{
  "run": {
    "url": "https://github.com/PranaVVelu/detection-validation-pipeline/actions/runs/41999719846",
    "commit": "0813e4fbd2e161167df3087bb00db071b04726ee",
    "finished": "5 Nov 2026, 09:11 UTC"
  },
  "summary": {
    "rules_passed": 10,
    "rules_total": 10,
    "evasion_caught": 5,
    "evasion_total": 10,
    "noise_quiet": 5,
    "noise_total": 11,
    "elastic_agree": 125,
    "elastic_total": 127,
    "healthy": true
  },
  "mode": "real",
  "rules": [
    {
      "id": "9c3e1a72-5d08-4f6b-b1e7-40a8d2c6f915",
      "title": "PowerShell Launched With Encoded Command (Defender XDR)",
      "file": "detections/kql/powershell_encoded_command.kql",
      "kind": "kql",
      "techniques": [
        "T1059.001"
      ],
      "category": "process_creation",
      "threat": "",
      "verdict": "PASS",
      "checks": [
        {
          "name": "Technique mapping",
          "passed": true
        },
        {
          "name": "True positive",
          "passed": true
        },
        {
          "name": "No false positive",
          "passed": true
        }
      ],
      "evasion_caught": 0,
      "evasion_total": 0,
      "noisy_scenarios": 1,
      "scenarios": 11,
      "elastic_agree": 0,
      "elastic_total": 0
    },
    {
      "id": "8f47a0d3-2b6e-4c91-a5d8-16c3e9f7b240",
      "title": "Game Loaded a System DLL From Outside the Windows Folder",
      "file": "detections/sigma/game/image_load_win_game_system_dll_outside_system_folder.yml",
      "kind": "sigma",
      "techniques": [
        "T1574.001"
      ],
      "category": "image_load",
      "threat": "mod-injection",
      "verdict": "PASS",
      "checks": [
        {
          "name": "Technique mapping",
          "passed": true
        },
        {
          "name": "True positive",
          "passed": true
        },
        {
          "name": "No false positive",
          "passed": true
        }
      ],
      "evasion_caught": 1,
      "evasion_total": 2,
      "noisy_scenarios": 1,
      "scenarios": 11,
      "elastic_agree": 14,
      "elastic_total": 15
    },
    {
      "id": "4d1b8e72-c6f5-49a3-b07e-5a92d3c1f806",
      "title": "Process Requested Write Access to Game Memory",
      "file": "detections/sigma/game/proc_access_win_game_memory_write_access.yml",
      "kind": "sigma",
      "techniques": [
        "T1055"
      ],
      "category": "process_access",
      "threat": "memory-tampering",
      "verdict": "PASS",
      "checks": [
        {
          "name": "Technique mapping",
          "passed": true
        },
        {
          "name": "True positive",
          "passed": true
        },
        {
          "name": "No false positive",
          "passed": true
        }
      ],
      "evasion_caught": 1,
      "evasion_total": 2,
      "noisy_scenarios": 1,
      "scenarios": 11,
      "elastic_agree": 15,
      "elastic_total": 15
    },
    {
      "id": "2c9e6b14-71d3-4a58-9f02-e8b4c5d7a361",
      "title": "License Server Redirected Through the Hosts File",
      "file": "detections/sigma/game/proc_creation_win_game_license_server_hosts_block.yml",
      "kind": "sigma",
      "techniques": [
        "T1565.001"
      ],
      "category": "process_creation",
      "threat": "license-bypass",
      "verdict": "PASS",
      "checks": [
        {
          "name": "Technique mapping",
          "passed": true
        },
        {
          "name": "True positive",
          "passed": true
        },
        {
          "name": "No false positive",
          "passed": true
        }
      ],
      "evasion_caught": 1,
      "evasion_total": 2,
      "noisy_scenarios": 0,
      "scenarios": 11,
      "elastic_agree": 15,
      "elastic_total": 15
    },
    {
      "id": "9a4d2f68-1e7b-4c30-a8d5-6f0b3c7e2914",
      "title": "Game Running From an Unofficial Build",
      "file": "detections/sigma/game/proc_creation_win_game_unofficial_build.yml",
      "kind": "sigma",
      "techniques": [
        "T1554"
      ],
      "category": "process_creation",
      "threat": "bootleg-copy",
      "verdict": "PASS",
      "checks": [
        {
          "name": "Technique mapping",
          "passed": true
        },
        {
          "name": "True positive",
          "passed": true
        },
        {
          "name": "No false positive",
          "passed": true
        }
      ],
      "evasion_caught": 1,
      "evasion_total": 1,
      "noisy_scenarios": 1,
      "scenarios": 11,
      "elastic_agree": 14,
      "elastic_total": 14
    },
    {
      "id": "b83f17d2-9c64-4e0a-b5f1-7a2d6e4c9038",
      "title": "License Key Guessing From One Address",
      "file": "detections/sigma/license/license_activation_key_guessing.yml",
      "kind": "sigma",
      "techniques": [
        "T1110"
      ],
      "category": "license_activation",
      "threat": "license-key-guessing",
      "verdict": "PASS",
      "checks": [
        {
          "name": "Technique mapping",
          "passed": true
        },
        {
          "name": "True positive",
          "passed": true
        },
        {
          "name": "No false positive",
          "passed": true
        }
      ],
      "evasion_caught": 1,
      "evasion_total": 2,
      "noisy_scenarios": 1,
      "scenarios": 11,
      "elastic_agree": 15,
      "elastic_total": 15
    },
    {
      "id": "e5c28b70-3d1f-4a96-8c47-1f9e0b6d2a83",
      "title": "One License Key Activated on Too Many Machines",
      "file": "detections/sigma/license/license_activation_key_sharing.yml",
      "kind": "sigma",
      "techniques": [
        "T1078"
      ],
      "category": "license_activation",
      "threat": "license-key-sharing",
      "verdict": "PASS",
      "checks": [
        {
          "name": "Technique mapping",
          "passed": true
        },
        {
          "name": "True positive",
          "passed": true
        },
        {
          "name": "No false positive",
          "passed": true
        }
      ],
      "evasion_caught": 0,
      "evasion_total": 1,
      "noisy_scenarios": 1,
      "scenarios": 11,
      "elastic_agree": 14,
      "elastic_total": 14
    },
    {
      "id": "e41c7d90-3f6a-4b28-8a15-96d2b7c0f3a4",
      "title": "Command Shell Obfuscated With Environment Variable Substring",
      "file": "detections/sigma/proc_creation_win_cmd_env_var_substring_obfuscation.yml",
      "kind": "sigma",
      "techniques": [
        "T1059.003"
      ],
      "category": "process_creation",
      "threat": "",
      "verdict": "PASS",
      "checks": [
        {
          "name": "Technique mapping",
          "passed": true
        },
        {
          "name": "True positive",
          "passed": true
        },
        {
          "name": "No false positive",
          "passed": true
        }
      ],
      "evasion_caught": 0,
      "evasion_total": 0,
      "noisy_scenarios": 0,
      "scenarios": 11,
      "elastic_agree": 13,
      "elastic_total": 13
    },
    {
      "id": "5b2f8c1e-7a44-4e0b-9d3a-2c61f0a8e7d1",
      "title": "PowerShell Launched With Encoded Command",
      "file": "detections/sigma/proc_creation_win_powershell_encoded_command.yml",
      "kind": "sigma",
      "techniques": [
        "T1059.001"
      ],
      "category": "process_creation",
      "threat": "",
      "verdict": "PASS",
      "checks": [
        {
          "name": "Technique mapping",
          "passed": true
        },
        {
          "name": "True positive",
          "passed": true
        },
        {
          "name": "No false positive",
          "passed": true
        }
      ],
      "evasion_caught": 0,
      "evasion_total": 0,
      "noisy_scenarios": 1,
      "scenarios": 11,
      "elastic_agree": 12,
      "elastic_total": 13
    },
    {
      "id": "7d1f4a26-8c3b-4e95-a0d7-3b6e92c1f584",
      "title": "PowerShell Launched With Short Encoded Flag",
      "file": "detections/sigma/proc_creation_win_powershell_short_encoded_flag.yml",
      "kind": "sigma",
      "techniques": [
        "T1059.001"
      ],
      "category": "process_creation",
      "threat": "",
      "verdict": "PASS",
      "checks": [
        {
          "name": "Technique mapping",
          "passed": true
        },
        {
          "name": "True positive",
          "passed": true
        },
        {
          "name": "No false positive",
          "passed": true
        }
      ],
      "evasion_caught": 0,
      "evasion_total": 0,
      "noisy_scenarios": 0,
      "scenarios": 11,
      "elastic_agree": 13,
      "elastic_total": 13
    }
  ],
  "evasion": [
    {
      "id": "hosts-add-content",
      "name": "Edit hosts with PowerShell instead of a cmd redirect",
      "rule": "License Server Redirected Through the Hosts File",
      "rule_file": "detections/sigma/game/proc_creation_win_game_license_server_hosts_block.yml",
      "expected": "caught",
      "actual": "caught",
      "as_recorded": true,
      "why": "The rule first only looked for a > in the command, and now knows the PowerShell ways to write a file.",
      "events": 1,
      "events_rule_reads": 1,
      "alerts": 1
    },
    {
      "id": "hosts-script-file",
      "name": "Edit hosts from a script file",
      "rule": "License Server Redirected Through the Hosts File",
      "rule_file": "detections/sigma/game/proc_creation_win_game_license_server_hosts_block.yml",
      "expected": "missed",
      "actual": "missed",
      "as_recorded": true,
      "why": "The command line only shows the script's name. Catching this needs file monitoring on hosts.",
      "events": 1,
      "events_rule_reads": 1,
      "alerts": 0
    },
    {
      "id": "dll-uppercase-name",
      "name": "Plant the DLL with an uppercase name",
      "rule": "Game Loaded a System DLL From Outside the Windows Folder",
      "rule_file": "detections/sigma/game/image_load_win_game_system_dll_outside_system_folder.yml",
      "expected": "caught",
      "actual": "caught",
      "as_recorded": true,
      "why": "Rule matching ignores case.",
      "events": 36,
      "events_rule_reads": 35,
      "alerts": 1
    },
    {
      "id": "dll-renamed-game",
      "name": "Plant the DLL next to a renamed copy of the game",
      "rule": "Game Loaded a System DLL From Outside the Windows Folder",
      "rule_file": "detections/sigma/game/image_load_win_game_system_dll_outside_system_folder.yml",
      "expected": "missed",
      "actual": "missed",
      "as_recorded": true,
      "why": "The rule and the Sysmon config both go by the game's file name, so these DLL loads aren't logged.",
      "events": 1,
      "events_rule_reads": 0,
      "alerts": 0
    },
    {
      "id": "memory-full-access",
      "name": "Request full access to the game's memory",
      "rule": "Process Requested Write Access to Game Memory",
      "rule_file": "detections/sigma/game/proc_access_win_game_memory_write_access.yml",
      "expected": "missed",
      "actual": "missed",
      "as_recorded": true,
      "why": "A launcher gets full access to the game too, so the rule leaves this value out to avoid false alerts.",
      "events": 36,
      "events_rule_reads": 1,
      "alerts": 0
    },
    {
      "id": "memory-write-only",
      "name": "Request only the rights needed to write memory",
      "rule": "Process Requested Write Access to Game Memory",
      "rule_file": "detections/sigma/game/proc_access_win_game_memory_write_access.yml",
      "expected": "caught",
      "actual": "caught",
      "as_recorded": true,
      "why": "The rule's list of values first assumed read access was requested too.",
      "events": 36,
      "events_rule_reads": 1,
      "alerts": 1
    },
    {
      "id": "bootleg-renamed",
      "name": "Run the modified copy under a different file name",
      "rule": "Game Running From an Unofficial Build",
      "rule_file": "detections/sigma/game/proc_creation_win_game_unofficial_build.yml",
      "expected": "caught",
      "actual": "caught",
      "as_recorded": true,
      "why": "The rule first only checked the file name, and now also reads the name stored inside the file.",
      "events": 1,
      "events_rule_reads": 1,
      "alerts": 1
    },
    {
      "id": "guessing-many-machine-ids",
      "name": "Guess keys while changing the reported machine ID",
      "rule": "License Key Guessing From One Address",
      "rule_file": "detections/sigma/license/license_activation_key_guessing.yml",
      "expected": "caught",
      "actual": "caught",
      "as_recorded": true,
      "why": "The rule counts by address, which the client can't choose as easily.",
      "events": 25,
      "events_rule_reads": 25,
      "alerts": 1
    },
    {
      "id": "guessing-many-addresses",
      "name": "Guess keys from many addresses",
      "rule": "License Key Guessing From One Address",
      "rule_file": "detections/sigma/license/license_activation_key_guessing.yml",
      "expected": "missed",
      "actual": "missed",
      "as_recorded": true,
      "why": "The rule counts each address separately. Counting across addresses needs tuning against real traffic.",
      "events": 25,
      "events_rule_reads": 25,
      "alerts": 0
    },
    {
      "id": "sharing-same-machine-id",
      "name": "Share a key among users reporting the same machine ID",
      "rule": "One License Key Activated on Too Many Machines",
      "rule_file": "detections/sigma/license/license_activation_key_sharing.yml",
      "expected": "missed",
      "actual": "missed",
      "as_recorded": true,
      "why": "The rule trusts the machine ID the client reports. In production, counting addresses per key could help.",
      "events": 8,
      "events_rule_reads": 8,
      "alerts": 0
    }
  ],
  "noise": [
    {
      "id": "normal-session",
      "name": "Normal session with the official game",
      "events": 76,
      "fires": [],
      "recorded": [],
      "as_recorded": true,
      "alerts": {},
      "why": "Nothing unusual happens."
    },
    {
      "id": "launcher-starts-game",
      "name": "Launcher starts and stops the game",
      "events": 40,
      "fires": [],
      "recorded": [],
      "as_recorded": true,
      "alerts": {},
      "why": "The memory rule leaves out full access, because launchers get it too."
    },
    {
      "id": "update-before-hash-list",
      "name": "Official update before its hash reaches the list",
      "events": 35,
      "fires": [
        "detections/sigma/game/proc_creation_win_game_unofficial_build.yml"
      ],
      "recorded": [
        "detections/sigma/game/proc_creation_win_game_unofficial_build.yml"
      ],
      "as_recorded": true,
      "alerts": {
        "detections/sigma/game/proc_creation_win_game_unofficial_build.yml": 1
      },
      "why": "A new build looks like a bootleg until it's listed, so a release has to publish its hash first."
    },
    {
      "id": "overlay-opens-game",
      "name": "Overlay opens the game with write access",
      "events": 36,
      "fires": [
        "detections/sigma/game/proc_access_win_game_memory_write_access.yml"
      ],
      "recorded": [
        "detections/sigma/game/proc_access_win_game_memory_write_access.yml"
      ],
      "as_recorded": true,
      "alerts": {
        "detections/sigma/game/proc_access_win_game_memory_write_access.yml": 1
      },
      "why": "Overlays can ask for the same access as cheats. Allowing one by file name would be easy to fake, so this needs signature checks."
    },
    {
      "id": "mod-manager-adds-dll",
      "name": "Mod manager adds a DLL to the game's folder",
      "events": 34,
      "fires": [
        "detections/sigma/game/image_load_win_game_system_dll_outside_system_folder.yml"
      ],
      "recorded": [
        "detections/sigma/game/image_load_win_game_system_dll_outside_system_folder.yml"
      ],
      "as_recorded": true,
      "alerts": {
        "detections/sigma/game/image_load_win_game_system_dll_outside_system_folder.yml": 1
      },
      "why": "A legitimate mod and a crack load the same way, so telling them apart needs a list of approved mods."
    },
    {
      "id": "admin-encoded-command",
      "name": "Admin tool runs an encoded PowerShell command",
      "events": 1,
      "fires": [
        "detections/kql/powershell_encoded_command.kql",
        "detections/sigma/proc_creation_win_powershell_encoded_command.yml"
      ],
      "recorded": [
        "detections/kql/powershell_encoded_command.kql",
        "detections/sigma/proc_creation_win_powershell_encoded_command.yml"
      ],
      "as_recorded": true,
      "alerts": {
        "detections/kql/powershell_encoded_command.kql": 1,
        "detections/sigma/proc_creation_win_powershell_encoded_command.yml": 1
      },
      "why": "Some management software uses encoded commands, so these rules need an allowlist tuned to each environment."
    },
    {
      "id": "launch-day",
      "name": "Launch day with 60 players activating",
      "events": 60,
      "fires": [],
      "recorded": [],
      "as_recorded": true,
      "alerts": {},
      "why": "Each player has a real key on one machine."
    },
    {
      "id": "lan-event-small",
      "name": "Small LAN event with 12 players mistyping once",
      "events": 24,
      "fires": [],
      "recorded": [],
      "as_recorded": true,
      "alerts": {},
      "why": "Set off the guessing rule until its threshold went from 10 different keys to 20."
    },
    {
      "id": "lan-event-large",
      "name": "School or large LAN event with 30 players mistyping once",
      "events": 60,
      "fires": [
        "detections/sigma/license/license_activation_key_guessing.yml"
      ],
      "recorded": [
        "detections/sigma/license/license_activation_key_guessing.yml"
      ],
      "as_recorded": true,
      "alerts": {
        "detections/sigma/license/license_activation_key_guessing.yml": 1
      },
      "why": "Everyone shares one address. Grouping by machine too would stop this, but guessers can change their reported machine ID."
    },
    {
      "id": "family-shared-pc",
      "name": "Family sharing one PC with their own keys",
      "events": 3,
      "fires": [],
      "recorded": [],
      "as_recorded": true,
      "alerts": {},
      "why": "The sharing rule counts machines per key, not keys per machine."
    },
    {
      "id": "new-pc-same-hour",
      "name": "Player sets up a new PC within the hour",
      "events": 3,
      "fires": [
        "detections/sigma/license/license_activation_key_sharing.yml"
      ],
      "recorded": [
        "detections/sigma/license/license_activation_key_sharing.yml"
      ],
      "as_recorded": true,
      "alerts": {
        "detections/sigma/license/license_activation_key_sharing.yml": 1
      },
      "why": "A third machine in an hour goes past the two allowed seats. It looks the same as the start of key sharing."
    }
  ],
  "elastic": [
    {
      "dataset": "test/real-telemetry-detections-sigma-game-image_load_win_game_system_dll_outside_system_folder-yml",
      "rule": "Game Loaded a System DLL From Outside the Windows Folder",
      "rule_file": "detections/sigma/game/image_load_win_game_system_dll_outside_system_folder.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "test/real-telemetry-detections-sigma-game-image_load_win_game_system_dll_outside_system_folder-yml",
      "rule": "Game Loaded a System DLL From Outside the Windows Folder",
      "rule_file": "detections/sigma/game/image_load_win_game_system_dll_outside_system_folder.yml",
      "scenario": "attack",
      "engine_fires": true,
      "elastic_fires": true,
      "agree": true
    },
    {
      "dataset": "test/real-telemetry-detections-sigma-game-proc_access_win_game_memory_write_access-yml",
      "rule": "Process Requested Write Access to Game Memory",
      "rule_file": "detections/sigma/game/proc_access_win_game_memory_write_access.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "test/real-telemetry-detections-sigma-game-proc_access_win_game_memory_write_access-yml",
      "rule": "Process Requested Write Access to Game Memory",
      "rule_file": "detections/sigma/game/proc_access_win_game_memory_write_access.yml",
      "scenario": "attack",
      "engine_fires": true,
      "elastic_fires": true,
      "agree": true
    },
    {
      "dataset": "test/real-telemetry-detections-sigma-game-proc_creation_win_game_license_server_hosts_block-yml",
      "rule": "License Server Redirected Through the Hosts File",
      "rule_file": "detections/sigma/game/proc_creation_win_game_license_server_hosts_block.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "test/real-telemetry-detections-sigma-game-proc_creation_win_game_license_server_hosts_block-yml",
      "rule": "License Server Redirected Through the Hosts File",
      "rule_file": "detections/sigma/game/proc_creation_win_game_license_server_hosts_block.yml",
      "scenario": "attack",
      "engine_fires": true,
      "elastic_fires": true,
      "agree": true
    },
    {
      "dataset": "test/real-telemetry-detections-sigma-game-proc_creation_win_game_unofficial_build-yml",
      "rule": "Game Running From an Unofficial Build",
      "rule_file": "detections/sigma/game/proc_creation_win_game_unofficial_build.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "test/real-telemetry-detections-sigma-game-proc_creation_win_game_unofficial_build-yml",
      "rule": "Game Running From an Unofficial Build",
      "rule_file": "detections/sigma/game/proc_creation_win_game_unofficial_build.yml",
      "scenario": "attack",
      "engine_fires": true,
      "elastic_fires": true,
      "agree": true
    },
    {
      "dataset": "test/real-telemetry-detections-sigma-license-license_activation_key_guessing-yml",
      "rule": "License Key Guessing From One Address",
      "rule_file": "detections/sigma/license/license_activation_key_guessing.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "test/real-telemetry-detections-sigma-license-license_activation_key_guessing-yml",
      "rule": "License Key Guessing From One Address",
      "rule_file": "detections/sigma/license/license_activation_key_guessing.yml",
      "scenario": "attack",
      "engine_fires": true,
      "elastic_fires": true,
      "agree": true
    },
    {
      "dataset": "test/real-telemetry-detections-sigma-license-license_activation_key_sharing-yml",
      "rule": "One License Key Activated on Too Many Machines",
      "rule_file": "detections/sigma/license/license_activation_key_sharing.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "test/real-telemetry-detections-sigma-license-license_activation_key_sharing-yml",
      "rule": "One License Key Activated on Too Many Machines",
      "rule_file": "detections/sigma/license/license_activation_key_sharing.yml",
      "scenario": "attack",
      "engine_fires": true,
      "elastic_fires": true,
      "agree": true
    },
    {
      "dataset": "test/real-telemetry-detections-sigma-proc_creation_win_cmd_env_var_substring_obfuscation-yml",
      "rule": "Command Shell Obfuscated With Environment Variable Substring",
      "rule_file": "detections/sigma/proc_creation_win_cmd_env_var_substring_obfuscation.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "test/real-telemetry-detections-sigma-proc_creation_win_cmd_env_var_substring_obfuscation-yml",
      "rule": "Command Shell Obfuscated With Environment Variable Substring",
      "rule_file": "detections/sigma/proc_creation_win_cmd_env_var_substring_obfuscation.yml",
      "scenario": "attack",
      "engine_fires": true,
      "elastic_fires": true,
      "agree": true
    },
    {
      "dataset": "test/real-telemetry-detections-sigma-proc_creation_win_powershell_encoded_command-yml",
      "rule": "PowerShell Launched With Encoded Command",
      "rule_file": "detections/sigma/proc_creation_win_powershell_encoded_command.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "test/real-telemetry-detections-sigma-proc_creation_win_powershell_encoded_command-yml",
      "rule": "PowerShell Launched With Encoded Command",
      "rule_file": "detections/sigma/proc_creation_win_powershell_encoded_command.yml",
      "scenario": "attack",
      "engine_fires": true,
      "elastic_fires": true,
      "agree": true
    },
    {
      "dataset": "test/real-telemetry-detections-sigma-proc_creation_win_powershell_short_encoded_flag-yml",
      "rule": "PowerShell Launched With Short Encoded Flag",
      "rule_file": "detections/sigma/proc_creation_win_powershell_short_encoded_flag.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "test/real-telemetry-detections-sigma-proc_creation_win_powershell_short_encoded_flag-yml",
      "rule": "PowerShell Launched With Short Encoded Flag",
      "rule_file": "detections/sigma/proc_creation_win_powershell_short_encoded_flag.yml",
      "scenario": "attack",
      "engine_fires": true,
      "elastic_fires": true,
      "agree": true
    },
    {
      "dataset": "evasion/hosts-add-content",
      "rule": "License Server Redirected Through the Hosts File",
      "rule_file": "detections/sigma/game/proc_creation_win_game_license_server_hosts_block.yml",
      "scenario": "attack",
      "engine_fires": true,
      "elastic_fires": true,
      "agree": true
    },
    {
      "dataset": "evasion/hosts-script-file",
      "rule": "License Server Redirected Through the Hosts File",
      "rule_file": "detections/sigma/game/proc_creation_win_game_license_server_hosts_block.yml",
      "scenario": "attack",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "evasion/dll-uppercase-name",
      "rule": "Game Loaded a System DLL From Outside the Windows Folder",
      "rule_file": "detections/sigma/game/image_load_win_game_system_dll_outside_system_folder.yml",
      "scenario": "attack",
      "engine_fires": true,
      "elastic_fires": false,
      "agree": false
    },
    {
      "dataset": "evasion/dll-renamed-game",
      "rule": "Game Loaded a System DLL From Outside the Windows Folder",
      "rule_file": "detections/sigma/game/image_load_win_game_system_dll_outside_system_folder.yml",
      "scenario": "attack",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "evasion/memory-full-access",
      "rule": "Process Requested Write Access to Game Memory",
      "rule_file": "detections/sigma/game/proc_access_win_game_memory_write_access.yml",
      "scenario": "attack",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "evasion/memory-write-only",
      "rule": "Process Requested Write Access to Game Memory",
      "rule_file": "detections/sigma/game/proc_access_win_game_memory_write_access.yml",
      "scenario": "attack",
      "engine_fires": true,
      "elastic_fires": true,
      "agree": true
    },
    {
      "dataset": "evasion/bootleg-renamed",
      "rule": "Game Running From an Unofficial Build",
      "rule_file": "detections/sigma/game/proc_creation_win_game_unofficial_build.yml",
      "scenario": "attack",
      "engine_fires": true,
      "elastic_fires": true,
      "agree": true
    },
    {
      "dataset": "evasion/guessing-many-machine-ids",
      "rule": "License Key Guessing From One Address",
      "rule_file": "detections/sigma/license/license_activation_key_guessing.yml",
      "scenario": "attack",
      "engine_fires": true,
      "elastic_fires": true,
      "agree": true
    },
    {
      "dataset": "evasion/guessing-many-addresses",
      "rule": "License Key Guessing From One Address",
      "rule_file": "detections/sigma/license/license_activation_key_guessing.yml",
      "scenario": "attack",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "evasion/sharing-same-machine-id",
      "rule": "One License Key Activated on Too Many Machines",
      "rule_file": "detections/sigma/license/license_activation_key_sharing.yml",
      "scenario": "attack",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/normal-session",
      "rule": "Game Loaded a System DLL From Outside the Windows Folder",
      "rule_file": "detections/sigma/game/image_load_win_game_system_dll_outside_system_folder.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/normal-session",
      "rule": "Process Requested Write Access to Game Memory",
      "rule_file": "detections/sigma/game/proc_access_win_game_memory_write_access.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/normal-session",
      "rule": "License Server Redirected Through the Hosts File",
      "rule_file": "detections/sigma/game/proc_creation_win_game_license_server_hosts_block.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/normal-session",
      "rule": "Game Running From an Unofficial Build",
      "rule_file": "detections/sigma/game/proc_creation_win_game_unofficial_build.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/normal-session",
      "rule": "License Key Guessing From One Address",
      "rule_file": "detections/sigma/license/license_activation_key_guessing.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/normal-session",
      "rule": "One License Key Activated on Too Many Machines",
      "rule_file": "detections/sigma/license/license_activation_key_sharing.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/normal-session",
      "rule": "Command Shell Obfuscated With Environment Variable Substring",
      "rule_file": "detections/sigma/proc_creation_win_cmd_env_var_substring_obfuscation.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/normal-session",
      "rule": "PowerShell Launched With Encoded Command",
      "rule_file": "detections/sigma/proc_creation_win_powershell_encoded_command.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/normal-session",
      "rule": "PowerShell Launched With Short Encoded Flag",
      "rule_file": "detections/sigma/proc_creation_win_powershell_short_encoded_flag.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/launcher-starts-game",
      "rule": "Game Loaded a System DLL From Outside the Windows Folder",
      "rule_file": "detections/sigma/game/image_load_win_game_system_dll_outside_system_folder.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/launcher-starts-game",
      "rule": "Process Requested Write Access to Game Memory",
      "rule_file": "detections/sigma/game/proc_access_win_game_memory_write_access.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/launcher-starts-game",
      "rule": "License Server Redirected Through the Hosts File",
      "rule_file": "detections/sigma/game/proc_creation_win_game_license_server_hosts_block.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/launcher-starts-game",
      "rule": "Game Running From an Unofficial Build",
      "rule_file": "detections/sigma/game/proc_creation_win_game_unofficial_build.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/launcher-starts-game",
      "rule": "License Key Guessing From One Address",
      "rule_file": "detections/sigma/license/license_activation_key_guessing.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/launcher-starts-game",
      "rule": "One License Key Activated on Too Many Machines",
      "rule_file": "detections/sigma/license/license_activation_key_sharing.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/launcher-starts-game",
      "rule": "Command Shell Obfuscated With Environment Variable Substring",
      "rule_file": "detections/sigma/proc_creation_win_cmd_env_var_substring_obfuscation.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/launcher-starts-game",
      "rule": "PowerShell Launched With Encoded Command",
      "rule_file": "detections/sigma/proc_creation_win_powershell_encoded_command.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/launcher-starts-game",
      "rule": "PowerShell Launched With Short Encoded Flag",
      "rule_file": "detections/sigma/proc_creation_win_powershell_short_encoded_flag.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/update-before-hash-list",
      "rule": "Game Loaded a System DLL From Outside the Windows Folder",
      "rule_file": "detections/sigma/game/image_load_win_game_system_dll_outside_system_folder.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/update-before-hash-list",
      "rule": "Process Requested Write Access to Game Memory",
      "rule_file": "detections/sigma/game/proc_access_win_game_memory_write_access.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/update-before-hash-list",
      "rule": "License Server Redirected Through the Hosts File",
      "rule_file": "detections/sigma/game/proc_creation_win_game_license_server_hosts_block.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/update-before-hash-list",
      "rule": "Game Running From an Unofficial Build",
      "rule_file": "detections/sigma/game/proc_creation_win_game_unofficial_build.yml",
      "scenario": "benign",
      "engine_fires": true,
      "elastic_fires": true,
      "agree": true
    },
    {
      "dataset": "noise/update-before-hash-list",
      "rule": "License Key Guessing From One Address",
      "rule_file": "detections/sigma/license/license_activation_key_guessing.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/update-before-hash-list",
      "rule": "One License Key Activated on Too Many Machines",
      "rule_file": "detections/sigma/license/license_activation_key_sharing.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/update-before-hash-list",
      "rule": "Command Shell Obfuscated With Environment Variable Substring",
      "rule_file": "detections/sigma/proc_creation_win_cmd_env_var_substring_obfuscation.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/update-before-hash-list",
      "rule": "PowerShell Launched With Encoded Command",
      "rule_file": "detections/sigma/proc_creation_win_powershell_encoded_command.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/update-before-hash-list",
      "rule": "PowerShell Launched With Short Encoded Flag",
      "rule_file": "detections/sigma/proc_creation_win_powershell_short_encoded_flag.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/overlay-opens-game",
      "rule": "Game Loaded a System DLL From Outside the Windows Folder",
      "rule_file": "detections/sigma/game/image_load_win_game_system_dll_outside_system_folder.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/overlay-opens-game",
      "rule": "Process Requested Write Access to Game Memory",
      "rule_file": "detections/sigma/game/proc_access_win_game_memory_write_access.yml",
      "scenario": "benign",
      "engine_fires": true,
      "elastic_fires": true,
      "agree": true
    },
    {
      "dataset": "noise/overlay-opens-game",
      "rule": "License Server Redirected Through the Hosts File",
      "rule_file": "detections/sigma/game/proc_creation_win_game_license_server_hosts_block.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/overlay-opens-game",
      "rule": "Game Running From an Unofficial Build",
      "rule_file": "detections/sigma/game/proc_creation_win_game_unofficial_build.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/overlay-opens-game",
      "rule": "License Key Guessing From One Address",
      "rule_file": "detections/sigma/license/license_activation_key_guessing.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/overlay-opens-game",
      "rule": "One License Key Activated on Too Many Machines",
      "rule_file": "detections/sigma/license/license_activation_key_sharing.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/overlay-opens-game",
      "rule": "Command Shell Obfuscated With Environment Variable Substring",
      "rule_file": "detections/sigma/proc_creation_win_cmd_env_var_substring_obfuscation.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/overlay-opens-game",
      "rule": "PowerShell Launched With Encoded Command",
      "rule_file": "detections/sigma/proc_creation_win_powershell_encoded_command.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/overlay-opens-game",
      "rule": "PowerShell Launched With Short Encoded Flag",
      "rule_file": "detections/sigma/proc_creation_win_powershell_short_encoded_flag.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/mod-manager-adds-dll",
      "rule": "Game Loaded a System DLL From Outside the Windows Folder",
      "rule_file": "detections/sigma/game/image_load_win_game_system_dll_outside_system_folder.yml",
      "scenario": "benign",
      "engine_fires": true,
      "elastic_fires": true,
      "agree": true
    },
    {
      "dataset": "noise/mod-manager-adds-dll",
      "rule": "Process Requested Write Access to Game Memory",
      "rule_file": "detections/sigma/game/proc_access_win_game_memory_write_access.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/mod-manager-adds-dll",
      "rule": "License Server Redirected Through the Hosts File",
      "rule_file": "detections/sigma/game/proc_creation_win_game_license_server_hosts_block.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/mod-manager-adds-dll",
      "rule": "Game Running From an Unofficial Build",
      "rule_file": "detections/sigma/game/proc_creation_win_game_unofficial_build.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/mod-manager-adds-dll",
      "rule": "License Key Guessing From One Address",
      "rule_file": "detections/sigma/license/license_activation_key_guessing.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/mod-manager-adds-dll",
      "rule": "One License Key Activated on Too Many Machines",
      "rule_file": "detections/sigma/license/license_activation_key_sharing.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/mod-manager-adds-dll",
      "rule": "Command Shell Obfuscated With Environment Variable Substring",
      "rule_file": "detections/sigma/proc_creation_win_cmd_env_var_substring_obfuscation.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/mod-manager-adds-dll",
      "rule": "PowerShell Launched With Encoded Command",
      "rule_file": "detections/sigma/proc_creation_win_powershell_encoded_command.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/mod-manager-adds-dll",
      "rule": "PowerShell Launched With Short Encoded Flag",
      "rule_file": "detections/sigma/proc_creation_win_powershell_short_encoded_flag.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/admin-encoded-command",
      "rule": "Game Loaded a System DLL From Outside the Windows Folder",
      "rule_file": "detections/sigma/game/image_load_win_game_system_dll_outside_system_folder.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/admin-encoded-command",
      "rule": "Process Requested Write Access to Game Memory",
      "rule_file": "detections/sigma/game/proc_access_win_game_memory_write_access.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/admin-encoded-command",
      "rule": "License Server Redirected Through the Hosts File",
      "rule_file": "detections/sigma/game/proc_creation_win_game_license_server_hosts_block.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/admin-encoded-command",
      "rule": "Game Running From an Unofficial Build",
      "rule_file": "detections/sigma/game/proc_creation_win_game_unofficial_build.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/admin-encoded-command",
      "rule": "License Key Guessing From One Address",
      "rule_file": "detections/sigma/license/license_activation_key_guessing.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/admin-encoded-command",
      "rule": "One License Key Activated on Too Many Machines",
      "rule_file": "detections/sigma/license/license_activation_key_sharing.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/admin-encoded-command",
      "rule": "Command Shell Obfuscated With Environment Variable Substring",
      "rule_file": "detections/sigma/proc_creation_win_cmd_env_var_substring_obfuscation.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/admin-encoded-command",
      "rule": "PowerShell Launched With Encoded Command",
      "rule_file": "detections/sigma/proc_creation_win_powershell_encoded_command.yml",
      "scenario": "benign",
      "engine_fires": true,
      "elastic_fires": false,
      "agree": false
    },
    {
      "dataset": "noise/admin-encoded-command",
      "rule": "PowerShell Launched With Short Encoded Flag",
      "rule_file": "detections/sigma/proc_creation_win_powershell_short_encoded_flag.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/launch-day",
      "rule": "Game Loaded a System DLL From Outside the Windows Folder",
      "rule_file": "detections/sigma/game/image_load_win_game_system_dll_outside_system_folder.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/launch-day",
      "rule": "Process Requested Write Access to Game Memory",
      "rule_file": "detections/sigma/game/proc_access_win_game_memory_write_access.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/launch-day",
      "rule": "License Server Redirected Through the Hosts File",
      "rule_file": "detections/sigma/game/proc_creation_win_game_license_server_hosts_block.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/launch-day",
      "rule": "Game Running From an Unofficial Build",
      "rule_file": "detections/sigma/game/proc_creation_win_game_unofficial_build.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/launch-day",
      "rule": "License Key Guessing From One Address",
      "rule_file": "detections/sigma/license/license_activation_key_guessing.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/launch-day",
      "rule": "One License Key Activated on Too Many Machines",
      "rule_file": "detections/sigma/license/license_activation_key_sharing.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/launch-day",
      "rule": "Command Shell Obfuscated With Environment Variable Substring",
      "rule_file": "detections/sigma/proc_creation_win_cmd_env_var_substring_obfuscation.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/launch-day",
      "rule": "PowerShell Launched With Encoded Command",
      "rule_file": "detections/sigma/proc_creation_win_powershell_encoded_command.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/launch-day",
      "rule": "PowerShell Launched With Short Encoded Flag",
      "rule_file": "detections/sigma/proc_creation_win_powershell_short_encoded_flag.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/lan-event-small",
      "rule": "Game Loaded a System DLL From Outside the Windows Folder",
      "rule_file": "detections/sigma/game/image_load_win_game_system_dll_outside_system_folder.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/lan-event-small",
      "rule": "Process Requested Write Access to Game Memory",
      "rule_file": "detections/sigma/game/proc_access_win_game_memory_write_access.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/lan-event-small",
      "rule": "License Server Redirected Through the Hosts File",
      "rule_file": "detections/sigma/game/proc_creation_win_game_license_server_hosts_block.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/lan-event-small",
      "rule": "Game Running From an Unofficial Build",
      "rule_file": "detections/sigma/game/proc_creation_win_game_unofficial_build.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/lan-event-small",
      "rule": "License Key Guessing From One Address",
      "rule_file": "detections/sigma/license/license_activation_key_guessing.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/lan-event-small",
      "rule": "One License Key Activated on Too Many Machines",
      "rule_file": "detections/sigma/license/license_activation_key_sharing.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/lan-event-small",
      "rule": "Command Shell Obfuscated With Environment Variable Substring",
      "rule_file": "detections/sigma/proc_creation_win_cmd_env_var_substring_obfuscation.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/lan-event-small",
      "rule": "PowerShell Launched With Encoded Command",
      "rule_file": "detections/sigma/proc_creation_win_powershell_encoded_command.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/lan-event-small",
      "rule": "PowerShell Launched With Short Encoded Flag",
      "rule_file": "detections/sigma/proc_creation_win_powershell_short_encoded_flag.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/lan-event-large",
      "rule": "Game Loaded a System DLL From Outside the Windows Folder",
      "rule_file": "detections/sigma/game/image_load_win_game_system_dll_outside_system_folder.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/lan-event-large",
      "rule": "Process Requested Write Access to Game Memory",
      "rule_file": "detections/sigma/game/proc_access_win_game_memory_write_access.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/lan-event-large",
      "rule": "License Server Redirected Through the Hosts File",
      "rule_file": "detections/sigma/game/proc_creation_win_game_license_server_hosts_block.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/lan-event-large",
      "rule": "Game Running From an Unofficial Build",
      "rule_file": "detections/sigma/game/proc_creation_win_game_unofficial_build.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/lan-event-large",
      "rule": "License Key Guessing From One Address",
      "rule_file": "detections/sigma/license/license_activation_key_guessing.yml",
      "scenario": "benign",
      "engine_fires": true,
      "elastic_fires": true,
      "agree": true
    },
    {
      "dataset": "noise/lan-event-large",
      "rule": "One License Key Activated on Too Many Machines",
      "rule_file": "detections/sigma/license/license_activation_key_sharing.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/lan-event-large",
      "rule": "Command Shell Obfuscated With Environment Variable Substring",
      "rule_file": "detections/sigma/proc_creation_win_cmd_env_var_substring_obfuscation.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/lan-event-large",
      "rule": "PowerShell Launched With Encoded Command",
      "rule_file": "detections/sigma/proc_creation_win_powershell_encoded_command.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/lan-event-large",
      "rule": "PowerShell Launched With Short Encoded Flag",
      "rule_file": "detections/sigma/proc_creation_win_powershell_short_encoded_flag.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/family-shared-pc",
      "rule": "Game Loaded a System DLL From Outside the Windows Folder",
      "rule_file": "detections/sigma/game/image_load_win_game_system_dll_outside_system_folder.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/family-shared-pc",
      "rule": "Process Requested Write Access to Game Memory",
      "rule_file": "detections/sigma/game/proc_access_win_game_memory_write_access.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/family-shared-pc",
      "rule": "License Server Redirected Through the Hosts File",
      "rule_file": "detections/sigma/game/proc_creation_win_game_license_server_hosts_block.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/family-shared-pc",
      "rule": "Game Running From an Unofficial Build",
      "rule_file": "detections/sigma/game/proc_creation_win_game_unofficial_build.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/family-shared-pc",
      "rule": "License Key Guessing From One Address",
      "rule_file": "detections/sigma/license/license_activation_key_guessing.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/family-shared-pc",
      "rule": "One License Key Activated on Too Many Machines",
      "rule_file": "detections/sigma/license/license_activation_key_sharing.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/family-shared-pc",
      "rule": "Command Shell Obfuscated With Environment Variable Substring",
      "rule_file": "detections/sigma/proc_creation_win_cmd_env_var_substring_obfuscation.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/family-shared-pc",
      "rule": "PowerShell Launched With Encoded Command",
      "rule_file": "detections/sigma/proc_creation_win_powershell_encoded_command.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/family-shared-pc",
      "rule": "PowerShell Launched With Short Encoded Flag",
      "rule_file": "detections/sigma/proc_creation_win_powershell_short_encoded_flag.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/new-pc-same-hour",
      "rule": "Game Loaded a System DLL From Outside the Windows Folder",
      "rule_file": "detections/sigma/game/image_load_win_game_system_dll_outside_system_folder.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/new-pc-same-hour",
      "rule": "Process Requested Write Access to Game Memory",
      "rule_file": "detections/sigma/game/proc_access_win_game_memory_write_access.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/new-pc-same-hour",
      "rule": "License Server Redirected Through the Hosts File",
      "rule_file": "detections/sigma/game/proc_creation_win_game_license_server_hosts_block.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/new-pc-same-hour",
      "rule": "Game Running From an Unofficial Build",
      "rule_file": "detections/sigma/game/proc_creation_win_game_unofficial_build.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/new-pc-same-hour",
      "rule": "License Key Guessing From One Address",
      "rule_file": "detections/sigma/license/license_activation_key_guessing.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/new-pc-same-hour",
      "rule": "One License Key Activated on Too Many Machines",
      "rule_file": "detections/sigma/license/license_activation_key_sharing.yml",
      "scenario": "benign",
      "engine_fires": true,
      "elastic_fires": true,
      "agree": true
    },
    {
      "dataset": "noise/new-pc-same-hour",
      "rule": "Command Shell Obfuscated With Environment Variable Substring",
      "rule_file": "detections/sigma/proc_creation_win_cmd_env_var_substring_obfuscation.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/new-pc-same-hour",
      "rule": "PowerShell Launched With Encoded Command",
      "rule_file": "detections/sigma/proc_creation_win_powershell_encoded_command.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    },
    {
      "dataset": "noise/new-pc-same-hour",
      "rule": "PowerShell Launched With Short Encoded Flag",
      "rule_file": "detections/sigma/proc_creation_win_powershell_short_encoded_flag.yml",
      "scenario": "benign",
      "engine_fires": false,
      "elastic_fires": false,
      "agree": true
    }
  ]
}