https://fibratus.io/ 2026-03-23 weekly 1.0 https://fibratus.io/es 2026-03-23 weekly 1.0 https://fibratus.io/product/overview 2026-03-23 monthly 0.9 https://fibratus.io/es/product/overview 2026-03-23 monthly 0.9 https://fibratus.io/how-it-works 2026-03-23 monthly 0.9 https://fibratus.io/es/how-it-works 2026-03-23 monthly 0.9 https://fibratus.io/product/extensibility 2026-03-23 monthly 0.9 https://fibratus.io/es/product/extensibility 2026-03-23 monthly 0.9 https://fibratus.io/solutions/blue-team 2026-03-23 monthly 0.9 https://fibratus.io/es/solutions/blue-team 2026-03-23 monthly 0.9 https://fibratus.io/solutions/red-team 2026-03-23 monthly 0.9 https://fibratus.io/es/solutions/red-team 2026-03-23 monthly 0.9 https://fibratus.io/solutions/purple-team 2026-03-23 monthly 0.9 https://fibratus.io/es/solutions/purple-team 2026-03-23 monthly 0.9 https://fibratus.io/solutions/detection-engineers 2026-03-23 monthly 0.9 https://fibratus.io/es/solutions/detection-engineers 2026-03-23 monthly 0.9 https://fibratus.io/solutions/soc-analysts 2026-03-23 monthly 0.9 https://fibratus.io/es/solutions/soc-analysts 2026-03-23 monthly 0.9 https://fibratus.io/solutions/threat-hunters 2026-03-23 monthly 0.9 https://fibratus.io/es/solutions/threat-hunters 2026-03-23 monthly 0.9 https://fibratus.io/kernel-runtime-security 2026-03-23 monthly 0.9 https://fibratus.io/es/kernel-runtime-security 2026-03-23 monthly 0.9 https://fibratus.io/behavioral-detection 2026-03-23 monthly 0.9 https://fibratus.io/es/behavioral-detection 2026-03-23 monthly 0.9 https://fibratus.io/detection-engineering 2026-03-23 monthly 0.9 https://fibratus.io/es/detection-engineering 2026-03-23 monthly 0.9 https://fibratus.io/about/mission 2026-03-23 monthly 0.7 https://fibratus.io/es/about/mission 2026-03-23 monthly 0.7 https://fibratus.io/about/open-source 2026-03-23 monthly 0.7 https://fibratus.io/es/about/open-source 2026-03-23 monthly 0.7 https://fibratus.io/about/team 2026-03-23 monthly 0.6 https://fibratus.io/es/about/team 2026-03-23 monthly 0.6 https://fibratus.io/contact 2026-03-23 yearly 0.5 https://fibratus.io/es/contact 2026-03-23 yearly 0.5 https://fibratus.io/downloads 2026-03-23 weekly 0.8 https://fibratus.io/es/downloads 2026-03-23 weekly 0.8 https://fibratus.io/roadmap 2026-03-23 weekly 0.7 https://fibratus.io/es/roadmap 2026-03-23 weekly 0.7 https://fibratus.io/blog 2026-03-23 weekly 0.7 https://fibratus.io/es/blog 2026-03-23 weekly 0.7 https://fibratus.io/glossary 2026-03-23 monthly 0.8 https://fibratus.io/es/glossary 2026-03-23 monthly 0.8 https://fibratus.io/rules 2026-03-23 weekly 0.9 https://fibratus.io/es/rules 2026-03-23 weekly 0.9 https://fibratus.io/terms 2026-03-23 yearly 0.3 https://fibratus.io/es/terms 2026-03-23 yearly 0.3 https://fibratus.io/privacy 2026-03-23 yearly 0.3 https://fibratus.io/es/privacy 2026-03-23 yearly 0.3 https://fibratus.io/changelog 2026-03-23 weekly 0.6 https://fibratus.io/blog/uac-bypass-detection-comprehensive-guide2026-04-09monthly0.9 https://fibratus.io/blog/lsass-credential-dumping-detection-windows2026-04-09monthly0.9 https://fibratus.io/blog/office-macro-initial-access-detection-windows2026-04-09monthly0.9 https://fibratus.io/blog/dll-sideloading-hijacking-detection-windows2026-04-09monthly0.8 https://fibratus.io/blog/registry-persistence-detection-windows2026-04-09monthly0.8 https://fibratus.io/blog/lolbin-abuse-detection-windows2026-04-09monthly0.8 https://fibratus.io/blog/dotnet-clr-abuse-detection-windows2026-04-09monthly0.8 https://fibratus.io/blog/how-fibratus-complements-splunk2026-03-23monthly0.8 https://fibratus.io/blog/how-fibratus-complements-elastic2026-03-23monthly0.8 https://fibratus.io/blog/how-fibratus-complements-crowdstrike2026-03-23monthly0.8 https://fibratus.io/blog/how-fibratus-complements-microsoft-defender2026-03-20monthly0.8 https://fibratus.io/blog/how-fibratus-complements-sysmon2026-03-17monthly0.8 https://fibratus.io/blog/detection-engineering-not-writing-rules2026-03-12monthly0.8 https://fibratus.io/blog/telemetry-ceiling-hard-limit2026-03-11monthly0.8 https://fibratus.io/blog/attack-to-primitives-mapping2026-03-10monthly0.8 https://fibratus.io/blog/state-modeling-missing-layer2026-03-04monthly0.8 https://fibratus.io/blog/valid-accounts-living-off-the-land-detection2026-03-03monthly0.8 https://fibratus.io/blog/adversarial-mimicry-behavioral-model-evasion2026-02-26monthly0.8 https://fibratus.io/blog/technique-first-detection-attack-invariants2026-02-25monthly0.8 https://fibratus.io/blog/why-signature-detection-keeps-losing2026-02-24monthly0.8 https://fibratus.io/blog/what-is-an-edr-crowdstrike-telemetry2026-02-19monthly0.8 https://fibratus.io/blog/detecting-process-injection-kernel-level-windows2026-02-18monthly0.8 https://fibratus.io/blog/userland-hooks-vs-kernel-telemetry2026-02-17monthly0.8 https://fibratus.io/blog/memory-scanning-at-runtime2026-02-12monthly0.8 https://fibratus.io/blog/detect-object-symbolic-link-abuse-windows2026-02-11monthly0.8 https://fibratus.io/blog/ntlm-hash-leak-ms-photos-uri-behavioral-detection2026-02-10monthly0.8 https://fibratus.io/blog/thread-pool-telemetry-sleeping-beacon-detection2026-02-05monthly0.8 https://fibratus.io/blog/how-to-write-behavioral-detection-rules2026-02-04monthly0.8 https://fibratus.io/blog/windows-kernel-event-monitoring-explained2026-02-03monthly0.8 https://fibratus.io/glossary/windows-kernel2026-03-23monthly0.6 https://fibratus.io/glossary/kernel-telemetry2026-03-23monthly0.6 https://fibratus.io/glossary/etw2026-03-23monthly0.6 https://fibratus.io/glossary/system-calls2026-03-23monthly0.6 https://fibratus.io/glossary/process-injection2026-03-23monthly0.6 https://fibratus.io/glossary/memory-allocation2026-03-23monthly0.6 https://fibratus.io/glossary/thread-creation2026-03-23monthly0.6 https://fibratus.io/glossary/registry-operations2026-03-23monthly0.6 https://fibratus.io/glossary/handle2026-03-23monthly0.6 https://fibratus.io/glossary/pe-portable-executable2026-03-23monthly0.6 https://fibratus.io/glossary/edr2026-03-23monthly0.6 https://fibratus.io/glossary/xdr2026-03-23monthly0.6 https://fibratus.io/glossary/behavioral-detection2026-03-23monthly0.6 https://fibratus.io/glossary/signature-detection2026-03-23monthly0.6 https://fibratus.io/glossary/runtime-detection2026-03-23monthly0.6 https://fibratus.io/glossary/defense-evasion2026-03-23monthly0.6 https://fibratus.io/glossary/adversary-tradecraft2026-03-23monthly0.6 https://fibratus.io/glossary/endpoint-security2026-03-23monthly0.6 https://fibratus.io/glossary/threat-hunting2026-03-23monthly0.6 https://fibratus.io/glossary/persistence2026-03-23monthly0.6 https://fibratus.io/glossary/credential-access2026-03-23monthly0.6 https://fibratus.io/glossary/ntlm2026-03-23monthly0.6 https://fibratus.io/glossary/userland-hooks2026-03-23monthly0.6 https://fibratus.io/glossary/detection-rule2026-03-23monthly0.6 https://fibratus.io/glossary/rule-engine2026-03-23monthly0.6 https://fibratus.io/glossary/filter-expressions2026-03-23monthly0.6 https://fibratus.io/glossary/event-correlation2026-03-23monthly0.6 https://fibratus.io/glossary/false-positives2026-03-23monthly0.6 https://fibratus.io/glossary/detection-coverage2026-03-23monthly0.6 https://fibratus.io/glossary/mitre-attack2026-03-23monthly0.6 https://fibratus.io/glossary/ttps2026-03-23monthly0.6 https://fibratus.io/glossary/yara2026-03-23monthly0.6 https://fibratus.io/glossary/sigma2026-03-23monthly0.6 https://fibratus.io/glossary/filaments2026-03-23monthly0.6 https://fibratus.io/glossary/kernel-event-pipeline2026-03-23monthly0.6 https://fibratus.io/glossary/execution-context2026-03-23monthly0.6 https://fibratus.io/glossary/process-tree2026-03-23monthly0.6 https://fibratus.io/glossary/process-state2026-03-23monthly0.6 https://fibratus.io/glossary/sequence-rules2026-03-23monthly0.6 https://fibratus.io/glossary/macros2026-03-23monthly0.6 https://fibratus.io/glossary/outputs2026-03-23monthly0.6 https://fibratus.io/glossary/alert-sinks2026-03-23monthly0.6 https://fibratus.io/glossary/captures2026-03-23monthly0.6 https://fibratus.io/glossary/transformers2026-03-23monthly0.6 https://fibratus.io/glossary/beaconing2026-03-23monthly0.6 https://fibratus.io/glossary/sleep-obfuscation2026-03-23monthly0.6 https://fibratus.io/glossary/endpoint-telemetry2026-03-23monthly0.6 https://fibratus.io/glossary/threat-intelligence2026-03-23monthly0.6 https://fibratus.io/glossary/soc2026-03-23monthly0.6 https://fibratus.io/glossary/forensic-telemetry2026-03-23monthly0.6 https://fibratus.io/glossary/detection-engineering2026-03-23monthly0.6 https://fibratus.io/glossary/runtime-security2026-03-23monthly0.6 https://fibratus.io/glossary/object-symbolic-link2026-03-23monthly0.6 https://fibratus.io/glossary/kernel-events2026-03-23monthly0.6 https://fibratus.io/glossary/invariant2026-03-23monthly0.6 https://fibratus.io/glossary/token-manipulation2026-03-23monthly0.6 https://fibratus.io/glossary/living-off-the-land2026-03-23monthly0.6 https://fibratus.io/glossary/adversarial-machine-learning2026-03-23monthly0.6 https://fibratus.io/glossary/valid-accounts2026-03-23monthly0.6 https://fibratus.io/glossary/dwell-time2026-03-23monthly0.6 https://fibratus.io/glossary/detection-pipeline2026-03-23monthly0.6 https://fibratus.io/glossary/state-modeling2026-03-23monthly0.6 https://fibratus.io/glossary/response-semantics2026-03-23monthly0.6 https://fibratus.io/glossary/uac-bypass2026-04-09monthly0.6 https://fibratus.io/glossary/dll-sideloading2026-04-09monthly0.6 https://fibratus.io/glossary/lolbin2026-04-09monthly0.6 https://fibratus.io/glossary/privilege-escalation2026-04-09monthly0.6 https://fibratus.io/docs2026-03-23weekly0.9 https://fibratus.io/docs/setup/installation2026-03-23monthly0.8 https://fibratus.io/docs/setup/quick-start2026-03-23monthly0.8 https://fibratus.io/docs/setup/configuration2026-03-23monthly0.7 https://fibratus.io/docs/setup/cli2026-03-23monthly0.7 https://fibratus.io/docs/kevents/anatomy2026-03-23monthly0.8 https://fibratus.io/docs/kevents/process2026-03-23monthly0.7 https://fibratus.io/docs/kevents/thread2026-03-23monthly0.7 https://fibratus.io/docs/kevents/image2026-03-23monthly0.7 https://fibratus.io/docs/kevents/file2026-03-23monthly0.7 https://fibratus.io/docs/kevents/registry2026-03-23monthly0.7 https://fibratus.io/docs/kevents/network2026-03-23monthly0.7 https://fibratus.io/docs/kevents/handle2026-03-23monthly0.6 https://fibratus.io/docs/kevents/object2026-03-23monthly0.6 https://fibratus.io/docs/kevents/driver2026-03-23monthly0.6 https://fibratus.io/docs/kevents/mem2026-03-23monthly0.7 https://fibratus.io/docs/filters/introduction2026-03-23monthly0.8 https://fibratus.io/docs/filters/prefiltering2026-03-23monthly0.6 https://fibratus.io/docs/filters/filtering2026-03-23monthly0.7 https://fibratus.io/docs/filters/operators2026-03-23monthly0.7 https://fibratus.io/docs/filters/iterators2026-03-23monthly0.6 https://fibratus.io/docs/filters/functions2026-03-23monthly0.7 https://fibratus.io/docs/filters/rules2026-03-23monthly0.8 https://fibratus.io/docs/filters/fields2026-03-23monthly0.7 https://fibratus.io/docs/captures/introduction2026-03-23monthly0.7 https://fibratus.io/docs/captures/capturing2026-03-23monthly0.6 https://fibratus.io/docs/captures/replaying2026-03-23monthly0.6 https://fibratus.io/docs/filaments/introduction2026-03-23monthly0.8 https://fibratus.io/docs/filaments/executing2026-03-23monthly0.6 https://fibratus.io/docs/filaments/internals2026-03-23monthly0.6 https://fibratus.io/docs/filaments/writing2026-03-23monthly0.7 https://fibratus.io/docs/outputs/introduction2026-03-23monthly0.7 https://fibratus.io/docs/outputs/console2026-03-23monthly0.6 https://fibratus.io/docs/outputs/null2026-03-23monthly0.5 https://fibratus.io/docs/outputs/rabbitmq2026-03-23monthly0.6 https://fibratus.io/docs/outputs/elasticsearch2026-03-23monthly0.7 https://fibratus.io/docs/outputs/http2026-03-23monthly0.6 https://fibratus.io/docs/outputs/eventlog2026-03-23monthly0.6 https://fibratus.io/docs/transformers/introduction2026-03-23monthly0.6 https://fibratus.io/docs/transformers/remove2026-03-23monthly0.5 https://fibratus.io/docs/transformers/rename2026-03-23monthly0.5 https://fibratus.io/docs/transformers/replace2026-03-23monthly0.5 https://fibratus.io/docs/transformers/tags2026-03-23monthly0.5 https://fibratus.io/docs/transformers/trim2026-03-23monthly0.5 https://fibratus.io/docs/alerts/introduction2026-03-23monthly0.7 https://fibratus.io/docs/alerts/senders2026-03-23monthly0.6 https://fibratus.io/docs/alerts/senders/mail2026-03-23monthly0.5 https://fibratus.io/docs/alerts/senders/slack2026-03-23monthly0.5 https://fibratus.io/docs/alerts/senders/systray2026-03-23monthly0.5 https://fibratus.io/docs/alerts/senders/eventlog2026-03-23monthly0.5 https://fibratus.io/docs/alerts/filaments2026-03-23monthly0.6 https://fibratus.io/docs/pe/introduction2026-03-23monthly0.7 https://fibratus.io/docs/pe/sections2026-03-23monthly0.5 https://fibratus.io/docs/pe/symbols2026-03-23monthly0.5 https://fibratus.io/docs/pe/resources2026-03-23monthly0.5 https://fibratus.io/docs/yara/introduction2026-03-23monthly0.8 https://fibratus.io/docs/yara/scanning2026-03-23monthly0.7 https://fibratus.io/docs/yara/alerts2026-03-23monthly0.6 https://fibratus.io/docs/troubleshooting/logs2026-03-23monthly0.6 https://fibratus.io/docs/troubleshooting/stats2026-03-23monthly0.5 https://fibratus.io/docs/troubleshooting/pprof2026-03-23monthly0.5 https://fibratus.io/rules/defense_evasion_dotnet_assembly_loaded_by_unmanaged_process2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_activity_from_unhooked_ntdll_module2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_clear_eventlog2026-04-09monthly0.6 https://fibratus.io/rules/initial_access_clickfix_phishing_via_browser_dialog_box2026-04-09monthly0.6 https://fibratus.io/rules/credential_access_credential_manager_access_via_known_tools2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_dll_loaded_via_callback_function2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_dll_loaded_via_apc_queue2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_dll_loaded_via_ldrpkernel32_overwrite2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_dll_sideloading_via_copied_binary2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_dll_sideloading_via_microsoft_office_dropped_file2026-04-09monthly0.6 https://fibratus.io/rules/execution_embedded_executable_file_run_via_shortcut2026-04-09monthly0.6 https://fibratus.io/rules/execution_embedded_script_execution_via_shortcut_file2026-04-09monthly0.6 https://fibratus.io/rules/initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document2026-04-09monthly0.6 https://fibratus.io/rules/persistence_executable_file_dropped_by_unsigned_service_dll2026-04-09monthly0.6 https://fibratus.io/rules/initial_access_execution_via_microsoft_office_process2026-04-09monthly0.6 https://fibratus.io/rules/privilege_escalation_exploitation_via_common_log_file_system2026-04-09monthly0.6 https://fibratus.io/rules/privilege_escalation_fake_system_root_directory_creation2026-04-09monthly0.6 https://fibratus.io/rules/privilege_escalation_fake_system_root_environment_variable_manipulation2026-04-09monthly0.6 https://fibratus.io/rules/credentail_access_file_access_to_sam_database2026-04-09monthly0.6 https://fibratus.io/rules/persistence_hidden_local_account_creation2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_hidden_registry_key_creation2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_image_load_via_ntfs_transaction2026-04-09monthly0.6 https://fibratus.io/rules/credential_access_lsass_access_from_unsigned_executable2026-04-09monthly0.6 https://fibratus.io/rules/credential_access_lsass_handle_leak_via_seclogon2026-04-09monthly0.6 https://fibratus.io/rules/credential_access_lsass_memory_dump_preparation_via_silent_process_exit2026-04-09monthly0.6 https://fibratus.io/rules/credential_access_lsass_memory_dump_via_minidumpwritedump2026-04-09monthly0.6 https://fibratus.io/rules/credential_access_lsass_memory_dump_via_wer2026-04-09monthly0.6 https://fibratus.io/rules/credential_access_lsass_memory_dumping2026-04-09monthly0.6 https://fibratus.io/rules/credential_access_lsass_process_clone_creation_via_reflection2026-04-09monthly0.6 https://fibratus.io/rules/initial_access_macro_execution_via_script_interpreter2026-04-09monthly0.6 https://fibratus.io/rules/initial_access_microsoft_office_file_execution_via_script_interpreter2026-04-09monthly0.6 https://fibratus.io/rules/initial_access_microsoft_office_file_execution_via_wmi2026-04-09monthly0.6 https://fibratus.io/rules/persistence_network_connection_via_startup_folder_executable_or_script2026-04-09monthly0.6 https://fibratus.io/rules/initial_access_potential_clickfix_infection_chain2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_potential_injection_via_dotnet_debugging2026-04-09monthly0.6 https://fibratus.io/rules/credential_access_potential_lsa_secrets_registry_dumping2026-04-09monthly0.6 https://fibratus.io/rules/persistence_potential_mandatory_profile_registry_persistence2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_potential_ntdll_unhooking_via_file_mapping2026-04-09monthly0.6 https://fibratus.io/rules/credential_access_potential_ntlm_hash_leak_via_ms_photos2026-04-09monthly0.6 https://fibratus.io/rules/credential_access_potential_ntlm_hash_leak_via_shortcut_file2026-04-09monthly0.6 https://fibratus.io/rules/persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification2026-04-09monthly0.6 https://fibratus.io/rules/privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit2026-04-09monthly0.6 https://fibratus.io/rules/privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface2026-04-09monthly0.6 https://fibratus.io/rules/privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_potential_process_creation_via_shellcode2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_potential_process_injection_via_tainted_memory_section2026-04-09monthly0.6 https://fibratus.io/rules/credential_access_potential_sam_hive_dumping2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_potential_shellcode_execution_via_etw_logger_thread2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_potential_shellcode_injection_via_windows_debugging_api2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_potential_thread_execution_hijacking2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_process_creation_from_stomped_module2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_process_creation_via_direct_syscall2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_process_creation_via_ntfs_transaction2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_process_execution_from_self_deleting_binary2026-04-09monthly0.6 https://fibratus.io/rules/execution_process_execution_from_compressed_file_via_explorer2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_process_execution_from_hollowed_memory_section2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_process_execution_from_remote_memory_section2026-04-09monthly0.6 https://fibratus.io/rules/initial_access_process_spawned_from_macro_enabled_microsoft_office_document2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_process_spawned_from_unusual_directory2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_process_spawned_via_remote_thread2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_regsvr32_scriptlet_execution2026-04-09monthly0.6 https://fibratus.io/rules/credential_access_remote_thread_creation_into_lsass2026-04-09monthly0.6 https://fibratus.io/rules/persistence_rid_hijacking2026-04-09monthly0.6 https://fibratus.io/rules/persistence_script_interpreter_or_untrusted_process_persistence2026-04-09monthly0.6 https://fibratus.io/rules/credential_access_suspicious_access_to_active_directory_domain_database2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_suspicious_access_to_the_hosts_file2026-04-09monthly0.6 https://fibratus.io/rules/credential_access_suspicious_access_to_unattended_panther_files2026-04-09monthly0.6 https://fibratus.io/rules/credential_access_suspicious_access_to_windows_manager_files2026-04-09monthly0.6 https://fibratus.io/rules/credential_access_suspicious_access_to_windows_dpapi_master_keys2026-04-09monthly0.6 https://fibratus.io/rules/credential_access_suspicious_access_to_windows_vault_files2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_suspicious_activity_from_reflected_process2026-04-09monthly0.6 https://fibratus.io/rules/privilege_escalation_suspicious_child_process_integrity_level2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_suspicious_child_spawned_via_reflected_process2026-04-09monthly0.6 https://fibratus.io/rules/initial_access_suspicious_dll_loaded_by_microsoft_office_process2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_suspicious_dll_loaded_via_memory_section_mapping2026-04-09monthly0.6 https://fibratus.io/rules/initial_access_suspicious_execution_via_wmi_from_microsoft_office_process2026-04-09monthly0.6 https://fibratus.io/rules/initial_access_suspicious_file_delivery_via_html_smuggling2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_suspicious_html_application_script_execution2026-04-09monthly0.6 https://fibratus.io/rules/persistence_suspicious_microsoft_office_addin_loaded2026-04-09monthly0.6 https://fibratus.io/rules/initial_access_suspicious_microsoft_office_embedded_object2026-04-09monthly0.6 https://fibratus.io/rules/persistence_suspicious_microsoft_office_template2026-04-09monthly0.6 https://fibratus.io/rules/execution_suspicious_mshta_execution_via_html_smuggling2026-04-09monthly0.6 https://fibratus.io/rules/persistence_suspicious_netsh_helper_dll_execution2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_suspicious_object_symbolic_link_creation2026-04-09monthly0.6 https://fibratus.io/rules/persistence_suspicious_persistence_via_registry_modification2026-04-09monthly0.6 https://fibratus.io/rules/persistence_suspicious_port_monitor_loaded2026-04-09monthly0.6 https://fibratus.io/rules/persistence_suspicious_print_processor_loaded2026-04-09monthly0.6 https://fibratus.io/rules/execution_suspicious_process_execution_from_archive_via_shortcut_file2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_suspicious_protected_process_execution2026-04-09monthly0.6 https://fibratus.io/rules/credential_access_suspicious_security_package_loaded_by_lsass2026-04-09monthly0.6 https://fibratus.io/rules/persistence_suspicious_startup_shell_folder_modification2026-04-09monthly0.6 https://fibratus.io/rules/credential_access_suspicious_vault_client_dll_load2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_suspicious_virtual_path_redirection2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_suspicious_windows_defender_exclusions_registry_modification2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_suspicious_xsl_script_execution2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_system_binary_proxy_execution_via_rundll322026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_thread_context_manipulation_from_exception_handler2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_thread_context_set_from_unbacked_memory2026-04-09monthly0.6 https://fibratus.io/rules/privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack2026-04-09monthly0.6 https://fibratus.io/rules/privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack2026-04-09monthly0.6 https://fibratus.io/rules/privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack2026-04-09monthly0.6 https://fibratus.io/rules/privilege_escalation_uac_bypass_via_command_handler_hijacking2026-04-09monthly0.6 https://fibratus.io/rules/privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack2026-04-09monthly0.6 https://fibratus.io/rules/privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack2026-04-09monthly0.6 https://fibratus.io/rules/privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory2026-04-09monthly0.6 https://fibratus.io/rules/privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface2026-04-09monthly0.6 https://fibratus.io/rules/privilege_escalation_uac_bypass_via_icmluautil_com_interface2026-04-09monthly0.6 https://fibratus.io/rules/privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking2026-04-09monthly0.6 https://fibratus.io/rules/privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack2026-04-09monthly0.6 https://fibratus.io/rules/privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack2026-04-09monthly0.6 https://fibratus.io/rules/privilege_escalation_uac_bypass_via_rouge_mmc_snap-in2026-04-09monthly0.6 https://fibratus.io/rules/privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_unsigned_dll_injection_via_remote_thread2026-04-09monthly0.6 https://fibratus.io/rules/credential_access_unusual_access_to_ssh_keys2026-04-09monthly0.6 https://fibratus.io/rules/credential_access_unusual_access_to_web_browser_credential_stores2026-04-09monthly0.6 https://fibratus.io/rules/credential_access_unusual_access_to_windows_credential_history2026-04-09monthly0.6 https://fibratus.io/rules/persistence_unusual_file_written_in_startup_folder2026-04-09monthly0.6 https://fibratus.io/rules/persistence_unusual_process_modified_registry_run_key2026-04-09monthly0.6 https://fibratus.io/rules/privilege_escalation_vulnerable_or_malicious_driver_dropped2026-04-09monthly0.6 https://fibratus.io/rules/privilege_escalation_vulnerable_or_malicious_driver_loaded2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_windows_defender_driver_unloading2026-04-09monthly0.6 https://fibratus.io/rules/defense_evasion_windows_defender_protection_tampering_via_registry2026-04-09monthly0.6