Custom rule pack

22 detections for Headquarters. Not part of the built-in set — import, read, edit.

Import

My rules → Import → pick the file → Preview → Import.

The preview shows what each rule will do before anything is written. JSON and YAML work the same way.

Notes

They arrive switched off. Read a rule, decide it fits, then enable it.

Change the prefix. ACME- is a placeholder. DGL-, SIGMA- and YARA- are reserved and will be rejected.

Three will be noisy in most estates — turn these on last, or narrow them:

• ACME-022 installers legitimately run from temp directories
• ACME-041 support teams use AnyDesk and TeamViewer too
• ACME-061 svc- is a normal service account almost everywhere

Contents

Group	Rules
Ransomware and destruction	ACME-001 … 003
Credential access	ACME-010 … 012
Execution and staging	ACME-020 … 023
Persistence	ACME-030 … 033
Lateral movement	ACME-040 … 041
Exfiltration and webshells	ACME-050 … 052
Accounts	ACME-060 … 061
Memory	ACME-070

10 CRITICAL, 9 HIGH, 3 MEDIUM. 19 ATT&CK techniques, 10 of the 11 artifact tables.

Rule format

rule_id      your prefix and a number
title        what shows in the findings list
severity     CRITICAL | HIGH | MEDIUM | LOW | INFO
mitre        T1490, or T1543.003 for a sub-technique
artifact     which collected table to read
match        all | any
conditions   FIELD OPERATOR VALUE, separated by ;
why          what to do about it
enabled      true | false

Operators: equals not_equals contains not_contains starts_with ends_with regex is_true is_false is_empty is_not_empty gt lt

The console validates against the artifact you named, so an unknown field is caught before saving. My rules → Write as text reports the line, not the rule.