{"ruleSet":{"name":"platphorm-default","version":"1.0.0","digest":"sha256:f2ae9c855d24ca5481615a0c16933278720bdcdf485ca3a80397485d1cad30aa"},"rules":[{"id":"process-lineage","version":"1","relationshipType":"process_lineage","description":"Relates process_create events where child.parent_process matches a parent process_name on the same host.","requiredEntities":["host","process"],"timeWindowMs":900000,"minScore":60,"maxScore":100,"factors":[{"factor":"sameHost","description":"Both observations occur on the same host","weight":30},{"factor":"sameUser","description":"Both observations share the same user","weight":20},{"factor":"directLineage","description":"child.parent_process equals parent.process_name","weight":30},{"factor":"withinWindow","description":"Observations fall inside the configured time window","weight":10},{"factor":"monotonicTime","description":"child starts at or after parent","weight":10}]},{"id":"actor-host-activity","version":"1","relationshipType":"actor_host_activity","description":"Relates consecutive endpoint actions by the same user on the same host into an activity timeline.","requiredEntities":["host","user"],"timeWindowMs":1800000,"minScore":75,"maxScore":100,"factors":[{"factor":"sameHost","description":"Both actions occur on the same host","weight":30},{"factor":"sameUser","description":"Both actions are attributed to the same user","weight":30},{"factor":"consecutive","description":"The two actions are temporally adjacent for that user on that host","weight":25},{"factor":"withinWindow","description":"Second action falls within the activity window","weight":15}]},{"id":"authenticated-session","version":"1","relationshipType":"authenticated_session","description":"Relates a user_logon to its matching user_logoff for the same user and host pair.","requiredEntities":["user","host"],"timeWindowMs":86400000,"minScore":70,"maxScore":100,"factors":[{"factor":"sameUser","description":"Logon and logoff share the same user","weight":30},{"factor":"sameHostPair","description":"Logon and logoff share the same source/dest host pair","weight":30},{"factor":"logonBeforeLogoff","description":"A successful user_logon precedes a user_logoff","weight":25},{"factor":"withinWindow","description":"Logoff occurs within the session window","weight":15}]},{"id":"remote-authentication","version":"1","relationshipType":"remote_authentication","description":"Relates a network logon to the first endpoint activity by the same user on the destination host.","requiredEntities":["user","host"],"timeWindowMs":3600000,"minScore":70,"maxScore":100,"factors":[{"factor":"networkLogon","description":"A successful network logon lands on the destination host","weight":35},{"factor":"activityOnDest","description":"Endpoint activity by the same user follows on the destination host","weight":35},{"factor":"sameUser","description":"The logon and the follow-on activity share the same user","weight":20},{"factor":"elevated","description":"The follow-on activity runs elevated","weight":10}]},{"id":"host-network-flow","version":"1","relationshipType":"egress_flow","description":"Relates a source host to an external destination for outbound network connections.","requiredEntities":["host","ipv4"],"timeWindowMs":0,"minScore":55,"maxScore":100,"factors":[{"factor":"outboundExternal","description":"Connection egresses from an internal host to an external destination","weight":40},{"factor":"allowed","description":"Firewall action allowed the connection","weight":15},{"factor":"namedSourceHost","description":"Source IP resolves to a named host","weight":25},{"factor":"significantVolume","description":"Bytes transferred exceed a nominal beacon threshold","weight":20}]},{"id":"process-network","version":"1","relationshipType":"process_egress","description":"Relates a process launch to a following outbound external connection from the same host.","requiredEntities":["host"],"timeWindowMs":5400000,"minScore":70,"maxScore":100,"factors":[{"factor":"sameHost","description":"The network egress originates from the host where the process ran","weight":35},{"factor":"processThenEgress","description":"An outbound external connection follows a process launch on that host","weight":35},{"factor":"externalDestination","description":"The connection targets an external address","weight":20},{"factor":"interpreter","description":"The preceding process is a script interpreter/shell (common C2 launcher)","weight":10}]},{"id":"c2-beacon","version":"1","relationshipType":"c2_beacon","description":"Groups repeated outbound connections from an internal host to one external IP as beaconing.","requiredEntities":["ipv4"],"timeWindowMs":21600000,"minScore":55,"maxScore":100,"factors":[{"factor":"repeatedExternalContact","description":"The same internal host contacts the same external IP more than once","weight":45},{"factor":"sameDestPort","description":"Repeated contacts use the same destination port","weight":20},{"factor":"regularCadence","description":"Contacts recur at a roughly regular cadence (beaconing)","weight":25},{"factor":"namedHost","description":"The internal endpoint resolves to a named host","weight":10}]},{"id":"credential-access","version":"1","relationshipType":"credential_access","description":"Relates sensitive process access (e.g. LSASS) to a following file write on the same host.","requiredEntities":["host","process"],"timeWindowMs":300000,"minScore":45,"maxScore":100,"factors":[{"factor":"processAccess","description":"A process_access observation targets a sensitive system process","weight":45},{"factor":"sameHost","description":"The follow-on file is created on the same host","weight":20},{"factor":"fileWriteAfter","description":"A file_create follows the access within the window","weight":25},{"factor":"largeArtifact","description":"The written file is large enough to be a memory dump","weight":10}]},{"id":"lateral-movement","version":"1","relationshipType":"lateral_movement","description":"Relates internal host-to-host admin-port connections to subsequent execution on the destination host.","requiredEntities":["host"],"timeWindowMs":21600000,"minScore":70,"maxScore":100,"factors":[{"factor":"internalPair","description":"Connection is between two internal hosts","weight":25},{"factor":"namedHostPair","description":"Both source and destination resolve to named hosts","weight":25},{"factor":"adminPort","description":"Destination port is a remote-admin/lateral port (445/3389/5985/22/135)","weight":30},{"factor":"followedByExecution","description":"A process/service is created on the destination host shortly after","weight":20}]},{"id":"service-execution","version":"1","relationshipType":"service_execution","description":"Relates a service creation to a child process spawned by that service on the same host.","requiredEntities":["host","service"],"timeWindowMs":600000,"minScore":70,"maxScore":100,"factors":[{"factor":"serviceCreate","description":"A service is created on the host","weight":30},{"factor":"childProcessFromService","description":"A process is spawned whose parent is the created service binary","weight":40},{"factor":"elevated","description":"The spawned process runs at high/system integrity","weight":20},{"factor":"withinWindow","description":"Process spawns within the window of service creation","weight":10}]},{"id":"data-staging","version":"1","relationshipType":"data_staging","description":"Relates archive-tool execution to the archive artifact it stages on the same host.","requiredEntities":["host","file"],"timeWindowMs":3600000,"minScore":70,"maxScore":100,"factors":[{"factor":"archiveTool","description":"A known archiving tool (7z/rar/zip/tar) is executed","weight":35},{"factor":"archiveArtifact","description":"An archive file is created on the same host after the tool runs","weight":35},{"factor":"outputPathMatch","description":"The created archive matches the tool's output path/name","weight":20},{"factor":"largeArtifact","description":"The archive is large (bulk collection)","weight":10}]},{"id":"cloud-exfiltration","version":"1","relationshipType":"cloud_exfiltration","description":"Relates an external-bucket cloud upload to the staged archive it exfiltrates.","requiredEntities":["bucket"],"timeWindowMs":43200000,"minScore":50,"maxScore":100,"factors":[{"factor":"externalBucket","description":"Upload destination bucket is owned by an external party","weight":35},{"factor":"uploadAction","description":"Cloud action is an upload/share","weight":20},{"factor":"matchesStagedArchive","description":"Uploaded file matches a previously staged archive by name and size","weight":30},{"factor":"largeTransfer","description":"Transferred volume is large","weight":15}]},{"id":"indicator-removal","version":"1","relationshipType":"indicator_removal","description":"Relates deletion of a file/service to its earlier creation on the same host.","requiredEntities":["host"],"timeWindowMs":86400000,"minScore":75,"maxScore":100,"factors":[{"factor":"removesPriorArtifact","description":"Deletion targets a file or service that was created earlier on the same host","weight":55},{"factor":"sameHost","description":"Creation and removal occur on the same host","weight":25},{"factor":"afterCreate","description":"Removal happens after the creation","weight":20}]}]}