サンプル検出ルール

States
関数
フィールド演算子
オペランド（ファセット値エクストラクタ）
関心アーチファクト
パス
Filters

{
    "States": [
    {
        "Name": "TestFile",
        "Scope": "Global",
        "Function": "(a)",
        "FieldOperators": {
            "a": {
                "Type": "Contains",
                "Operands": [
                    {
                        "Source": "TargetFile",
                        "Data": "Path"
                    },
                    {
                        "Source": "Literal",
                        "Data": "my_test_file"
                    }
                ],
                "OperandType": "String"
                }
            },
            "ActivationTimeLimit": "-0:00:00.001",
            "Actions": [
                {
                    "Type": "AOI",
                    "ItemName": "InstigatingProcess",
                    "Position": "PostActivation"
                },
                {
                    "Type": "AOI",
                    "ItemName": "TargetProcess",
                    "Position": "PostActivation"
                },
                {
                    "Type": "AOI",
                    "ItemName": "TargetFile",
                    "Position": "PostActivation"
                }
            ],
            "HarvestContributingEvent": true,
            "Filters": [
                {
                    "Type": "Event",
                    "Data": {
                        "Category": "File",
                        "SubCategory": "",
                        "Type": "Create"
                    }
                }
            ]
        }
    ],
     "Paths": [
        {
            "StateNames": [
            "NewSuspiciousFile",
            "CertUtilDecode"
            ]
        }
    ],
    "Tags": [
        "CylanceOPTICS"
    ]
}