T1053.005 | Windows process creation |
| Regsvr32 loading remote scriptlet | T1218.010 | Windows process creation |
| WMI remote process creation | T1047 | Windows process creation |
| Local account created from the command line | T1136.001 | Windows process creation |
| Windows event log cleared | T1070.001 | Windows Security log |
| Authentication brute force | T1110 | Windows Security log or Linux auth |
| Kerberoasting (RC4 service ticket requests) | T1558.003 | Windows Security log on domain controllers |
| Defender real-time protection disabled | T1562.001 | Microsoft Defender |
| Administrative share accessed over SMB | T1021.002 | Windows Security log |
| Office application spawned a shell | T1566.001 | Windows process creation |
| Download piped straight into a shell (Linux) | T1059.004 | Linux auditd |
| Credential-dumping tool signatures in telemetry | T1003 | Any |
| Parent PID spoofing: handle opened, then a child appears | T1134.004 | Sysmon |
| Brute force followed by successful logon | T1110, T1078 | Windows Security log or Linux auth |
| Failed logons and a service installed on the same host | T1021.002, T1543.003 | Windows Security log |
The last three are multi-stage rules.
Tuning
Content-pack rules are a starting point. Expect to add exceptions for your environment's legitimate administration tooling in the first two weeks; see Exceptions and suppressions. The rule inspector's false-positive rate tells you which rules need attention.
Updates
New pack versions arrive with platform updates and are applied by an administrator. Applying an update returns every pack rule to its shipped state, including its enabled state and exceptions. Rules your team wrote are not touched.