.event-meta{display:flex;flex-wrap:wrap;gap:.4em 1rem;margin:.5em 0 .75em;padding:.4em .75em;background:var(--bg2);border-radius:4px}.event-meta:empty{display:none}.event-meta>div{display:flex;flex-direction:column;min-width:0}.event-meta dt{font-size:.75rem;text-transform:uppercase;letter-spacing:.05em;color:var(--fg2)}.event-meta dd{margin:0;font-weight:600;overflow-wrap:anywhere}.event-section{margin:1em 0}.event-section h2,.event-section h3{font-size:1rem;margin:0 0 .4em}.event-detection-rules .event-section{margin:.8em 0 0}.event-detection-rules .event-section:first-of-type{margin-top:.4em}.event-section>p{margin:0}.section-anchor{color:var(--fg2);text-decoration:none;opacity:0;margin-left:.3em;font-size:.85em;font-weight:400}.event-section h2:hover .section-anchor,.event-section h3:hover .section-anchor,.event-section:target .section-anchor{opacity:1}.section-anchor:hover{color:var(--link)}.event-section[id]{scroll-margin-top:calc(var(--hf-height) + 1em)}.event-message{white-space:pre-wrap;word-break:break-word;overflow-wrap:anywhere;margin:0;padding:.75em 1em;border-radius:4px;font-size:.85rem;line-height:1.6}.record-type-msgtype{font-size:.8rem;font-weight:400;font-family:var(--font-mono,monospace);color:var(--fg2);margin-left:.5em;white-space:nowrap}.auditd-rule{margin:0;padding:.6em .9em;border-radius:4px;background:var(--bg2);font-size:.85rem;line-height:1.5;overflow-x:auto}.source-list{list-style:none;padding:0;margin:0}.source-list>li{margin-bottom:1em}.source-list>li>p{margin:.25em 0 0}.source-cite{font-size:.8rem;color:var(--fg2)}.source-caveat{font-size:.85rem;color:var(--fg2)}.event-oie-note{font-size:.85rem;color:var(--fg2);border-left:3px solid var(--border);padding-left:.6em;margin:.4em 0 .8em}.detection-notes-refs-label{margin-bottom:.2em}.detection-notes-refs{font-size:.85rem;color:var(--fg2);margin:0 0 .8em;padding-left:1.6em}.detection-notes-refs li{margin:.15em 0}.detection-notes-refs li:target{background:var(--bg2)}.event-example-note{font-size:.85rem;color:var(--fg2);border-left:3px solid var(--border);padding-left:.6em;margin:.4em 0 .8em}.event-example-code{border:1px solid var(--border);border-radius:4px;max-height:36rem;max-width:100%;min-height:8rem;overflow:auto;resize:vertical}.event-example-code>div,.event-example-code pre{margin:0}pre.chroma{max-width:100%;overflow-x:auto}pre.chroma code,pre.chroma .line{display:block;white-space:pre;word-break:normal;overflow-wrap:normal}pre.chroma code[data-lang="json"] .s2{white-space:pre-wrap;overflow-wrap:anywhere}.msg-param{color:var(--msg-param);font-weight:600}.event-fields-table{width:auto;max-width:100%;border-collapse:collapse}.event-fields-table th{text-align:left;font-size:.8rem;padding:.4em .75em}.event-fields-table td{padding:.4em .75em}.event-fields-table td:first-child{white-space:nowrap}.event-fields-table{border-collapse:separate;border-spacing:0}.event-fields-table td,.event-fields-table th{border:0;border-bottom:1px solid var(--border)}.event-fields-table tbody tr:last-child td{border-bottom:0}.event-compact-table{width:auto;max-width:100%;border-collapse:separate;border-spacing:0;font-size:.875rem}.event-compact-table th{text-align:left;font-size:.8rem;padding:.35em .75em;border:0;border-bottom:2px solid var(--border)}.event-compact-table td{padding:.35em .75em;border:0;border-bottom:1px solid var(--border);vertical-align:top}.event-compact-table tbody tr:last-child td{border-bottom:0}.event-compact-table td:first-child{white-space:nowrap}.event-compact-table code{word-break:normal;overflow-wrap:anywhere}.event-envelope-details>summary{cursor:pointer;font-size:1rem;font-weight:600;margin:0 0 .4em}.event-envelope-details summary:hover .section-anchor,.event-envelope-details:target .section-anchor{opacity:1}@media(max-width:600px){.event-fields-table thead{display:none}.event-fields-table tr{display:block;padding:.5em 0;border-bottom:1px solid var(--border)}.event-fields-table tbody tr:last-child{border-bottom:0}.event-fields-table td{display:block;padding:.15em 0;border:0}.event-fields-table td:first-child{padding-bottom:.3em;white-space:normal}.event-fields-table .field-rule-count{text-align:left}.event-fields-table .field-rule-count:empty{display:none}.event-fields-table .field-rule-unit{display:inline}.event-compact-table thead{display:none}.event-compact-table,.event-compact-table tbody,.event-compact-table tr,.event-compact-table td{display:block}.event-compact-table tr{padding:.5em 0;border-bottom:1px solid var(--border)}.event-compact-table tbody tr:last-child{border-bottom:0}.event-compact-table td{padding:.15em 0;border:0}.event-compact-table td:first-child{white-space:normal}}.field-rule-count{text-align:right;white-space:nowrap;color:var(--fg2);font-size:.85rem}.field-rule-unit{display:none}.common-indicators-table,.cross-vendor-table{width:100%;border-collapse:separate;border-spacing:0;font-size:.875rem}.common-indicators-table th,.cross-vendor-table th{text-align:left;font-size:.8rem;padding:.4em .75em;border:0;border-bottom:2px solid var(--border)}.common-indicators-table td,.cross-vendor-table td{padding:.35em .75em;border:0;border-bottom:1px solid var(--border);vertical-align:top}.common-indicators-table tbody tr:last-child td{border-bottom:0}.common-indicators-table .rule-num,.cross-vendor-table .rule-num{text-align:right;font-variant-numeric:tabular-nums;white-space:nowrap}.rule-num{text-align:right;white-space:nowrap;font-variant-numeric:tabular-nums;color:var(--fg2);width:5rem}.common-indicators-table .indicator-vendors{color:var(--fg2);font-size:.8rem;white-space:nowrap}.common-indicators-table code,.cross-vendor-table code{word-break:break-all}.indicator-rules-unit{display:none}@media(max-width:600px){.common-indicators-table thead{display:none}.common-indicators-table,.common-indicators-table tbody{display:block}.common-indicators-table tr{display:block;padding:.5em 0;border-bottom:1px solid var(--border)}.common-indicators-table tbody tr:last-child{border-bottom:0}.common-indicators-table td{display:inline;padding:0;border:0}.common-indicators-table td+td::before{content:" "}.common-indicators-table code{word-break:normal;overflow-wrap:anywhere}.common-indicators-table td code:empty{display:none}.common-indicators-table .rule-num::before{content:"\A";white-space:pre}.common-indicators-table .rule-num{font-size:.8rem;color:var(--fg2)}.indicator-rules-unit{display:inline}.common-indicators-table .indicator-vendors{white-space:normal}.common-indicators-table .indicator-vendors::before{content:" · "}}.field-type{display:inline-block;font-size:.7rem;font-family:var(--font-mono,monospace);padding:.1em .4em;margin-left:.4em;border-radius:3px;background:var(--bg3);color:var(--fg2);vertical-align:baseline;white-space:nowrap}.field-presence{font-size:.75rem;color:var(--fg2);margin-left:.55em;white-space:nowrap}.field-presence-note{display:block;font-size:.85rem;color:var(--fg2);margin-top:.3em;max-width:40rem}details.field-values{margin-top:.35em}details.field-values summary{cursor:pointer;font-size:.9375rem;color:var(--fg2)}.field-value-list{display:grid;grid-template-columns:auto minmax(0,1fr);gap:.125em .75em;margin:.35em 0 0;padding:0;font-size:.9375rem}.field-value-list dt{margin:0;color:var(--fg2)}.field-value-list dd{margin:0;overflow-wrap:anywhere}.field-example-value{margin:0;padding:.5em .75em;border-radius:4px;background:var(--bg3);font-size:.85em;line-height:1.5;overflow-x:auto}@media(max-width:600px){.field-value-list{grid-template-columns:1fr;gap:0}.field-value-list dt{margin-top:.35em}.field-value-list dt:first-child{margin-top:0}.field-value-list dd{padding-left:1em}}.detection-rules{list-style:none;padding:0;margin:0}.detection-rules li{padding:.25em .5em;border-bottom:1px solid var(--bg3)}.detection-rules li:nth-child(odd){background:var(--bg2)}.detection-rules li:last-child{border-bottom:0}.rule-severity{display:inline-block;font-size:.75rem;font-weight:600;padding:.15em .5em;border-radius:3px;vertical-align:middle;text-transform:uppercase;letter-spacing:.03em}.rel-inferred-pill{display:inline-block;font-size:.65em;font-weight:600;padding:.05em .4em;margin-right:.35em;border:1px dashed var(--fg2);border-radius:3px;vertical-align:middle;text-transform:uppercase;letter-spacing:.03em;color:var(--fg2);cursor:help}.rule-severity--informational,.rule-severity--low,.rule-severity--medium,.rule-severity--high,.rule-severity--critical{background:var(--badge-bg);color:var(--badge-fg)}.sigma-desc{color:var(--fg2);overflow-wrap:anywhere}.rules-overflow-link{margin:.25em 0 0;font-size:.9em}.ref-page-link{font-size:.75rem;font-weight:400;color:var(--fg2);text-decoration:none;margin-left:.5em}.ref-page-link:hover{color:var(--link);text-decoration:underline}.rule-also-fires{display:block;font-size:.8rem;color:var(--fg2);font-style:italic;margin-top:.1em}.related-events{list-style:none;padding:0;margin:0}.related-event-group{margin-bottom:1.25em}.related-event-group-label{font-weight:700;font-size:1rem;margin-bottom:.5em;padding-bottom:.25em;text-transform:uppercase;letter-spacing:.03em}.related-event-card{border:1px solid var(--border);border-radius:4px;padding:.6em .8em;margin-bottom:.4em}.related-event-card .related-event-line1{font-weight:500;overflow-wrap:anywhere}.related-event-card .related-event-line2{padding-left:0;color:var(--fg2);margin-top:.2em}.related-event-source{font-size:.8em;opacity:.7}.related-event-rules{list-style:none;padding:0;margin:.4em 0 0 0}.related-event-rules li{font-size:.85em;padding:.15em 0;color:var(--fg1)}.related-event-rule-vendor{display:inline-block;font-size:.75em;font-weight:600;padding:.1em .45em;border-radius:3px;vertical-align:middle;text-transform:uppercase;letter-spacing:.03em;background:var(--badge-bg);color:var(--badge-fg);margin-right:.35em}.event-provider-table{width:100%;border-collapse:separate;border-spacing:0;border:1px solid var(--border)}.event-provider-table th,.event-provider-table td{border-right:1px solid var(--border);border-bottom:1px solid var(--border)}.event-provider-table th:last-child,.event-provider-table td:last-child{border-right:0}.event-provider-table tbody tr:last-child td{border-bottom:0}.event-provider-table th{text-align:left;font-size:.8rem;padding:.4em .75em;white-space:nowrap}.catalog-header-tooltip{position:relative;display:inline-flex}.catalog-header-tooltip-trigger{appearance:none;padding:0;border:0;border-bottom:1px dotted currentColor;border-radius:0;background:transparent;color:inherit;font:inherit;font-weight:inherit;line-height:inherit;cursor:help}.catalog-header-tooltip-trigger:hover{color:var(--link)}.catalog-header-tooltip-trigger:focus-visible{outline:2px solid var(--link);outline-offset:2px}.catalog-header-tooltip-content{position:fixed;z-index:30;top:0;left:0;width:max-content;max-width:min(18rem,calc(100vw - 2rem));padding:.45rem .6rem;border:1px solid var(--border);border-radius:4px;background:var(--bg1);box-shadow:0 4px 12px rgba(0,0,0,0.15);color:var(--fg1);font-size:.78rem;font-weight:400;letter-spacing:normal;line-height:1.35;text-align:left;text-transform:none;white-space:normal;visibility:hidden;opacity:0;pointer-events:auto}.catalog-header-tooltip:hover .catalog-header-tooltip-content,.catalog-header-tooltip:focus-within .catalog-header-tooltip-content{visibility:visible;opacity:1}.catalog-header-tooltip.catalog-header-tooltip--dismissed .catalog-header-tooltip-content{visibility:hidden;opacity:0}.event-provider-table td{padding:.4em .75em}.event-provider-table td a{color:var(--link)}.event-provider-table .provider-row--stub{opacity:.6}.defender-landing .section-count{opacity:.6;font-weight:normal;font-size:.85em}.defender-landing .row-note{display:block;opacity:.7;font-size:.85em}.defender-landing .evidence-rule{opacity:.65;font-size:.85em}.defender-landing .evidence-internal{opacity:.7;font-size:.85em;font-style:italic}.defender-landing .evidence-classes{margin:.5em 0 1em}.defender-landing .evidence-classes dt{font-weight:600;margin-top:.5em}.defender-landing .evidence-classes dd{margin:.1em 0 0;color:var(--fg2);font-size:.9em}.defender-landing .defender-group{font-size:.95rem;margin-top:1.1em;margin-bottom:.35em}.defender-landing .asr-panel{border-left:2px solid var(--border);padding-left:.75em;margin-bottom:.6em}.mde-landing .event-id-list{list-style:none;margin:0;padding:0}.mde-landing .event-id-list li{line-height:1.4}.mde-landing .event-id-list li+li{margin-top:.2em}@media(min-width:700px){.mde-landing .event-provider-table{table-layout:fixed}.mde-landing .event-provider-table .col-mde-provider{width:23%;white-space:normal;overflow-wrap:break-word}.mde-landing .event-provider-table .col-mde-rule-names{width:21%}.mde-landing .event-provider-table td{overflow-wrap:anywhere}}@media(max-width:699px){.mde-landing .event-provider-table thead{display:none}.mde-landing .event-provider-table,.mde-landing .event-provider-table tbody,.mde-landing .event-provider-table tr,.mde-landing .event-provider-table td{display:block}.mde-landing .event-provider-table tr{border-bottom:1px solid var(--border);padding:.5em .25em}.mde-landing .event-provider-table td{border:0;padding:.15em 0}.mde-landing .event-provider-table .col-mde-provider,.mde-landing .event-provider-table .col-nowrap{white-space:normal;font-weight:600}.mde-landing .event-provider-table td[data-label]::before{content:attr(data-label) " ";display:block;margin-top:.3em;font-size:.75rem;color:var(--fg2)}.mde-landing .event-provider-table td[data-label]:empty{display:none}}.defender-landing .etw-provenance{margin-top:.15em;font-size:.82em;color:var(--fg2);white-space:normal;word-break:break-all}.defender-landing .etw-provenance code{font-size:inherit}.provider-sensor-note{font-size:.9rem;color:var(--fg1);border-left:3px solid var(--border);padding-left:.75em;margin-top:.5em}.event-provider-table .col-count{width:1%;white-space:nowrap}.semantic-labels-page .event-provider-table .col-count{text-align:right;font-variant-numeric:tabular-nums}.event-provider-table .col-shrink{width:1%;white-space:nowrap}.okta-namespaces-table .col-namespace{width:11rem;white-space:normal;overflow-wrap:normal;word-break:normal}.catalog-telemetry-inline{display:none}@media(max-width:600px){.event-provider-table th,.event-provider-table td{padding-right:.4em;padding-left:.4em}.event-provider-table th.col-count{white-space:normal}.okta-namespaces-table.hub-fold-table .col-namespace{width:8rem}.home-catalog-table .col-telemetry,.hub-fold-table .col-secondary{display:none}.home-catalog-table .col-shrink,.hub-fold-table .col-shrink{width:auto;white-space:normal}.hub-fold-table .col-shrink{overflow-wrap:anywhere}.home-catalog-table .catalog-telemetry-inline,.hub-fold-table .catalog-telemetry-inline{display:block;margin-top:.1em;color:var(--fg2);font-size:.75rem;line-height:1.3}}.event-provider-table .col-nowrap{white-space:nowrap}.defender-schema-table .col-action-type{width:1%;white-space:nowrap}.defender-schema-table .col-sample{width:1%;white-space:nowrap;text-align:center;font-variant-numeric:tabular-nums}.defender-schema-table td.col-sample--no{color:var(--fg2)}@media(max-width:600px){.defender-schema-table,.defender-schema-table tbody,.defender-schema-table tr,.defender-schema-table td{display:block}.defender-schema-table thead{display:none}.defender-schema-table{border-top:1px solid var(--border)}.defender-schema-table tr{border-bottom:1px solid var(--border);padding:.5em .25em;content-visibility:auto;contain-intrinsic-size:auto 84px}.defender-schema-table td{border:0;padding:0}.defender-schema-table .col-action-type{width:auto;white-space:normal;font-weight:600;overflow-wrap:break-word}.defender-schema-table .col-description{font-size:.85rem;margin:.15em 0 .2em}.defender-schema-table td[data-label]::before{content:attr(data-label) " ";color:var(--fg2)}.defender-schema-table td[data-label="Event:"]{display:block;font-size:.8rem}.defender-schema-table td[data-label="Event:"]:empty{display:none}.defender-schema-table .col-sample{display:inline;width:auto;font-size:.75rem;color:var(--fg2);padding-right:.75em;text-align:left}}.provider-overflow{margin:.6em 0 .2em;font-size:.85rem;color:var(--fg2)}.event-catalog>h1{font-size:1.15rem;margin-top:.75em;margin-bottom:0}.event-catalog-summary{color:var(--fg2);font-size:.8rem;margin-top:.15em;margin-bottom:.25em}.event-provider>h1{font-size:1.15rem;margin-top:.75em;margin-bottom:0}.event-provider>h1+.table-scroll-wrap{margin-top:1em}.event-provider>h1 .provider-raw{color:var(--fg2);font-weight:normal;font-size:.85em}.event-provider-summary{color:var(--fg2);font-size:.8rem;margin-top:.15em;margin-bottom:1em}.event-toc-table{width:100%;border-collapse:separate;border-spacing:0;border:1px solid var(--border)}.event-toc-table th,.event-toc-table td{border-right:1px solid var(--border);border-bottom:1px solid var(--border)}.event-toc-table th:last-child,.event-toc-table td:last-child{border-right:0}.event-toc-table tbody tr:last-child td{border-bottom:0}.event-toc-table tbody tr{content-visibility:auto;contain-intrinsic-size:auto 32px}.event-toc-table th{text-align:left;font-size:.8rem}.event-toc-table td,.event-toc-table th{padding:.4em .75em}.event-toc-table td a{color:var(--link)}.event-toc-table .col-event-id,.event-toc-table .col-channel,.event-toc-table .col-sample{width:1%;white-space:nowrap}.primitive-obs-table .primitive-obs-label{white-space:nowrap}.primitive-obs-table .primitive-obs-identifier{white-space:normal}@media(max-width:600px){.primitive-obs-table td{vertical-align:top}.primitive-obs-table .primitive-obs-source{min-width:9em}.primitive-obs-table .primitive-obs-label,.primitive-obs-table .primitive-obs-source a{white-space:normal;overflow-wrap:normal;word-break:normal}}.event-toc-table .col-sample{text-align:center}.event-toc-table.sublime-toc-table .col-event-id{width:auto}.event-toc-table.entra-toc-table .col-event-id{width:30rem;white-space:normal}.event-toc-table.gcp-toc-table .col-event-id{width:20rem;white-space:normal}.event-toc-table.azure-toc-table .col-event-id{width:30rem;white-space:normal}.event-toc-table.gws-toc-table .col-gws-event,.event-toc-table.gws-toc-table .col-gws-event a{white-space:normal;overflow-wrap:normal;word-break:normal}.event-toc-table.gws-toc-table .col-gws-event{width:35ch}@media(max-width:600px){.event-toc-table td,.event-toc-table th{padding-right:.4em;padding-left:.4em}.event-toc-table .col-event-id,.event-toc-table .col-event-id a{width:10rem;white-space:normal;overflow-wrap:break-word;word-break:normal}.event-toc-table.numeric-toc-table .col-event-id{width:1%;white-space:nowrap;overflow-wrap:normal}.event-toc-table .col-sample{padding-right:.3em;padding-left:.3em}.event-toc-table.entra-toc-table .col-event-id,.event-toc-table.azure-toc-table .col-event-id,.event-toc-table.esf-toc-table .col-event-id{width:10rem}.event-toc-table.gcp-toc-table .col-event-id{width:9rem}.event-toc-table.gws-toc-table .col-gws-event{width:10rem}}@media(max-width:600px){.event-toc-table.provider-toc-table,.event-toc-table.provider-toc-table tbody,.event-toc-table.provider-toc-table tr,.event-toc-table.provider-toc-table td{display:block}.event-toc-table.provider-toc-table thead{display:none}.event-toc-table.provider-toc-table{border:0;border-top:1px solid var(--border)}.event-toc-table.provider-toc-table tbody tr{padding:.5em .25em;border-bottom:1px solid var(--border);contain-intrinsic-size:auto 85px}.event-toc-table.provider-toc-table td,.event-toc-table.provider-toc-table th{border:0;padding:0}.event-toc-table.provider-toc-table td.col-event-id,.event-toc-table.provider-toc-table td.col-gws-event,.event-toc-table.provider-toc-table td.col-rt-title,.event-toc-table.provider-toc-table td.col-event-name{width:auto;white-space:normal;font-weight:600;overflow-wrap:break-word}.event-toc-table.provider-toc-table td.col-event-id a,.event-toc-table.provider-toc-table td.col-gws-event a,.event-toc-table.provider-toc-table td.col-rt-title a,.event-toc-table.provider-toc-table td.col-event-name a{overflow-wrap:break-word}.event-toc-table.provider-toc-table.esf-toc-table td.col-nowrap,.event-toc-table.provider-toc-table td.col-sample,.event-toc-table.provider-toc-table td.col-channel{display:inline;font-size:.75rem;color:var(--fg2);padding-right:.75em;text-align:left}.event-toc-table.provider-toc-table td[data-label]::before{content:attr(data-label) " "}.event-toc-table.provider-toc-table td:where(:not(.col-event-id):not(.col-gws-event):not(.col-rt-title):not(.col-event-name):not(.col-sample):not(.col-channel):not(.col-nowrap)){font-size:.85rem;margin:.15em 0 .2em}.event-toc-table.provider-toc-table.numeric-toc-table td.col-event-id{display:inline-block;min-width:3.5em;vertical-align:top}.event-toc-table.provider-toc-table.numeric-toc-table td.col-event-id+td{display:inline-block;width:calc(100% - 4.2em);vertical-align:top;margin:0}.event-toc-table.provider-toc-table.gcp-toc-table td:nth-child(3){display:block;font-size:.75rem;color:var(--fg2)}}@media(max-width:1100px){.event-toc-table.entra-toc-table .col-event-id,.event-toc-table.azure-toc-table .col-event-id{width:22rem}.event-toc-table.gcp-toc-table .col-event-id{width:16rem}}.event-toc-table .col-rt-title,.event-toc-table .col-rt-title a{white-space:normal;overflow-wrap:normal;word-break:normal}.rt-msgtype-inline{display:none}@media(max-width:600px){.event-toc-table.rt-toc-table .col-event-id{display:none}.event-toc-table.rt-toc-table .rt-msgtype-inline{display:block;margin-top:.1em;color:var(--fg2);font-size:.7rem;white-space:nowrap}}.event-entry{border-left:3px solid transparent;scroll-margin-top:calc(var(--hf-height) + 1em)}.event-entry-group{content-visibility:auto;contain-intrinsic-size:auto 0}.event-entry-group.event-active-group,html:not(.js) .event-entry-group:has(:target){content-visibility:visible}.event-entry-header{display:none}.event-entry-heading{font-size:1.15rem;margin:0;overflow-wrap:anywhere}.event-body{display:none;padding:0 .75em .75em}html:not(.js) .event-entry:target{border-left-color:var(--link);background:var(--bg2)}html:not(.js) .event-entry:target .event-body,html:not(.js) .event-entry:has(:target) .event-body{display:block}html.hash-landing .event-provider>h1,html.hash-landing .event-provider>.event-provider-summary,html.hash-landing .event-provider>.table-scroll-wrap,html.hash-landing .event-provider>.esf-grouping-note,html.hash-landing .event-provider>.esf-group-label,html.hash-landing .event-provider>.esf-section,html.hash-landing .event-provider>.provider-provenance{display:none}html:not(.js) .event-provider:has(:target):not(:has(.esf-section:target)):not(:has(.provider-provenance:target))>h1,html:not(.js) .event-provider:has(:target):not(:has(.esf-section:target)):not(:has(.provider-provenance:target))>.event-provider-summary,html:not(.js) .event-provider:has(:target):not(:has(.esf-section:target)):not(:has(.provider-provenance:target))>.table-scroll-wrap,html:not(.js) .event-provider:has(:target):not(:has(.esf-section:target)):not(:has(.provider-provenance:target))>.esf-grouping-note,html:not(.js) .event-provider:has(:target):not(:has(.esf-section:target)):not(:has(.provider-provenance:target))>.esf-group-label,html:not(.js) .event-provider:has(:target):not(:has(.esf-section:target)):not(:has(.provider-provenance:target))>.esf-section,html:not(.js) .event-provider:has(:target):not(:has(.esf-section:target)):not(:has(.provider-provenance:target))>.provider-provenance,html:not(.js) .event-provider:has(:target):not(:has(.esf-section:target)):not(:has(.provider-provenance:target)) .event-entry:not(:target):not(:has(:target)){display:none}html:not(.js) .event-provider:has(:target) .event-entry:target,html:not(.js) .event-provider:has(:target) .event-entry:has(:target){border-left-color:transparent;background:transparent;margin:0}html:not(.js) .event-provider:has(:target) .event-entry:target .event-entry-header,html:not(.js) .event-provider:has(:target) .event-entry:has(:target) .event-entry-header{display:flex;align-items:baseline;gap:.5em;padding-top:.85rem;padding-bottom:.5em;margin-bottom:.75em;border-bottom:1px solid var(--border)}.event-entry.event-active{border-left-color:var(--link);background:var(--bg2)}.event-entry.event-active .event-body{display:block}[data-event-focus-hidden],[data-event-focus-deferred]{display:none}.event-entry.event-focus-view{border-left-color:transparent;background:transparent;margin:0}.event-entry.event-focus-view .event-entry-header{display:flex;align-items:baseline;gap:.5em;padding-top:.85rem;padding-bottom:.5em;margin-bottom:.75em;border-bottom:1px solid var(--border)}.event-permalink{color:var(--fg2);text-decoration:none;font-size:.9em;opacity:0;margin-left:.3em;font-weight:400}a[data-event-focus-pending]{outline:2px solid var(--link);outline-offset:2px}.event-entry-header:hover .event-permalink,.event-entry:target .event-permalink{opacity:1}.event-permalink:hover{color:var(--link)}.provider-badge-stub{display:inline-block;font-size:.65em;padding:.15em .45em;border-radius:3px;vertical-align:middle;background:var(--badge-bg);color:var(--badge-fg)}@keyframes field-flash{0%{background-color:color-mix(in srgb,var(--accent) 35%,transparent)}100%{background-color:transparent}}tr[id*="-field-"]:target td{animation:field-flash 2s ease-out}tr[id*="-field-"]{scroll-margin-top:30vh}mark,.search-highlight{background:var(--highlight-bg);color:var(--highlight-fg);border-radius:2px;padding:0 2px}@media(max-width:600px){.mw-prefix{display:none}}.pattern,.pattern-shape{border:1px solid var(--border);border-radius:4px;padding:.9em 1em;margin-bottom:.8em;background:var(--bg1)}.pattern:last-of-type,.pattern-shape:last-of-type{margin-bottom:0}.pattern[id],.pattern-shape[id]{scroll-margin-top:calc(var(--hf-height) + 1em)}.pattern:target,.pattern-shape:target{border-color:var(--link)}.pattern .chain-line,.pattern-shape .chain-line{font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:.88em;color:var(--fg2);margin:.3em 0;display:flex;flex-wrap:wrap;align-items:baseline;gap:.25em;line-height:1.6}.pattern .chain-line .node a,.pattern-shape .chain-line .node a{color:var(--link);text-decoration:none;overflow-wrap:anywhere}.pattern .chain-line .node.cur,.pattern-shape .chain-line .node.cur{background:var(--bg2);padding:.05em .4em;border-radius:3px;border:1px solid var(--border)}.pattern .chain-line .node.cur a,.pattern-shape .chain-line .node.cur a{color:var(--fg1);font-weight:700;text-decoration:none;cursor:default}@media(hover:hover){.pattern .chain-line .node a:hover,.pattern-shape .chain-line .node a:hover{text-decoration:underline}.pattern .chain-line .node.cur a:hover,.pattern-shape .chain-line .node.cur a:hover{text-decoration:none}}.pattern .chain-line .arrow,.pattern-shape .chain-line .arrow{color:var(--fg2);opacity:.55;margin:0 .3em}.pattern .chain-line .joiner,.pattern-shape .chain-line .joiner{color:var(--fg2);opacity:.55;margin:0 .4em;font-style:italic}.pattern .chain-line .step-alts,.pattern-shape .chain-line .step-alts{display:inline-flex;align-items:baseline;gap:.2em}.pattern .chain-line .step-paren,.pattern-shape .chain-line .step-paren{color:var(--fg2);opacity:.55}.pattern .chain-line .joiner-alt,.pattern-shape .chain-line .joiner-alt{font-style:normal}.pattern .chain-line .arrow-step,.pattern-shape .chain-line .arrow-step{margin:0 .45em}.pattern .rule-group,.pattern-shape .rule-group{margin:.2em 0 .4em}.pattern .rule-group h4,.pattern-shape .rule-group h4{font-size:.78em;text-transform:uppercase;letter-spacing:.06em;color:var(--fg2);margin:.8em 0 .25em;font-weight:600}.pattern .rule-row,.pattern-shape .rule-row{display:grid;grid-template-columns:minmax(0,1fr) auto;gap:.7em;padding:.25em 0;border-top:1px solid var(--border);font-size:.95em}.pattern .rule-group .rule-row:first-of-type,.pattern-shape .rule-group .rule-row:first-of-type{border-top:0}.pattern .rule-row .title,.pattern-shape .rule-row .title{min-width:0;overflow:hidden;text-overflow:ellipsis}.pattern .rule-row .title a,.pattern-shape .rule-row .title a{color:var(--link);text-decoration:none}@media(hover:hover){.pattern .rule-row .title a:hover,.pattern-shape .rule-row .title a:hover{color:var(--link);text-decoration:underline}}.pattern .rule-row .rule-row-source-sep,.pattern-shape .rule-row .rule-row-source-sep{display:inline-block;width:4ch}.pattern .rule-row .author,.pattern-shape .rule-row .author{color:var(--fg2);opacity:.8;font-size:.88em}@media(max-width:600px){.pattern .rule-row,.pattern-shape .rule-row{grid-template-columns:minmax(0,1fr)}.pattern .rule-row .author:not(:empty),.pattern-shape .rule-row .author:not(:empty){margin-top:.15em}.pattern .rule-row .rule-row-source-sep,.pattern-shape .rule-row .rule-row-source-sep{display:none}.pattern .rule-row .sigma-source-link,.pattern-shape .rule-row .sigma-source-link{display:block;margin-left:0}}.pattern-shape details>summary{cursor:pointer;list-style:none}.pattern-shape details>summary::-webkit-details-marker{display:none}.pattern-shape details>summary .caret{display:inline-block;width:.9em;color:var(--fg2);opacity:.7}.pattern-shape details[open]>summary .caret::before{content:"▾"}.pattern-shape details:not([open])>summary .caret::before{content:"▸"}.pattern-shape .shape-details{margin-top:.2em}.pattern-shape .shape-details>summary.shape-summary{color:var(--fg2);font-size:.88em;padding:.3em 0}@media(hover:hover){.pattern-shape .shape-details>summary.shape-summary:hover{color:var(--fg1)}}.pattern-shape .shape-summary strong{color:var(--fg1);font-weight:600}.pattern-shape .pattern-purpose{margin:0 0 .4em;font-size:1.05em;font-weight:600;color:var(--fg1);line-height:1.35}.pattern-shape .shape-rules-more{margin-top:.25em}.pattern-shape .shape-rules-overflow{margin:.25em 0 0;font-size:.9em}.pattern-shape .shape-rules-more>summary{cursor:pointer;color:var(--link);font-size:.9em;width:fit-content}@media(hover:hover){.pattern-shape .shape-rules-more>summary:hover{text-decoration:underline}}.event-detection-patterns .detection-patterns-more{margin-top:.8em}.event-detection-patterns .detection-patterns-more>summary{cursor:pointer;color:var(--link);width:fit-content;list-style:none}.event-detection-patterns .detection-patterns-more>summary::-webkit-details-marker{display:none}.event-detection-patterns .detection-patterns-more>summary::after{content:" \25BE";opacity:.6}.event-detection-patterns .detection-patterns-more[open]>summary::after{content:" \25B4"}.event-detection-patterns .detection-patterns-more[open]>summary{margin-bottom:.8em}@media(hover:hover){.event-detection-patterns .detection-patterns-more>summary:hover{text-decoration:underline}}@media(max-width:480px){.event-body{padding:0 .25em .5em}.event-message{padding:.5em .5em}.pattern,.pattern-shape{padding:.6em .5em}.related-event-card{padding:.5em .5em}.detection-rules li{padding:.2em .25em}}.sigma-source-link{margin-left:.4em;font-size:.78em;color:var(--fg2);text-decoration:none;text-transform:uppercase;letter-spacing:.04em}.sigma-source-link:hover{text-decoration:underline}.event-section-prose{margin:0 0 .75em;font-size:.9em;color:var(--fg2)}.rule-eval-conditional{margin:0 0 .75rem;font-size:.88rem}.rule-eval-field{margin-bottom:.3rem;font-size:.9rem;font-weight:600;color:var(--fg1)}.rule-eval-field code{font-family:monospace;background:var(--bg1);padding:.05rem .3rem;border-radius:3px}.rule-eval-branch{display:flex;flex-wrap:wrap;align-items:baseline;gap:.25rem .5rem;padding:.15rem 0;padding-left:1.5rem;border-left:2px solid var(--border);margin-bottom:.15rem}.rule-eval-kw{font-family:monospace;font-size:.82rem;color:var(--fg2);min-width:3ch;flex-shrink:0}.rule-eval-cond{font-family:monospace;font-size:.82rem;background:var(--bg1);padding:.05rem .3rem;border-radius:3px;overflow-wrap:anywhere}.rule-eval-val{font-family:monospace;font-size:.82rem;background:var(--bg1);padding:.05rem .3rem;border-radius:3px;overflow-wrap:anywhere}@media(max-width:480px){.rule-eval-branch{padding-left:.75rem;flex-direction:column;gap:.15rem}}.esf-section{margin:1.75rem 0 0}.esf-section-heading{display:flex;flex-wrap:wrap;align-items:baseline;gap:.5rem}.esf-section-blurb{margin:.25rem 0 .75rem;font-size:.9rem;color:var(--fg2)}.esf-grouping-note{margin-bottom:1rem}.esf-group-label{margin:2.25rem 0 0;padding-top:1rem;border-top:1px solid var(--border);font-size:.8rem;font-weight:600;color:var(--fg2)}.event-section .esf-table-heading{margin-top:1.75rem;font-size:.92rem}.esf-auth-note{font-size:.85em;color:var(--fg2)}.reference-list{margin:.5rem 0 0;padding-left:1.25rem;font-size:.9rem}.reference-list li{margin:.35rem 0}.reference-list--cited{list-style:none;padding-left:0}.rule-mitre-inline{margin-left:.35em;font-size:.85em;color:var(--fg2)}.rule-mitre-inline a{color:var(--fg2)}.rule-mitre-inline a:hover{color:var(--link)}.rule-fp-inline{margin:.2em 0 0 .35em;font-size:.85em;color:var(--fg2)}.rule-fp-inline>summary{cursor:pointer;color:var(--fg2)}.rule-fp-list{margin:.25em 0 .35em 1.2em;padding:0}.rule-note-body{margin:.25em 0 .4em .6em;padding-left:.6em;border-left:2px solid var(--bg3)}.rule-note-body h1,.rule-note-body h2,.rule-note-body h3,.rule-note-body h4{font-size:.95em;margin:.5em 0 .2em 0;color:var(--fg)}.rule-note-body p,.rule-note-body ul,.rule-note-body ol{margin:.2em 0}.rule-note-body ul,.rule-note-body ol{padding-left:1.2em}.rule-note-body code{font-size:.92em}.provider-provenance .provenance-binary{margin:.4rem 0 .6rem}.provider-provenance .provenance-binary code,.provider-provenance .provenance-observation code{background:var(--code-bg);font-family:var(--font-mono);font-size:.85em;padding:.05em .35em;border-radius:4px;word-break:break-all}.provenance-sources{margin:.4rem 0 0;padding-left:1.2rem}.provenance-sources li{padding:.2rem 0;font-size:.9rem;line-height:1.4}.provenance-observations{list-style:none;margin:0;padding:0}.provenance-observation{padding:.4rem 0;border-top:1px solid var(--border);color:var(--fg2);font-size:.9rem}.provenance-observation:first-child{border-top:0;padding-top:0}.provenance-observation .obs-build{color:var(--fg1);font-family:var(--font-mono)}.provenance-observation .obs-method{color:var(--fg2)}.provenance-observation .observation-download{color:var(--link);white-space:nowrap}.provenance-obs-label{margin:.7rem 0 .2rem;color:var(--fg2);font-size:.9rem}.provenance-observation .obs-note{margin:.3rem 0 0;font-size:.85rem;line-height:1.4}.provider-provenance .provenance-subhead{margin-top:1em}.provider-download-list{list-style:none;margin:0;padding:0}.provider-download-list li{padding:.2rem 0;color:var(--fg2);font-size:.9rem}.provider-download-list a{color:var(--link);font-family:var(--font-mono);word-break:break-all}.download-kind{margin-left:.4rem;padding:.03em .4em;background:var(--badge-bg);color:var(--badge-fg);border-radius:4px;font-size:.72em;text-transform:uppercase;white-space:nowrap}